Computer forensics investigators no longer simply rely on traditional computers as sources of evidence. Incriminating evidence can be found on cellphones, smartphones, PDAs, cameras and even game systems. This course will introduce students to mobile forensic file systems. Students will learn methods of evidence extraction from mobile devices and how these devices should be handled and analyzed. Labs sessions will allow students with hands-on analysis of phones, flash memory and SIM cards. Students will also learn about recovering deleted SMS text messages, call logs. An introduction to CDMA and GSM networks will also be provided. This practical experience will be supplemented with exposure to the use of digital images and video in investigations. The course will teach students how to find photo metadata, identify whether images have been edited, reconstruct damaged image files and subsequently use these files as admissible evidence.
Goals and Objectives
students will analyze different file structures from different cellphones and work to determine the most efficient methods of data extraction.
students will learn to use professional imaging hardware and software to extract digital evidence from mobile devices, like cellphones.