COURSE DETAILS
WHY APP DATA FORENSICS?
Applications (apps) are at the centre of almost every modern investigation. Full file-system extractions provide a wealth of potential evidence and intelligence, but as new apps appear your vendor tools may struggle to keep pace with decoding significant data. Many apps leave behind a rich trail of data — but only if you know where to look and how to interpret what you find.
App Data Forensics goes beneath the surface of those applications which are significant to your investigation, breaking down exactly how the app stores its data, what artefacts are created by user activity, and how those artefacts can be located, interpreted and presented as evidence. Delegates will work directly with SQLite databases, property lists, cache files and other data storage mechanisms.
By understanding the internal architecture of the apps your subjects use, you will be better equipped to identify evidence that vendor tools may not decode, challenge incomplete extraction reports, manually validate vendor tool output and deliver thorough and defensible findings.
WHO WILL BENEFIT
This course is designed for digital forensic practitioners who may be required to perform data investigation and analysis, and want to move beyond automated tool output to a deeper, artefact-level understanding of evidentially significant apps encountered in investigations.
- •Digital forensic examiners & analysts
- •Law enforcement forensic units
- •Corporate investigation and eDiscovery teams
- •Laboratory managers seeking deeper app analysis capability
WHAT WE TEACH ON THIS COURSE
App Data Forensics provides in-depth, hands-on training in app-level forensic analysis for both iOS and Android platforms. Working with real app data, students will learn to identify, decode and interpret the most significant artefacts and be able to present their findings to 3rd parties in a clear and intelligible format. Topics covered include:
PRE-COURSE REQUIREMENTS
Delegates should have a working knowledge of digital forensic principles and have conducted device examinations using standard extraction tools such as Cellebrite UFED, MSAB XRY or Magnet AXIOM. No prior app development knowledge or scripting experience is required. An understanding of iOS and Android file system structures is beneficial but not essential.
UPCOMING DATES
Dates are being finalised. Contact us to register interest or discuss scheduling or on-site delivery.