
AX400 Advanced Mobile Data Analysis
This course is a two-day, expert-level training program designed to equip digital forensic examiners with advanced skills for navigating complex mobile data. Emphasizing unsupported third-party applications, advanced data structures, and custom artifact creation, this course will provide essential tools for analyzing mobile device data with confidence.
Course Modules
Module 1: Course introduction and environment setup
Students will begin by exploring the course outline and meeting their instructor and fellow students. Students will gain an understanding of the course’s depth and focus while preparing the necessary software and tools for success. By the end of this module, students will have a clear understanding of the data structure types to be explored and a fully prepared classroom environment.
Module 2: Extraction and analysis of mobile data structures
The structure and forensic significance of a variety of different data structures including Property Lists (PLists) Protobufs and XML will be examined in this module. Students will decode ABX files and binary PLists, explore NSKeyedArchiverPLists, and analyze Protobufs used in serialized data storage. Students will gain the ability to decode complex data structures, analyze embedded artifacts, and understand the forensic implications of application intents and serialized data within mobile devices.
Module 3: Creating custom artifacts
In this module, students will learn to navigate unsupported third-party applications and create custom artifacts to meet investigative needs. Students will load these artifacts into Magnet Axiom for processing and leverage the Dynamic App Finder to identify and process unsupported SQLite databases. By the end of this module, students will understand the importance of custom artifacts and how to utilize them effectively to extract critical data.
Module 4: Advanced artifact customization
Students will learn how to further customize artifacts for unsupported applications using Magnet Custom Artifact Generator (MCAG) in this module. The opportunity to learn how toleverage SQLite to generate queries and further customize artifacts for unsupported applications will be presented. After the module is completed, students will understand how to effectively utilize the Magnet Custom Artifact Generator and SQLite queries to maximize evidence collection from mobile applications.
Module 5: Understanding and decrypting encrypted applications
In this module, students will dive into mobile device encryption, focusing on key elements like the Android Keystore. Students will decrypt previously discovered encrypted files and learn how to decompile Android application APKs for investigative purposes. By the end of this module, students will understand encryption methodologies, the role of the Android Keystore, and how to decrypt an encrypted database using tools such as JadX and DB Browser for SQLite.