Smartphone Forensics
- Who it is for
- Examiners and responders who already handle computers and need phones, law enforcement and legal professionals, and insurance and accident investigators.
- Prerequisites
- Comfort with a file system, a command line and SQLite at the level of Appendix A modules 02 to 04.
- Time
- 13 modules, 2 to 4 hours each, planning estimate.
- Status
- First modules: launch date to be announced. Module 00 is free when released; enrollment is not open.
See membership pricing, free access and team seats.
The labs analyze provided extractions and lab devices with known passcodes. The path does not teach bypassing a lock on a device you do not control. Acquisition from a locked current-generation device is described, not performed.
Two matters. Thirteen deliverables.
Matter A is a collision: a courier for the fictional Redfern Couriers is in a crash at 07:40 and the insurer asks whether his Android phone was in use. Matter B is an internal fraud at the fictional Northgate Credit Union: a suspect's iPhone, an accomplice's Android, an encrypted messaging app they shared, and an app on the accomplice's phone that should not be there.
The order is the order the devices arrive and the questions get asked, not any vendor's section order.
On smaller screens, scroll each table horizontally to read every column.
| # | Module | Opens on | You build | Lab on SIFT | Hours | Status |
|---|---|---|---|---|---|---|
| 00 | A phone on the desk | The insurer calls at 09:15: was the courier's phone in use at 07:40? The phone is in an evidence bag, screen dark | An intake plan for a mobile device: isolation, power and passcode state, scope of consent or warrant, what extraction is possible and what each type leaves out | Yes: Redfern and Northgate synthetic set. Isolate a lab device, document its state, choose and justify an extraction type, open the case log | 2 to 4, planning estimate | Free (on release) |
| 01 | Get the data off the device | The Android is unlocked and at 30 percent | An acquisition record: extraction type, tool, hashes, and a coverage table of what was and was not captured | Yes: Redfern and Northgate synthetic set. Perform a logical and a file-system acquisition of the Matter A lab device; hash and compare their contents | 2 to 4, planning estimate | Planned |
| 02 | SQLite is the evidence | The messaging database has rows the app no longer shows | A database analysis method: schema reading, write-ahead log, freelist pages, deleted-record recovery, timestamp formats and time zones | Yes: Redfern and Northgate synthetic set. Parse a messaging database with its WAL on SIFT; recover deleted rows; convert four timestamp formats to one timeline | 2 to 4, planning estimate | Planned |
| 03 | Android: where the system keeps the truth | Was the screen on at 07:40, and was anyone touching it | An Android system-activity timeline: usage statistics, battery statistics, screen state, notifications, location, call and SMS logs | Yes: Redfern and Northgate synthetic set. Android system artifacts on the Matter A image, built into a minute-by-minute timeline around 07:40 | 2 to 4, planning estimate | Planned |
| 04 | Android: what the apps recorded | The courier says he was using navigation hands-free | An application analysis report for the navigation, messaging and media apps: what each stored, when, and what the user did | Yes: Redfern and Northgate synthetic set. App data directories, app databases, shared preferences and media metadata on Matter A | 2 to 4, planning estimate | Planned |
| 05 | The collision report | The insurer's counsel wants a one-page answer and an appendix they can defend | The Matter A report: device activity around 07:40 with confidence levels, what the evidence cannot say, and the exhibits | Yes: Redfern and Northgate synthetic set. Assemble from modules 01 to 04; a second learner reviews against a checklist | 2 to 4, planning estimate | Planned |
| 06 | iOS: acquire what you can, know what you cannot | Matter B opens: the fraud suspect surrenders a locked iPhone and a laptop with a backup on it | An iOS acquisition decision record: backup versus full file system, encryption state, keychain, and what each extraction type excludes | Yes: Redfern and Northgate synthetic set. Compare the provided encrypted backup with the full file system extraction of the Matter B device; table the coverage gap | 2 to 4, planning estimate | Planned |
| 07 | iOS: the file system tells time | When did the suspect first contact the outside account holder | An iOS system-artifact timeline: knowledge and interaction databases, power log, locations, Safari, call history, messages | Yes: Redfern and Northgate synthetic set. iOS system artifacts on the Matter B extraction; build the first-contact timeline | 2 to 4, planning estimate | Planned |
| 08 | iOS: inside the apps | The transfers were approved in a banking app and discussed in a notes app | An iOS application analysis report: app containers, property lists and SQLite stores, caches, what the user saw and did | Yes: Redfern and Northgate synthetic set. iOS app containers on Matter B: notes, mail, the banking app's cache, photo metadata | 2 to 4, planning estimate | Planned |
| 09 | Third-party apps, both platforms | The suspect and the accomplice used an encrypted messaging app and a ride-share app | A cross-device application analysis: which artifacts survive on each platform, how the two devices corroborate each other, how a message is attributed to a person | Yes: Redfern and Northgate synthetic set. Parse the third-party app data on the iPhone (Matter B) and the accomplice's Android; join the two sides of the conversation | 2 to 4, planning estimate | Planned |
| 10 | Cloud, backups and what the device forgot | Messages deleted from the phones exist somewhere else | A recovery plan across local backups, synced caches and a cloud return obtained under legal process, with a gap table | Yes: Redfern and Northgate synthetic set. Analyze the local backup and the synthetic cloud return against the device images; recover deleted media and messages | 2 to 4, planning estimate | Planned |
| 11 | The app that should not be there | The accomplice's Android has an app that drains the battery and uploads at night | A mobile malware analysis memo: permissions, install source, network behavior, persistence, and what data it could reach | Yes: Redfern and Northgate synthetic set. Static and behavioral triage of the synthetic malicious APK on SIFT, plus a configuration-profile abuse case on iOS; indicators extracted | 2 to 4, planning estimate | Planned |
| 12 | Tell the fraud story across two phones | The credit union's board and the prosecutor each need the same facts told differently | The Matter B report and exhibit set: a merged two-device timeline, attribution reasoning, application and malware findings, limitations; plus a ten-minute briefing | Yes: Redfern and Northgate synthetic set. Assemble; second learner reviews against a checklist; deliver the briefing | 2 to 4, planning estimate | Planned |
Labs on SIFT.
The Redfern and Northgate synthetic set comprises a full file system image of the Matter A Android, a full file system extraction and an encrypted backup of the Matter B iPhone, a full file system image of the accomplice's Android, a synthetic malicious APK, and a synthetic cloud return. The curriculum specifies lab devices with scripted activity, licensed to DFIR.com and versioned. Evidence downloads will accompany released modules.
Install SIFTPlanned access: module 00 free; subscription $149 per month or $1,290 per year. No payment is being collected here.
Last reviewed . Curriculum source: Appendix I supplied by DFIR.com. Contribute a module.
Hear when the smartphone modules open.
One email when there is something to learn from. No payment, nothing to buy.
Last reviewed