AX400 Advanced Mobile Data Analysis
This course is a two-day, expert-level training program designed to equip digital forensic examiners with advanced skills for navigating complex mobile data. Emphasizing unsupported third-party applications, advanced data structures, and custom artifact creation, this course will provide essential tools for analyzing mobile device data with confidence.
Description
Magnet Forensics products including Magnet Axiom, Magnet Graykey and Magnet Verakeyare extremely valuable tools for mobile acquisition, deep analysis of data, and being able to report findings for stakeholders—saving you time and allowing you to solve cases in a more efficient manner.
If you haven’t already, it is strongly encouraged to complete the Magnet Axiom Advanced Mobile Forensics (AX300) course which will familiarize yourself with even more file types found within mobile operating systems. From an acquisition perspective, you may want to consider taking either the GK200 course for GrayKey(law enforcement only) or VK200 for Verakey (private sector). These two courses will give you hands-on experience with mobile device acquisition.
While Axiom is equipped to navigate evidence derived on mobile devices, it will be impossible for any tool to have native, first-party support for every single application on the app stores. Learning to write custom artifacts derived from unsupported applications allows the examiner to tailor their Axiom experience, providing a method to examine unsupported data in a tool they’re already familiar with.
Before writing a custom artifact, examiners should have an understanding of the underlying file types and how data can be stored within mobile file systems. Students in the course will explore mobile operating system file types even deeper, with data extraction from existing file types, like SQLite databases.
This course will go even further by decompiling APKs from Android apps, helping examiners understand how encryption might come into play with applications, and potentially understand just how the application is using particular.
Our world-class trainers will bring their years of practical and research expertise to the classroom and share the latest trends that examiners need to be aware of, keeping them one step ahead in their investigations. Magnet Forensics Trainers have had active experience in investigation and forensics, bringing with them a wealth of knowledge to the classroom experience. The classroom experience will bring together tips and tricks, deep analysis, and the latest research into a training scenario using some of the latest mobile operating systems and popular applications. This, combined with the opportunity to ask questions and collaborate with our trainers and other attendees, is invaluable.
Course Highlights
When students attend the AX400 course, they receive a dedicated two-day course that will utilize instructor-led scenario-based experience to reinforce the learning objectives of the specific learning modules. It will further enhance your understanding of unsupported data of both iOS and Android devices, discussing the latest changes of the operating systems whilst also learning to confidently evaluate and validate unsupported data types for stakeholders.
Course modules
Module 1: Course introduction and environment setup
Students will begin by exploring the course outline and meeting their instructor and fellow students. Students will gain an understanding of the course's depth and focus while preparing the necessary software and tools for success. By the end of this module, students will have a clear understanding of the data structure types to be explored and a fully prepared classroom environment.
Module 2: Extraction and analysis of mobile data structures
The structure and forensic significance of a variety of different data structures including Property Lists (PLists) Protobufs and XML will be examined in this module. Students will decode ABX files and binary PLists, explore NSKeyedArchiverPLists, and analyze Protobufs used in serialized data storage. Students will gain the ability to decode complex data structures, analyze embedded artifacts, and understand the forensic implications of application intents and serialized data within mobile devices.
Module 3: Creating custom artifacts
In this module, students will learn to navigate unsupported third-party applications and create custom artifacts to meet investigative needs. Students will load these artifacts into Magnet Axiom for processing and leverage the Dynamic App Finder to identify and process unsupported SQLite databases. By the end of this module, students will understand the importance of custom artifacts and how to utilize them effectively to extract critical data.
Module 4: Advanced artifact customization
Students will learn how to further customize artifacts for unsupported applications using Magnet Custom Artifact Generator (MCAG) in this module. The opportunity to learn how toleverage SQLite to generate queries and further customize artifacts for unsupported applications will be presented. After the module is completed, students will understand how to effectively utilize the Magnet Custom Artifact Generator and SQLite queries to maximize evidence collection from mobile applications.
Module 5: Understanding and decrypting encrypted applications
In this module, students will dive into mobile device encryption, focusing on key elements like the Android Keystore. Students will decrypt previously discovered encrypted files and learn how to decompile Android application APKs for investigative purposes. By the end of this module, students will understand encryption methodologies, the role of the Android Keystore, and how to decrypt an encrypted database using tools such as JadX and DB Browser for SQLite.
Additional information
Who should attend: Participants who are familiar with the principles of digital forensics
Advanced preparation: AX300 is strongly recommended
Program level: expert-level
Field of study: Computer software & applications
Delivery method: Group internet based & group live
Refunds and cancellations: Training Course(s) can be rescheduled to a later date or cancelled by either Magnet Forensics or you without charge or penalty if written notice is received twenty-one (21) days or more prior to the date of the Training Course. No rescheduling shall be permitted on less than twenty-one (21) days written notice, which shall constitute a cancellation without a refund. Your written rescheduling or cancellation notice must be emailed to training@magnetforensics.com or contact 202.984.3417. If Magnet Forensics cancels a Training Course due to insufficient attendance, you will have the option to register in a different scheduled Training Course or receive a full refund. Please do not book travel until you have confirmed that the Training Course will be running.
Magnet Forensics is registered with the National Association of State Boards of Accountancy (NASBA) as a sponsor of continuing professional education on the National Registry of CPE Sponsors. State boards of accountancy have final authority on the acceptance of individual courses for CPE credit. Complaints regarding registered sponsors may be submitted to the National Registry of CPE Sponsors through its website:www.nasbaregistry.org.