Handheld Forensic Course - Level 1

Attending examiners will be taught the structure of the data associated with each type of PDA, cellular, and hybrid device. The examiners will then continue by practically applying the acquisition process for these various devices using multiple forensic tools. After acquisition has been completed, the students will exercise their analysis skills through the use of these tools both with live acquisitions as well as sample cases.

The course runs for four days. Practical examinations throughout class and a written examination on techniques at the end of this four day course go towards Paraben's PCME certification.

Handheld Forensics PDA's, Cell, Hybrid Devices

Each day of training is designed to allow the student to understand the theory behind each concept and then practically apply that knowledge.

COURSE DETAILS

Day 1

1. Day 1
2. Introductions
3. Certifications
   • Level 1
   • PCME (Paraben Certified Mobile Examiner)
4. Other Training Courses
5. Course Objectives
6. What are the devices?
7. What is handheld/mobile forensics?
8. Sources of Cellular Evidence
9. Cellular & Mobile Networks
10. Network Generations
11. Cellular Subsets
12. Faraday Technology Preserving Evidence
13. Cell Phone Identification Numbers
14. Wireless Data Transfer Services
15. Legal Considerations
16. Cellular/Mobile Forensic Rules
17. Cellular Evidence Procedures
18. Device Seizure Overview
19. Reporting Acquired Data
20. Common Issues
21. Technical Support
22. Paraben Internet Handheld Database
23. Review

Day 2

1. Cell Phone Data Storage
2. Cell Phone File Systems
3. Data Analysis: SMS/MMS Technology
4. Data Analysis: Phone Data
5. PDA Device Basic Structure
6. PDA Operating Systems
7. PDA Memory Storage
8. PDA Desktop Synchronization Software
9. PDA Forensic Rules
10. Operating System Specifics: Palm
11. Palm Acquisition Process behind the Scenes
12. Windows CE, Pocket PC, Windows Mobile OS
13. Windows CE Memory and Data Structure
14. Data Storage on Windows CE
15. Synchronization on Windows CE
16. Windows CE Device Acquisition
17. PDA Quick Examination Techniques
18. Review

Day 3

1. Hybrid Devices
2. Hybrid Devices-Palm
3. Hybrid Devices-Smartphones
4. Hybrid Devices-RIM BlackBerry
5. RIM BlackBerry Desktop
6. RIM BlackBerry File System
7. BES BlackBerry Enterprise Service
8. Hybrid Forensic Rules
9. PDA & Hybrid Security Considerations
10. Palm Security
11. Windows CE/Mobile Security
12. RIM BlackBerry Security
13. 3rd Party Security Tools
14. Review

Day 4

1. Processing Cellular Accessories
2. SIM Card Basics
3. Cross Validation
4. Additional Tools
5. BitPim
6. Simcon
7. Other Tools
8. Oxygen
9. SecureView
10. Mobiledit!
11. .XRY
12. Review
13. Certification Test