CELL PHONE & SIM CARD ADVANCED FORENSICS - Level 2

Students wishing to participate in this course will need to have attended Paraben's Basic Handheld course or its approved equivalent, or successfully pass the Advanced Cell/SIM pre-test. The pre-test is designed to test the students knowledge on the basic principles of hand held forensics.

Day 1

1. Review of Seizure Techniques
   • Faraday Technology
   • Power issues
2. Protection of Device
   • What is the write protect and how and when to use.
   • Registry Modifications
     • USB write protection
     • PRACTICAL-Modify the registry
   • Software drivers
   • USB Write Blockers (Tableau Device)
3. Review of Acquisition procedure
   • Order of acquisition
   • Helpful hints
   • PRACTICAL-2 in class cell phone acquisitions
4. Advanced Parsing and Data Carving
   • Understanding folder structure
   • Where to go to find evidence
   • Presenting the evidence found
5. Optional Device Acquisition tools
   • Project-a-Phone
     • Conducting an examination
     • PRACTICAL- Hands on use of the tool

Day 2

1. Cell Phone Flashers
   • Recoverable Information
   • What is a Flasher
     • Available tools
       • Device Seizure
       • Nokia Flash Tool
       • Tornado Box
   • Validation testing and additional acquisition tools
     • HEX Editors
       • How to work with the data from a flasher?
       • Compare with Device Seizure Data
2. Media Card Processing
   • Acquisition
     • Walk through PFR
     • How do media cards in a cell work different?
   • Analysis
     • PRACTICAL
3. Device Seizure
   • Interface
   • Acquisition
   • Capabilities
   • Sorter/ Data Carving

Day 3

1. Break out of SIM (All Data Sections)
   • GSM SIM Standards
   • Physical analysis
     • FCC Numbers
     • Discussion of Smart Cards
2. Reading through data
   • Low Level Analysis
   • High level overview of SIM structure
   • Byte by Byte of common files
     • IMSI
     • LOCI
     • MSISDN
3. How to analyze a SIM
   • The role of .Forbidden Networks
   • The role of IMSI
   • Graphics
   • Text messages
   • MMS
   • Validation
4. PRACTICAL
5. SIM Card Cloning
   • Procedures for cloning
   • How to process a device without a SIM card
6. PRACTICAL-Cloning
7. Encryption Detailed
   • PIN
   • PUK
8. SIM Encryption
9. Handset Encryption
10. 3rd Party Encryption

Day 4

1. Optional tools
   • CDMA Workshop
   • SmartMoto
   • BitPIM
   • SimCon
   • SIM Card Seizure
2. PRACTICAL
3. iPhone Forensics
   • Procedures
   • Issues
   • Basics on OS
   • Data Analysis
4. PRACTICAL -Analysis
5. Proper forensic testing and validation
6. Sample SOP to students
7. Presentation on the data Practical
8. Certification Test Level 2