With over 9 Billion wireless subscriptions worldwide as of 2016, every criminal investigation involves information that can be captured from a digital device, including phones and tablets. Understanding what information can be obtained from these devices, as well as how to collect and preserve the information legally is critical. This course will cover various digital devices, how wireless and cellular networks operate, and review data and information that can be obtained from carriers, devices, and the web. Attendees will be exposed to FTK Imager and Autopsy, open source tools for digital device imaging, as well as commercial products including Paraben’s E3:DS (Device Seizure) and HTCI’s MapLink and DART tools.  Students will conduct practical exercises on mobile devices and learn how to create presentations and reports that meet law enforcement legal requirements.

Class Overview:

Day 1

• Overview of the Digital Evidence cycle Collection, Preservation, Evaluation, Report (CPER) model
• Introduction to Open Source Forensic Tools: FTK Imager and Autopsy
• Conduct a sample case to show the power of FTK and Autopsy in a hands on case environment 

Day 2

• Cell Phone collection overview
• Using Paraben DS to collect cellphone data from the handsets
• Using DART to correlate multiple cellphone extractions for a case file
• Using Call Detail Records (CDR) in your investigations including MapLink to create plots and reports
• Hands on practical exercise using the cellphone collection tools to produce evidence.