Cellebrite Advanced Smartphone Analysis (CASA)
Mobile Forensics
- Level: Advanced
- Length: Five Days (35 hours)
- Training Track: Mobile Forensics
- Delivery Mode: CCPO (Core)
Course Description
Cellebrite Advanced Smartphone Analysis is a five-day (35 hours) advanced level course designed to provide training in forensic recovery of application data from smartphones. The CASA class is recommended for practitioners familiar with Physical Analyzer and graduates of the CCPA course. In the CASA course, participants will learn how to decode information not commonly decoded by forensic tools. Attendees will also use third-party software and Python scripts to decode, analyse, verify, and validate findings.
Cellebrite Advanced Smartphone Analysis (CASA) has extended its course duration from four (4) days to five (5) days.
Here’s what’s new:
- Adopted a more process-oriented learning approach instead of focusing on interesting/valuable artifacts. We teach you what to do when the automated tools fail to find what you are looking for.
- Deeper dive into SQLite databases and explanations on how they can be used to find data that is not parsed by the tools.
- Added an App Deconstruction module to explain the steps that can be taken to understand and manually parse unsupported applications.
- Added a module on basic Python scripting to show the value of scripting languages in searching and parsing large datasets.
- Revised the iOS and Android modules to focus more on the operating system-specific artifacts found in each OS.
Course Learning Objectives
Upon successful completion of the course, the student will be able to:
- Recognize SQLite database structures and how to use search Query Language (SQL) to filter and sort data efficiently.
- Inspect databases in Physical Analyzer to locate applications of interest to an investigation.
- Interpret unsupported data.
- Identify basic data types and how they are used with Python.
- Interpret the structures of iOS and Android file systems.
- Analyse extractions with Cellebrite Physical Analyzer.
- Examine and parse unsupported applications using the SQL Builder and incorporate the data into Physical Analyzer.
