NETS1032

Mobile Device Forensics

Introduction

This module provides some conceptual and practical information on doing forensic investigations of mobile devices, in particular cellular phones and tablets.

Learning Objectives

At the end of this module, students will:

• Learn about the unique characteristics of mobile devices and the tactics used by forensic investigators to work with these devices
• Observe investigative tools and techniques to analyze mobile devices and extract artifacts of interest to an investigation

These objectives are in support of Learning Outcomes 2, 3, 4, and 5 in the Course Outline.

To do List

• Watch the videos listed below
• Review the materials linked below
• Discuss topic in class
• No lab or quiz for this topic

Lesson Material

• Cellphone Forensics talk by Simon Varley (overview of mobile investigations for use in USA legal proceedings 1:04:23)
• The Incident Response Playbook for Android and iOS - SANS DFIR Summit 2016 (where mobile forensics fits into incident reponse 26:47)
• Smartphone Forensics Investigations: An Overview of Third Party App Examination (discussion on challenges of investigating mixed software environments 19:22)
• Introduction to iLEAPP - IOS Forensics Made Easy by 13Cubed (tool-specific 14:36)
• BelkaTalk on DFIR - a playlist of topics related to mobile device data acquisition using advanced Belkasoft tools - (tool-specific 17 videos, less than one hour total)
• Mobile Forensics For Litigation using Cellebrite (tool-specific 17:49)

Learning Activity

• View the videos linked above
• Discuss in class

Graded Activity

There is no graded lab activity for this topic.

Quiz

There is no quiz for this topic.

Summary

In this module, we introduced conceptual and practical information on doing forensic investigations of mobile devices, in particular cellular phones and tablets. You should have:

• Gained awareness of the unique characteristics of mobile devices and the tactics used by forensic investigators to work with these devices
• Observed use of investigative techniques to analyze mobile devices and extract artifacts of interest to an investigation