Beyond the Tool: Advanced Mobile Artifact Analysis and Anti-Forensics for iOS and Android

Online, Available in English

Overview

Mobile devices generate more forensically relevant evidence than any other artifact class in modern investigations — and are simultaneously the most poorly examined. The problem is not access. It is understanding. The dominant training model produces practitioners who know how to operate commercial tools. When those tools fail, misparse, or simply have not caught up to a given artifact, the investigation stops. This course is built on a different premise: investigators who understand what data exists, where it lives, and why it looks the way it does will outwork any tool-dependent practitioner in every scenario that matters.

Over five intensive days, participants work through Android and iOS forensics at the artifact level — filesystem internals, SIM card structures, application database schemas, and the forensic signatures that persist across both platforms and survive deliberate attempts at destruction. Coverage spans SIM card forensics, third-party application analysis across social media, encrypted communications, and financial applications, with a dedicated module on anti-forensics techniques and mobile memory acquisition. Custom scripting is introduced where tools fall short — as a targeted capability for specific investigative scenarios, not a thread running through every session.

The course concludes with a full capstone investigation — a constructed case scenario that demands synthesis under realistic conditions, built by someone whose professional background includes designing forensic problems that experienced practitioners consistently get wrong. Attendees will be tested, not just taught.

Topics:

• Android Architecture and Acquisition
• SIM Card Forensics: Structure, Acquisition, and Android Integration
• Android Core Artifact Analysis
• iOS Architecture, Acquisition, and SIM/eSIM Forensics
• iOS Core Artifact Analysis
• Social Media and Encrypted Communications
• Anti-Forensics Identification and Remnant Recovery
• Mobile Memory Acquisition and Analysis
• Capstone Investigation

This course is designed for practitioners who already operate in digital forensics and need to go deeper — not practitioners entering the field. The intended audience includes:

• Digital forensics investigators and analysts with active casework experience.
• Law enforcement and national-level cyber units that handle mobile evidence in legal proceedings.
• Incident responders operating in environments where mobile devices are part of the threat picture.
• Forensic practitioners whose current workflows are tool-dependent and who recognize that as a professional liability.
• Researchers and advanced CTF competitors operating at the intersection of mobile security and forensics.

Participants without hands-on forensic experience will struggle from the first lab session. This is by design.

The following are hard requirements, not recommendations:

• Minimum two years of hands-on digital forensics experience in an operational or investigative context. Academic exposure without casework is not sufficient.
• Working proficiency with SQLite. Participants will query databases manually from Day 1. The course does not explain SQL syntax.
• Python scripting capability at a functional level. Lab exercises build on existing proficiency — they do not teach the language.
• Familiarity with mobile acquisition types and their evidence scope. Participants should arrive knowing the difference between a logical and a full filesystem acquisition and why it matters.
• Linux command-line proficiency. All lab work is terminal-native.
• Foundational understanding of filesystem concepts — inodes, allocation, journaling. Participants who do not understand these concepts will fall behind during Day 1.
• Basic familiarity with cellular network concepts (IMSI, ICCID, PLMN, location area codes) is helpful but not required — the SIM module is self-contained in its introductory framing before progressing to forensic depth.

Lab environment: A pre-configured VM will be distributed via USB on Day 1. Attendees must arrive with a machine capable of running two VMs simultaneously (minimum 16GB RAM, 100GB free storage), VMware Workstation or VirtualBox installed, and full administrative privileges.

By the end of this course, the participant will be able to:

• Perform deep filesystem analysis on Android (ext4, F2FS) and iOS (APFS) without dependency on commercial tooling, understanding storage structures, journaling behavior, and the forensic implications of each.
• Evaluate acquisition types — logical, file system, physical, chip-off — against specific investigative requirements, and identify precisely what evidence each type can and cannot yield.
• Acquire and interpret SIM card artifacts at the Elementary File level, including deleted SMS recovery and network location history reconstruction, and correlate SIM-resident data with device-resident artifacts to surface discrepancies indicative of SIM swap, cloning, or identity fraud.
• Extract and manually interpret core platform artifacts on both Android and iOS at the schema and binary level, including messaging databases, call records, location data, and browser artifacts.
• Conduct targeted forensic examination of third-party applications across social media, encrypted communications, and financial platforms — including artifact structures not documented by vendors.
• Reconstruct behavioral timelines and communication patterns by correlating raw artifact data across SIM records, device artifacts, and multiple application databases.
• Identify anti-forensics techniques deployed at the user and application level — secure deletion, encryption, artifact suppression, and factory reset behavior — and recover remnant artifacts that survive them.
• Acquire and parse mobile memory dumps on Android and iOS, extracting volatile artifacts unavailable through any disk-based acquisition method.
• Develop purpose-built Python scripts for targeted artifact extraction, database parsing, and timeline construction tailored to specific investigative requirements.