The IACIS Advanced Mobile Device Forensics course is a 36-hour program delivered over five consecutive days. It is designed for experienced forensic examiners and investigators who want to develop a deeper technical understanding of how data is structured, stored, and extracted from modern mobile devices.
Rather than focusing solely on tool-based examinations, this course centers on the underlying data structures that power mobile applications and operating systems. Students learn to analyze databases, serialized data formats, and proprietary storage methods that are often only partially parsed by commercial forensic tools. This approach equips participants to manually interpret and extract data when automated solutions fall short.
A core component of the course is the use of Python scripting to parse data stores, automate extraction processes, and build custom solutions for unique forensic challenges. Participants gain hands-on experience writing and adapting scripts to recover and interpret complex application data.
The course also addresses identification of malicious or anomalous data artifacts, giving students methods to recognize and investigate suspicious behavior within data sets. Training includes extensive practical exercises and real-world examples to reinforce concepts.
By the end of the course, participants will have a stronger command of data structure analysis, the ability to move beyond push-button forensics, and the technical skills to design custom workflows for advanced mobile device investigations.
