Mobile Forensics Course Catalogue

Transcription

1 Mbile Frensics Curse Catalgue

2 Mbile Device Frensics 101 Beginner Three-Day Instructr-Led Curse This three-day curse prvides the knwledge and skills necessary fr entry level mbile device examiner t gain a basic understanding f hw cellular devices stre data, hw cellular netwrks functin, cllecting evidence and preserving it, methds fr radi frequency interruptin, trubleshting cnnectins, verifying results, and the frensic prcess. Prerequisites: T btain the maximum benefit frm this class, yu shuld meet the fllwing requirements: Able t understand curse curriculum presented in English Perfrm basic peratins n a persnal cmputer Have a basic knwledge f cmputer frensic investigatins and acquisitin prcedures Be familiar with the Micrsft Windws envirnment Class Materials and Sftware: Yu will receive the assciated materials prir t the curse. During this three-day, hands-n class, participants will review the fllwing: Histry f Mbile Frensics and device examinatins Cellular Netwrks Legal Cnsideratins (US classes nly) Subscriber Identify Mdules GSM, CDMA, and iden Handsets Call Detail Recrds Trubleshting yur cnnectins Cmmercial Sftware Acquisitins Verifying yur findings Yur Frensic Prcess The class includes multiple hands-n labs that allw students t apply what they have learned in the wrkshp. (Cntinued n ther side)

3 Mbile Device Frensics 101 Beginner Three-Day Instructr-Led Curse (Cntinued) Mdule 1: Intrductin Tpics: Sftware used in this curse Oxygen Frensic Suite Cellebrite MPE+ Utilities Curse Overview Mdule 2: Overview f Mbile Frensics Prvide a brief histry f mbile phne examinatins List the types f data yu shuld lk fr n mbile devices List the different sftware applicatins used in this curse fr mbile device examinatin Describe methds f extracting data manually (if n sftware applicatins are available) Mdule 3: Cellular Netwrks Explain hw mbile phnes cmmunicate n cellular netwrks Explain hw cell sites are cnfigured Prvide a brief histry f mbile netwrk technlgy (2G, 3G, and 4G) Identify the parts f a cellular netwrk Mdule 4: Legal Issues Prvide an verview f case laws that deal with legal issues regarding device and electrnic data seizure Identify what paperwrk is needed t: Cnduct physical exams f seized devices Obtain histrical recrds frm the cell phne prvider Retrieve live lcatin infrmatin Mdule 5: Subscriber Identity Mdule Cards Lcate the fllwing types f data cntained n a Subscriber Identity Mdule (SIM) card: Internatinal Mbile Subscriber Identity (IMSI) Integrated Circuit Card Identifier (ICC-ID) User s stred phne numbers (AND) Dialed numbers (LND) SMS text messages (SMS) Deleted SMS messages Area where the user last pwered dwn the phne (LOCI) electrnic data seizure Mdule 6: Using SimCn SIM Card Recvery Use SIMCn (SIM Cntent Cntrller) t analyze and recver data frm SIM cards Recver deleted text messages that are stred n the card Enter a PIN cde if the card is PIN prtected Unlck the card using a PUK cde if the card is PIN prtected and yu d nt knw the PIN Read bth SIM and USIM cards Print a reprt f the files that are f evidentiary value Exprt items t files that can be imprted in ppular spreadsheet prgrams

4 Mbile Device Frensics 101 Beginner Three-Day Instructr-Led Curse (Cntinued) Mdule 7: Handsets Recgnize the fllwing types f mbile handsets and identify where yu can find data n them: GSM iden TDMA CDMA Mdule 8: Prcessing Guidelines Fllw frensically sund prcesses t examine and extract data frm mbile devices Validate the sftware yu are using t examine the device Fllw prper prcesses t examine the mbile phne Islate the device frm the netwrk Lcate lck cdes, phnebk, ESN, and s n Lcate key files Validate the examinatin prcess Create a Frensic SIM Mbile Phne Examiner Plus Mdule 10: Sftware/Hardware Examine mbile phnes using the fllwing sftware: Oxygen Frensic Suite Mbile Phne Examiner Plus Cellebrite (Overview Only) Mdule 11: Manual Examinatins Explre the fllwing manual methds f examining mbile devices when sftware is nt available r when sftware des nt wrk: Fernic ZRT Prject-a-Phne Making screenshts Mdule 12: Case Presentatin Present the case after yu have examined the devices and extracted data Mdule 9: Trubleshting Trublesht the fllwing cmmn prblems: Cmmunicatin Sftware Cables and cnnectins Data that cannt be extracted Prducts that wrk while thers dn t

5 Mbile Phne Examiner Plus Beginner Three-Day Instructr-Led Curse This curse trains participants hw t effectively use MPE+ t prcess evidence frm mbile devices, which can include GPS devices and remval strage. This curse cvers the fllwing tpics: the MPE+ interface, cllectins frm handsets and SIM cards, extractin f physical data frm varius device types like ios and Andrid, parsing data, searching, bkmarking, visualizatin, incrpratin f MPE+ Tablet and Investigatr, exprt and reprting. Prerequisites: T btain the maximum benefit frm this class, yu shuld meet the fllwing requirements: Able t understand curse curriculum presented in English Perfrm basic peratins n a persnal cmputer Attend the AccessData MDF 101 curse r equivalent experience with MPE+ and FTK Have previus investigative experience in mbile frensic case wrk Class Materials and Sftware: Yu will receive the assciated materials prir t the curse. (Cntinued n ther side)

6 Mbile Phne Examiner Plus Beginner Three-day Instructr-Led Curse (Cntinued) Mdule 1: Intrductin Tpics: Student Intrductins Helpful infrmatin Upgrades and Supprt MPE+ Certificatins Curse Outline Mdule 2: MPE+ Interface Discuss different licensing ptins Discuss and learn the MPE+ Interface Imprt and exprt data Imprt multiple frmats Break dwn the AD1 frensic cntainer Lab: Participants imprt an AD1 image int MPE+, then recver specific infrmatin and artifacts. Participants then exprt the parsed infrmatin t a separate AD1 image file. Mdule 3: MPE+ Data Acquisitin Discuss prcessing guidelines Extract data frm a SIM and USIM (UICC) Extract data frm a mbile device Extract data frm a smart device ios Andrid Lab: Participants cnduct an extractin f a SIM card and a mbile phne with MPE+, then navigate the exprted data t cllect specific artifacts. Participants als use MPE+ t create a frensic SIM card and parse data frm an itunes backup file. Mdule 4: MPE+ Advanced Features Utilize the fllwing features in MPE+ Image munting SQL Builder SQLite dataset viewer Native file exprt Lab: pythnscripter Data parsers Filtering data SQLite prcessing features Visualizatin Alerts Participants have hands-n pprtunity t wrk with advanced features in MPE+. During the labs in this curse, participants perfrm the fllwing: Munt an image Carve data frm unallcated space in a mbile device s file system Parse Andrid, ios, and BlackBerry IPD images Read ios and Andrid SQLite database files Use FreeFile parser t recver deleted text frm free pages in SQLite database files Create filters t narrw data results Exprt native files and flders Create timeline and scial visualizatin charts, then frmat the data in a cluster chart Mdule 5: MPE+ Reprting Discuss the varius reprt frmats Discuss adding bkmarked items t a reprt Explain exprting vs. reprt preview Learn t generate a final reprt Use MPE+ Investigatr Mdule 6: MPE+ Velcitr Discuss the challenges f Chinese handsets Discuss binary extractins Discuss the hardware utilized fr extractin Explain.BIN and.ad1 Velcitr files Lab: Participants extract a physical image frm a phne with a Chinese chipset using MPE+ Velcitr. Students cnduct a frensic analysis f the.ad1 image and create a reprt f their findings.

7 ios Frensic Analysis This curse prvides the knwledge and skills necessary fr mbile device examiners t gain a understanding f hw ios devices stre data. We will uncver the ways t capture the data frm these devices and perfrm a frensic analysis n the data with autmated tls as well as manually s that the examiner may verify the findings f the tls they are using. This curse uses a multi-tl apprach t ios frensics. We use bth free and paid applicatins and teach the skills needed t find and prcess the data with the aid f specialized sftware tls. There is n single tl that will prcess every cellular device in its entirety. Yu will be trained t knw where infrmatin lies n the ios device and ther lcatins where data may be lcated. During this curse, participants will review the fllwing: Histry f ios Plists and SQLite itunes including backups and iclud Jailbrken devices SMS breakdwn imessage Call Lg Breakdwn Cmmercial Sftware Acquisitins Verifying yur findings Prerequisites: T btain the maximum benefit frm this class, yu shuld meet the fllwing requirements: Able t understand curse curriculum presented in English Attendance at the MDF 101 Curse r equivalent Perfrm basic peratins n a persnal cmputer Have a basic knwledge f mbile device frensic investigatins and acquisitin prcedures Be familiar with the Micrsft Windws envirnment Class Materials and Sftware: Yu will receive the assciated materials prir t the curse. (Cntinued n ther side)

8 ios Frensic Analysis (Cntinued) Mdule 1: Objectives Discuss the histry f ios Review Apple s idevices and their generatins alng with their capabilities Discuss Jail Brken ios device and their significance in mbile device frensics Cydia and ther third party stres Discuss itunes and its imprtance in frensic examinatins Discuss the different types f itunes backups Challenges f encrypted backups Intrductin t SQLite and Plists, including different types f Plists and the challenges assciated with them Parse itunes backup files with free and cmmercial tls Breaking dwn and carving fr Plists in hex Mdule 3: Discuss the imprtance f validating autmated frensic sftware Diving in the hexadecimal data cntained within a SQLite database which includes SMS, Call Histry, Cntacts, etc. Lcating the ffsets f imprtant data in rder t cnduct a prper validatin Recgnizing and lcating deleted data cntained within a SQLite database Mdule 2: Objectives Discuss the ios file system and partitin cnfiguratin Methds and challenges when extracting files frm an ios device Discuss Device Firmware Update (DFU) mde Demnstrate the use f MPE+ in extracting evidence frm an ios device Navigate and lcate t key evidence lcatins within the ios file system Discuss SQLite Schema and the imprtance f Tables t frensic examiners Demnstrate flag and ther items f interest within the SQLite table structure

9 BlackBerry Frensic Analysis This curse cvers the particulars f the hardware, which includes the stred data available fr analysis and the BlackBerry backup file. This curse als discusses the best ptins t capture the data frm BlackBerry devices. Yu as the examiner will be armed with the ability t perfrm frensic analysis bth using autmated tls and manual methds (result verificatin). This curse uses a multiple-tl apprach t mbile phne frensics. It uses bth free and cmmercial applicatins and teaches the skills needed t find and prcess data with the aid f specialized sftware tls. There is n single tl that will entirely prcess every cellular device. Syntricate trains yu t knw where infrmatin is lcated n cell phnes and hw t extract that infrmatin -bth with and withut tls s yu can btain the maximum amunt f data frm mbile devices. Prerequisites: This curse is intended fr frensic prfessinals and law enfrcement persnnel wh must cnduct mbile device examinatins utilizing multiple tls and a tested frensic prcess. T btain the maximum benefit frm this class, yu shuld meet the fllwing requirements: Able t understand curse curriculum presented in English Perfrm basic peratins n a persnal cmputer Attend the AccessData MDF 101 curse r equivalent Be familiar with Blackberry devices Class Materials and Sftware: Yu will receive the assciated materials prir t the curse. (Cntinued n ther side)

10 BlackBerry Frensic Analysis (Cntinued) Mdule 1: Intrductin Tpics: Student Intrductins Sftware used in this curse BlackBerry Desktp Sftware ABCAmber BlackBerry Cnverter / BlackBerry Backup Explrer BlackBerry Simulatr MPE+ FTK Rubus Curse Outline Mdule 2: BlackBerry Histry Describe the prgressin f the keybard styles, mdel numbers, and style names Lcate mdel infrmatin including user manuals Identify netwrk frmats Mdule 3: BlackBerry Hardware Describe the infrmatin cntained n the device label Explain infrmatin fund n the external memry card Explain why netwrk islatin is imprtant and the result f installing the handset battery Mdule 4: Data Cntents Understand and prevent cntent wipe Describe the cmplicatins f a lcked handset Identify which carrier is assciated with the handset Understand the many databases cntained n the BlackBerry Understand the BBM prcess, including backup and lgging Mdule 5: Desktp Sftware Set up and cnfigure a simulatr Lcate the current versin f the sftware based n cuntry f rigin and perating system Prperly install the sftware s as t avid data cntaminatin Create a backup file and dcument the prcess Mdule 6: Backup Files Identify the unique phrasing f the file header fr a keywrd search n a cmputer Identify the cntent differences between a Windws and a Mac backup file Reslve the issue f an encrypted backup file Mdule 7: Tls Identify the unique phrasing f the file header fr a keywrd search n a cmputer Identify the cntent differences between a Windws and a Mac backup file Reslve the issue f an encrypted backup file Lab: Exprt BlackBerry backup files Use MPE+ t prcess a BlackBerry Prcess files int FTK Mdule 8: Practical This final practical tests participants cmprehensin f the entire curse

11 Andrid Analysis This curse cvers the internals f Andrid devices, the way the OS is designed, and the way that the devices stre data. We will uncver the way t capture these devices data. In the end, yu as the examiner will be armed with the ability t perfrm frensic analysis bth using autmated tls as well as manually (t duble check the results f the tls). This curse uses a multiple-tl apprach t mbile phne frensics. We use bth free and paid applicatins and teach the skills needed t find and prcess data with the aid f specialized sftware tls. There is n single tl that will prcess every cellular device in its entirety. Syntricate trains yu t knw where infrmatin lies n cell phnes and hw t extract that infrmatin bth with and withut tls s yu can btain the maximum amunt f data frm mbile devices. Prerequisites: This curse is intended fr frensic prfessinals and law enfrcement persnnel wh must cnduct mbile device examinatins utilizing multiple tls and a tested frensic prcess. T btain the maximum benefit frm this class, yu shuld meet the fllwing requirements: Able t understand curse curriculum presented in English Attend the MDF 101 Curse r equivalent Have previus investigative experience in mbile frensic case wrk Be familiar with Andrid devices Be familiar with wrking in hex Class Materials and Sftware: Yu will receive the assciated materials prir t the curse. (Cntinued n ther side)

12 Andrid Analysis (Cntinued) Mdule 1: Class Overview Objectives Student Intrductins Sftware used in this curse Andrid SDK and Eclipse MPE+ FTK SQLite DB Viewer Cmmand line Curse utline Mdule 2: Andrid Overview Review basic principles f the Andrid device and the Andrid perating system Describe hw Andrid uses NAND t stre data Describe the Dalvik VM in Andrid Outline the usage and installatin f the Andrid SDK and emulatr Discuss SD cards and Emulated SD cards Mdule 3: Frensic Prcess Recmmend ways t cllect an Andrid device Challenges f netwrk islatin with Andrid Gathering infrmatin abut specific Andrid devices Validatin and Reprting Mdule 4: Andrid SDK and Eclipse SDK and Eclipse installatin and verview Discuss the Andrid Debug Bridge Andrid Virtual Devices and frensics Discuss the purpse f the USB debugging Mdule 5: Andrid File Systems Outline the varius file systems used by Andrid Discuss the frensic challenges f YAFFS Discuss the ther file systems used by Andrid Hw can examiners utilize the Andrid temp memry Mdule 6: Andrid Partitins What partitins can an examiner expect t find n an Andrid device Discuss where Andrid typically stres files f interest and what partitin they may be lcated Discuss files f interest that may be lcated n a SD card Discuss what it means t be rt Mdule 7: Andrid Lgical Acquisitin Discuss the tls t extract data frm an Andrid device Trublesht cnnectivity issues the examiner may encunter Learn the different mdes when cnnecting an Andrid device Discuss ADB cnflicts Mdule 8: Andrid Physical Acquisitin Discuss the tls and techniques used t extract physically frm an Andrid device Discuss NAND vs DD physical extractins The recvery partitin and what des it mean Challenges f custm ROMs Mdule 9: Lcatin f SQLite files f interest Discuss where key SQLite files live in the file system Discuss and lcate clumn flag meanings Discuss tables Lab: Using varius tls, parse SQLite database files Lcate and understand their links t ther tables

13 Andrid Analysis (Cntinued) Mdule 10: SQLite hex breakdwn Cmpare and discuss parsed SQLite data with that fund in hex Discuss deleted data Lab: Manually parse SQLite database files Lcate and examine deleted data in hex

14 SIM Frensic Analysis This curse prvides the knwledge and skills necessary t extract and analyze the data fund n SIM cards. SIM cards are used in mbile phnes, tablet cmputers (ipad and Andrid), and laptp cmputers. Students will be expsed t SIM, USIM, R-UIM, CSIM, and UICC technlgies as it applies t mbile devices, learn the SIM file system structure, learn artifact lcatins fr key functins f the SIM, describe the naming cnventin f files stred n a SIM. Students will als learn hw the autmated frensic suites are creating a Frensic SIM by finding the needed files in hex, reading them, and then writing them t a SIM. Prerequisites: T btain the maximum benefit frm this class, yu shuld meet the fllwing requirements: Able t understand curse curriculum presented in English Perfrm basic peratins n a persnal cmputer Have a basic knwledge f mbile device frensic investigatins and acquisitin prcedures Be familiar with the Micrsft Windws envirnment Class Materials and Sftware: Yu will receive the assciated materials prir t the curse. (Cntinued n ther side)

15 SIM Frensic Analysis (Cntinued) Mdule 1: Intrductin Student Intrductins Wrkshp bjectives Mdules verview Install required applicatins Mdule 2: SIM Overview SIM Specificatins PIN PUK CPU USIM R-UIM CSIM UICC Flash Mdule 3: File System Master File, Dedicated Files, and Elementary Files Artifact Lcatins SMS Call Histry Lcatin Infrmatin Card Identity Subscriber Identity Phne Bk Frbidden Netwrks Mdule 4: Frensic SIM MPE+ AD Mbile SIM Xplrer Manual Creatin f Frensic SIM APDU Cmmands Mdule 5: File Carving SIM file naming cnventin Lcating hidden files n a SIM Manual interpretatin SMS Call Histry

16 Andrid Malware Advanced One-Day Instructr-Led Curse This ne-day curse prvides the knwledge and skills necessary t analyze Malware within the Andrid perating system. It will help students understand the Andrid perating system, the vulnerabilities, Andrid Malware types, distributin pints, APK file and mdificatin, static vs dynamic analysis, and methds t uncver Malware n a mbile device. During this curse, participants will review the fllwing: Andrid Operating System Dalvik VM APK files Permissins File Lcatins Andrid Malware Types and distributin Andrid Analysis Static Dynamic Prerequisites: T btain the maximum benefit frm this class, yu shuld meet the fllwing requirements: Able t understand curse curriculum presented in English Perfrm basic peratins n a persnal cmputer Have a basic knwledge f mbile device frensic investigatins and acquisitin prcedures Be familiar with the Micrsft Windws envirnment Class Materials and Sftware: Yu will receive the assciated materials prir t the curse. Tpics: Andrid OS types/versin Vulnerabilities and Permissins Rt/Nn Rt Malware Types Malware Distributin Pints APK Overview Lcating the Malware n the device APK file dissectin Static Analysis using Apkinspectr Dynamic Analysis using Wireshark Determining what the Malware is ding Cmparisn f Malware and nrmal APKs