Training Courses
Table of Contents Introduction to MSAB Training Department... 01 Training Services Overview... 02 XRY Certification training... 03 XRY Intermediate training... 04 Advanced Acquisition training... 05 Advanced Apps Analysis training... 06 Kiosk & Tablet training... 07 XRY Refresher training... 08 XAMN Certification training... 09 Train-the-Trainer course... 10 On-site training the advantages... 11 The Training Passport... 12 The biggest division between mobile phone examiners is not the tools, but their knowledge and experience.
Training Courses 01 INTRODUCTION TO MSAB TRAINING DEPARTMENT WHEN YOU WANT TO STAY AHEAD Welcome to the Training Department of MSAB a team of dedicated professional instructors from around the globe who can teach you how to get the best from our technology. Our qualified trainers have hands on real world experience. If you are going to invest in mobile forensic technology, then it makes sense to ensure you can get the very best return out of your investment. Pressing the buttons is just the beginning of the journey. You need to understand what is being recovered and why, in order to do your job to the best of your abilities. INDUSTRY RECOGNIZED CERTIFICATE Whether you are an experienced phone examiner or a brand-new investigator, MSAB Training can help you increase your knowledge and skills. You will become more experienced, productive and efficient in performing the forensic recovery of data from mobile devices. Successful completion of our courses and assessment will result in the issue of an industry recognized certificate. This will help demonstrate your ability to meet the required competencies of a modern mobile forensic examiner. OUR METHOD We teach by letting you get hands-on with devices, rather than simply lecturing. You can obtain an industry recognized Certificate for each of the following courses: XRY Certification 2 days XRY Intermediate 3 days Advanced Acquisition (AA) 4 days HEX Refresher 1 day Advanced Apps Analysis (AAA) 5 days Kiosk & Tablet 1 day Kiosk Admin 1 day Investigator 1 day XRY Refresher 1 day XAMN 1 day Find our updated training schedule at: www.msab.com/training/schedule
Training Courses 02 TRAINING SERVICES OVERVIEW Our dedicated training team can offer a wide variety of tailored courses either at advertised open courses around the world: www.msab.com/training/schedule or alternatively we can deliver tailor made courses developed for your particular needs on-site at your premises. WE OFFER THE FOLLOWING CERTIFICATION COURSES KIOSK & TABLET Basic mobile forensics training, this is the essential certification course designed for frontline staff and administrators who use Kiosk within their organization. XRY CERTIFICATION These courses are designed for professionals who specialize in mobile forensics. The courses cover everything you could possibly need to know through a series of training sessions Certification > Intermediate > Advanced Acquisition > Advanced Apps Analysis. INVESTIGATOR COURSES Information from mobile devices is impacting all aspects of investigations and is no longer an isolated specialism. This course gives detectives, analysts and intelligence operatives an overview of mobile forensics so they understand how best to handle the information from initial seizure, extraction and analysis of forensic phone reports to giving evidence in court. REFRESHER TRAINING We offer courses specifically designed for students who already have attended XRY certification training courses in the past, but need to get up to date with the latest versions. This course will get you back up to speed with the latest features in this fast moving industry and ensure your existing XRY certification remains valid and introduces you to time saving features that will make you more efficent in your line of work. XAMN CERTIFICATION This course is purpose designed to help professionals who review mobile phone data in their roles. The XAMN analytical tool allows users to review up to 50 phone extractions to draw comparisons and maximize the full functionality of this software. TRIAGE TRAINING This is training for specialists who need to use XRY in covert operations to gather information rapidly and avoid detection. Due to the nature of this work interested parties should contact us for more detailed information. ACADEMIC TRAINING We deliver bespoke training options designed to embed the standard XRY training courses into modules for digital forensic degree courses at academic institutions. TRAIN-THE-TRAINER If you have embedded XRY or XAMN into your organization and expect to have to train 25 members of staff or more, then talk to us about this option. It s highly likely that it will be more cost effective and provide you with much greater flexibility. VENDOR NEUTRAL & SUB-CONTRACT TRAINING Due to our global expertise in the fast moving world of mobile forensics we have experience of delivering vendor neutral training and training as contractors on behalf of other agencies. Please contact us for more details. Contact training@msab.com to book training!
Training Courses 03 XRY CERTIFICATION TRAINING THE STARTING POINT FOR XRY TRAINING This is the core certification training that you will need to take in order to make you effective and confident in handling XRY and is the foundation for the next level of forensic courses. We take you through the basics of mobile phone forensic examinations and the necessary principles to recover and preserve data using XRY in the correct manner to ensure safe preservation of data. The course is two days long and covers all the essentials you will need to get up and running so you can feel confident in your operation of XRY in the early days. The information provided is extensive and covers all aspects of examinations of SIM cards, memory cards, feature phones and we dedicate a full day to specialist smartphone training due to the complexities of these devices. LEARN BY DOING You will have access to an XRY system in a professionally equipped classroom with plenty of hands on practical exercises using numerous different mobile devices that ensure you learn by doing, rather than listening. Our trainers are professionals handpicked for their knowledge and understanding of your operational needs. All possess considerable experience of mobile phone forensics and delivering training to classes with differing levels of knowledge. We start at the beginning and make no assumptions about skill levels; by the end of the second day we are confident you will be knowledgeable and skilled on the essentials. If you are new to mobile phone forensics or transferring from a computer forensics background then this course is ideally suited to get an understanding of the fundamentals and appreciation of the differences with mobile devices. With the basics covered you will be able to move with confidence to the next levels with our Intermediate and Advanced Training courses. DAY 1 Introduction to Networks Intro to SIM Cards and Mobile Devices SIM Cloning & Handset Extractions Intro to Location Data Common Challenges with Devices Searching & Exporting DAY 2 Day 1 Review Intro to Smartphones Android Basics idevice Basics Windows Phone Basics BlackBerry Basics Assessment Exercise Well-pitched delivery for novice as well as more experienced students. Work books very useful for future reference when in the field Quote from XRY Certification Feedback The course was excellent, well presented in an informal informative manner. The content was very good, relevant and current Quote from XRY Certification Feedback RECEIVE A CERTIFICATE Successful completion of this course assessment will result in the issue of a formal certificate to demonstrate your ability to meet the required competencies of a mobile forensic examiner.
Training Courses 04 XRY INTERMEDIATE TRAINING PHYSICAL & DELETED DATA This is the next level course after successful completion of the XRY Certification course with MSAB forensic tools. We assume you are now familiar with the basics of XRY and we take you through the next level of cell phone examinations and understanding. With an introduction to HEX, physical decoding, PLists, SQL and manual carving. The course is three days long and covers the next level knowledge you will need to maximize productivity with XRY. The information provided is extensive and covers practical exercises with feature phones, smartphones, memory cards, GPS navigation devices and tablets. PROFESSIONAL TRAINERS You will have full access to a XRY system in a professionally equipped classroom with plenty of hands on practical exercises using numerous different devices that ensure you learn by doing, rather than listening. Our trainers are professionals handpicked for their knowledge and understanding of your operational needs. All possess considerable experience of mobile phone forensics and delivering training to classes with differing levels of knowledge. Participants will need to have completed the XRY Certification Course beforehand; by the end of the day three we are confident you will be knowledgeable and informed to an Intermediate user standard on XRY. DEVELOP HIGHER LEVEL SKILLS XRY Intermediate training helps build increasing confidence in our system and take you through all the features and functionality available to ensure you get maximum value from your investment. Successful completion of this course assessment will result in the issue of a formal certificate to assist with demonstrating your ability to meet the required competencies of a mobile forensic examiner. This will give you the confidence in court to explain the forensic recovery process of deleted material and other forensic knowledge. DAY 1 Different Extraction Types Android Logical Extractions Next Level Logical Extractions GPS Devices & Locations Connection Types & Passcodes Dumping and Decoding Feature Phones Non-Standard Mobile Devices DAY 2 Introduction to HEX Introduction to XACT File Systems & Memory Cards HEX Searching & File Signatures Data Hashing DAY 3 RAM Disk & Bootloaders Dumping & Decoding Smartphones Import & Export PLists & SQL Databases Investigating Apps Support Tools Assessment Great class, instructors were very knowledgeable and provided for an excellent learning environment. Hands on training is great Quote from XRY Intermediate Feedback I really enjoyed the course and will take a lot back to assist in my everyday work Quote from XRY Intermediate Feedback
Training Courses 05 ADVANCED ACQUISITION TRAINING ADVANCED DEVICE DUMPING The Advanced Acquisition course is focused on helping you learn new ways to secure the data. We teach you how to extract data from mobile devices when traditional forensic tools are no longer an option. This training will take you to the next level of knowledge and understanding for mobile forensics. This course focuses on the extraction and recovery of data via JTAG and Chip Off methods, and gives you an introduction to Python to automate the process of decoding the recovered data. This practical knowledge is invaluable when automatic dumping and decoding is no longer an option. THE NEXT STEP This course is the next natural step after completion of the XRY Intermediate course. As a more advanced training course, this class is four days long and covers all elements of knowledge required to maximize your productivity and expertise. If you have been using XRY for quite some time and want to demonstrate excellence in the recovery of mobile data; then the XRY Advanced Acquisition Training course is for you. WHAT YOU WILL LEARN By the end of this course, you will be able to use alternative methods to extract mobile device data and import it into XRY. You will understand how dates and times are stored, and explore different encoding schemes used on mobile devices. You will learn how the data is stored in different formats and how to decode encoded data, as well as write Python scripts to automate tasks in XRY and expand XRY s capability. Successful completion of this course will result in a formal certificate, ensuring you can demonstrate the higher levels of competence and meet the modern demanding requirements of a mobile forensic examiner. The advanced nature of this course curriculum requires that all attendees have passed both the XRY Certification and Intermediate courses before attending. DAY 1 Advanced Extraction Methods JTAG RIFF Android JTAG RIFF Windows EMMC Extraction Chip-off DAY 2 HEX Refresh Endianess Time Epochs & Signed Integrers Delta Sync & RegEx Binary Images Examination & Analysis Importing Images DAY 3 Intro to Python Python Math Operators Python Variables Python Lists, Tuples & Loops XACT Data Structures File Output Modules re, struct, datetime Adding Data to the XRY Report Automating Tasks with Python DAY 4 Advanced Android ADB & Rooting Swipe PIN Decoding USB Disabled Devices DD & Nanddump Group Exercise Assessment & Closure Well paced and highly informative course, very knowledgeable and friendly trainer in a superb venue. Simply excellent all round Quote from XRY Advanced Acquisition Feedback
Training Courses 06 ADVANCED APPS ANALYSIS TRAINING ADVANCED DECRYPTION & DECODING This training course takes you to the highest levels of knowledge and understanding for mobile forensics. It is designed to be taken after successful completion of the other XRY training courses and will mean you have reached our highest possible level of education. The AAA course covers everything you need to know in order to decode smartphone data, utilize Python to analyze the contents and find the wealth of deleted information in smartphone apps and their databases. The course covers all elements of knowledge required to recover, decode, and reverse engineer apps to decrypt encrypted files stored in the handset and explore the hidden SQL & PList data on modern smartphones. This is a fast growing and rapidly changing area of mobile forensics which will only grow with importance in the future. So getting the knowledge now will give you a real advantage. CUTTING EDGE EDUCATION This course is designed to take you from relying on the decoding capabilities of XRY to being able to decode apps manually. There are over a million smart phone apps available and we show you how to locate that data when the tools can t do it automatically. Eventually you will come across a situation where you need to decrypt data from an app that is not supported and this course will show you exactly how to do it. You will learn how to decode the data yourself and using Python programming to add that data to the XRY report HIGHEST POSSIBLE CERTIFICATION Successful completion of this course will result in a formal certificate, ensuring you can demonstrate the highest level of competence to meet the demanding requirements of a modern mobile forensic examiner. The high level of the Advanced Apps Analysis Course curriculum requires all attendees to have passed both the XRY Certification and Intermediate courses before attending. DAY 1 Intro to Apps SQL Data Structures App Data Storage App Practical Hands-on App Practical DAY 2 Create SQLite Database Rebuilding Databases Deleted Contents in Database DAY 3 Intro to Python Python Math Operators Python Variables Python Lists & Tuples Python Loops File Output Modules Datetime SQLite3 Python Practical DAY 4 XACT Python API & Help File Adding Data to XRY Report Python Dictionaries Multi-Table Databases Python App Practicals DAY 5 Intro to Encryption Android App Reverse Engineering Reverse Engineer Encrypted App Group Exercise Assessment & Closure Hugely informative, well aimed and balanced course. Presented with the genuine passion and knowledge that has become the MSAB training trademark Quote from Advanced Apps Analysis Feedback
Training Courses 07 KIOSK & TABLET TRAINING FRONTLINE TRAINING SOLUTIONS The Kiosk & Tablet are frontline forensic tools designed for users where mobile data recovery is just one part of their responsibilities. These tools are our easiest to use mobile forensic solutions with a simplified user interface, nevertheless the correct training is still essential so that users can confidently explain their actions in a court of law. Recent legal challenges have demonstrated that the need for effective training of personnel is critical so that they can explain the technology in court. Hard won evidence can easily be rejected simply due to the inability of the witness to effectively explain the extraction process and fundamentals of mobile device forensics. This is where formal training will pay dividends ensuing that staff know how to use the equipment to the best of their abilities. WORKFLOW PROCESS SETUP We offer training on the Kiosk & Tablet for both standard users and also Administrators to ensure that you maximize your return on investment. A typical training course would cover a 2 day period with day 1 dedicated to the set up and workflows tailored to the needs of the organization, along with training of the Administrators. Day 2 of the course then delivers the core training on mobile forensics knowledge to standard users. Our trainers are hand picked for their professionalism and experience with mobile forensics and will be able to guide you through the training process to ensure the entire team of users benefits from their training. TRAIN-THE-TRAINER If your organization envisions a large scale roll-out of the Kiosk or Tablet then consider our Train-the-Trainer options. We can provide you with a fully flexible onsite training program for your nominated training staff to allow delivery on demand. DAY 1 Administrator Training Day & Installation Workflow Procedures Administrator Functions Password and User Profiles General Procedures for Standard Users DAY 2 Introduction to Mobile Forensics Equipment Overview SIM Cards & Cloning Memory Cards Handsets Smartphone Acquisitions Reports, Search & XRY Reader User-friendly Interface Mobile device forensics is a science. No matter how easy to use the tool makes things for the operator, the user still needs to understand what the equipment is doing and more importantly why. Evidence requires explanation Quote from Training Director, MSAB
Training Courses 08 XRY REFRESHER TRAINING WHEN DID YOU TAKE YOUR LAST XRY TRAINING? XRY has been in a constant state of development since 2003. Is your XRY Certification over one year old? Considering that we have over four major releases annually packed with new features and functions, it means there may have been several new versions of XRY software released since your last Certification. Each new release brings about significant changes in the functionality and features of XRY and its capabilities to recover more data from mobile devices. Therefore we offer a one day refresher training course to get you back up to speed and ensure your XRY training remains valid. If you want to continue to demonstrate your competency in XRY as a professional mobile device examiner and get the most out of all the latest features, then this course is for you. COURSE DESCRIPTION This Refresher Training will summarize the very latest version of XRY and its functionality compacted into a one day course for experienced practitioners. The training includes everything new you will need to know within the XRY System for both the Logical and Physical extraction tools. Training is adaptable to different users needs. Typically a timetable is agreed in advance with the group to ensure the best possible learning environment. The training will present what is now possible compared to older versions of the software and will show you what types of new devices and extractions that are possible on the thousands of different device profiles we support. Students who successfully complete this course will be certified and issued with a new XRY Certificate. RENEW YOUR CERTIFICATION XRY Certification is valid for 3 years. The technology is constantly changing and it s the responsibility of examiners to ensure they maintain their status as a XRY Certified user. 1 DAY Training is flexible to meet user requirements. Examples include: Latest Release Updates Restricted License PinPoint Smartphone Apps Multi-User Accounts Decryption Service Cables Exporting Chipset Support Carving Deleted Data Hex Analysis Re-Decoding Hash Values JTAG Decoding Python Support Security Codes Geo-Location Data Unsupported Apps Backup Retrievals Del File Decoder Device Manual Searches Updated Cables Device Time Analysis XAMN The technology is constantly changing. To ensure your certification remains valid, make sure you get refresher training
Training Courses 09 XAMN CERTIFICATION TRAINING DO YOU WANT TO MAKE SENSE OF DATA FROM MOBILE DEVICES? If you want to learn how to visualize connections between different devices through link analysis, timeline or geographical views, then this training is for you. XAMN is the phone forensic analytical tool for specialists who need to compare data from multiple mobile devices. This certification training course introduces you to XAMN, assuming no previous experience and teaches you all the fundamental aspects of the solution. Users will leave confident about all the features of XAMN and how best to use them in the world of mobile forensic analysis. With mobile data storage getting ever bigger, the challenge of dealing with large volumes of information is growing. Investigators need to review more and more, in order to find the crucial connections and prove associations. Because it s not just about the data, it s about the meaning. PROFESSIONAL TRAINING XAMN certification training teaches users first-hand through practical exercises and scenarios how to make quicker, faster, more efficient decisions with the aid of visualizing mobile forensic data. XAMN is the next generation of analysis tools for digital forensics and this training course will enable users greater understanding and discovery abilities, from the goldmine of mobile phone data available to them. The course is one day and covers all the essentials, so you can feel confident in your operation of XAMN. The information provided is extensive and covers all aspects of analytical review. You will have full access to both XRY and XAMN in a professionally equipped classroom with plenty of hands-on exercises to ensure you learn by doing, rather than listening. Our trainers are professionals hand-picked for their knowledge and understanding of your operational needs. Successful completion of this course will result in the issue of a formal certificate, ensuring you can demonstrate the required competences of a mobile forensic analyst. COURSE CONTENTS List Multiple XRY Files Show Connection View to Link Contacts Generate Three Different Timelines Create Geographical Mapping Data Run Searches Across 50 XRY Files Create Conversation View of Chat Data Import Other Forensic Files Analyze Call Data Records Tag Data for Review User Added Data Import Offline Translation Tool Offline Mapping Tool Case Data & Details Case Saving & Exporting COURSE LENGTH 1 Day XAMN Map View It s not about the data, it s about the meaning
Training Courses 10 TRAIN-THE-TRAINER COURSE EMBEDDED TRAINING FOR YOUR ORGANIZATION MSAB offer the opportunity for you to embed our standard industry training programs into your own organization, so that you can supply mobile forensic training on demand, precisely when and where you need it. This is ideal for those organizations considering wide area roll out of XRY. If you expect to train 25 people or more in a year on XRY or XAMN then this option is the best solution for you in terms of price and flexibility SPECIAL DESIGNED INTENSIVE COURSES We can provide a complete Train-the-Trainer package to qualify your personnel to the level of approved Trainer. These intensive courses are designed to show how to deliver each course to our required standards through practice and repetition. Students are taken through the course as we intended it to be delivered, so they experience what it is like to be a student on the training. The following days are spent focusing on the best teaching methods to deliver the course for themselves. We use qualified dedicated trainers to go through the training course material on a page by page basis, explaining the learning points in detail to cover the best methods for delivery of information to other students. Our core objective is to assist students to demonstrate competence in their role for a court of law when providing evidence regarding the use of XRY. Our Train the Trainer course is designed to ensure the nominated trainers are equally able to deliver the same level of knowledge internally to the organization. ANNUAL LICENSE AND UP TO DATE MATERIALS An annual Train-the-Trainer agreement will entitle the customer to a single point of contact dedicated MSAB trainer. Your organization is enabled to deliver training internally to your staff on demand. MSAB support ensures you have a complete set of reproducible training materials and the option to consult with our dedicated MSAB Training team to discuss new course materials at any time. EXAMPLE CERTIFICATION TRAINER PACK: 4 nominated trainers to attend standard 2 Day XRY Open Certification Course 4 nominated trainers to receive 3 Day Certification Train-the-Trainer training course Includes 12 month licence to teach Certification Course including issue of Certificates Includes access to latest Training Material and Documentation including PowerPoint s for 12 months Online consultation and support from MSAB training department for 12 months Additional student certificates available by negotiation COURSE LENGTH Individual, depending on the attendee s level of knowledge The biggest division between mobile phone examiners is not the tools, but their knowledge and experience.
Training Courses 11 ON-SITE TRAINING THE ADVANTAGES YOUR PLACE OR OURS? In addition to the standard training programs available worldwide, we can also perform the training on-site at your premises. We know that sometimes it s easier for us to come to you, especially if you have a large group of personnel to train. FRONTLINE TRAINING SOLUTIONS We offer on-site training at competitive prices and provided you have a suitable classroom environment, we will bring all the technology required to you in order to deliver the courses. CUSTOMIZED OR STANDARD We are happy to discuss arrangements and the training can either be in the form of our standard certification training program or as a customized training program, specifically arranged to suit your local needs. ADVANTAGES OF ON-SITE TRAINING INCLUDE: Competitive pricing compared to open courses Remove the issue of travel, accommodation and expense claims for staff Tailor made training to suit your local policies and procedures MSAB delivers computers, phones and XRY equipment to your doorstepcase Data & Details Case Saving & Exporting LEAVE THE ARRANGEMENTS TO US Once the suitability of your teaching environment is confirmed, we can make all the other necessary arrangements to bring our qualified trainer and equipment to you. While your staff receive training locally in a familiar environment that minimises travel, accommodation and expense claims for your organization. CLASS SIZES Onsite training is suitable for class sizes of 6 or more student who require specialized mobile forensics training. Please note that the maximum class size onsite per trainer is 12 students for Certification & Intermediate and 8 students for our Advanced training courses. For customer specific trainings please consult with your regional sales representative or send your request directly to training@msab.com I ve been to a million courses over the years, but this is the first time I was excited to come every single day (for a week). Very well done & presented excellent information and practicals XRY Certification & Intermediate Course
Training Courses 12 THE TRAINING PASSPORT ANY COURSE, ANYWHERE, ANYTIME FOR A WHOLE YEAR Save money and simplify your budget process by purchasing a whole year s worth of training for one person, at a discounted flat rate. With a broad selection of courses available globally, getting the training you need has never been easier. This is the simplest and most costeffective way to achieve continuing education in mobile forensics. Organizations must ensure that staff are properly trained to handle the continually evolving development of mobile forensics. Budgetary challenges and scheduling conflicts may limit the amount of training your staff can receive. The MSAB Annual Training Passport allows you to pay one discounted rate for a whole year of unlimited training for one member of your staff. BENEFITS Simplifies budgeting costs Provides significant savings Gives greater scheduling flexibility Unlimited learning potential Your staff will have the most up-to-date skills No fees for last minute cancellations of attendance Protection from price increases COURSE LENGTH The training passport is valid for a period of 12 months. TERMS & CONDITIONS An MSAB Annual Training Passport grants access for a named individual to unlimited attendance on all MSAB open courses anywhere in the world for the period of validity. The passport is activated either from the date of the first training course attended or alternatively 6 months after the original date of purchase, whichever occurs first. CERTIFICATE OF TRAINING Certified The passport is not transferrable and can only be used by the named individual. No refunds will be given if the passport is unused. The trainer was extremely patient and up to date with all information. He did not rush me in any way. The learning environment was calm and I would highly recommend this training to several officers. XRY Student Course Feedback Sheet
Hornsbruksgatan 28, SE-117 34 Stockholm, Sweden Phone: +46 8739 0270 Fax: +46 8730 0170 www.msab.com