SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
SEC595Cyber Defense, Artificial Intelligence
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
Major updates
FOR585: Smartphone Forensic Analysis In-Depth
FOR585Digital Forensics and Incident Response
- 6 Days (Instructor-Led)
- 36 Hours (Self-Paced)
Course authored by:
Heather Barnhart & Domenica (Lee) Crognale
Course authored by:Heather Barnhart & Domenica (Lee) Crognale
- GIAC Advanced Smartphone Forensics (GASF)
- 36 CPEs
Apply your credits to renew your certifications
- In-Person, Virtual or Self-Paced
Attend a live, instructor-led class at a location near you or remotely, or train on your time over 4 months
- Essential Skill Level
Course material is for individuals with an understanding of IT or cyber security concepts
- 22 Hands-On Lab(s)
Apply what you learn with hands-on exercises and labs
Your forensic tools report data—but they cannot determine if the user created it. Learn to validate mobile artifacts, recover evidence tools miss, and testify with confidence in court.
Featured Quote
This class has been amazing. I've learned so much in such a short amount of time. I'm ready to go back to work and use these new skills.
Course Overview
FOR585 delivers advanced iOS and Android forensics focused on artifact interpretation—not just tool operation. Master location data validation, recovery of deleted records tools miss, manual decoding of unsupported applications, and determination of whether evidence was user-created or generated automatically by the operating system.
What You'll Learn
- Locate critical evidence on iOS and Android and determine exactly how data got there
- Recover deleted, unparsed, and obfuscated mobile data that commercial tools miss
- Manually decode third-party application artifacts when tools provide zero support
- Validate location artifacts and confidently identify false positives before court
- Detect, isolate, decompile, and analyze mobile malware and commercial spyware apps
- Leverage AI assistants safely to build Python scripts and SQL queries for analysis
- Extract evidence from locked devices, encrypted containers, and secure messaging
Business Takeaways
- In-house smartphone forensic capability eliminates outsourcing delays and reduces costs
- Time to evidence is critical—volatile mobile data can purge within hours of seizure
- Open-source tools taught in class supplement or replace expensive commercial licenses
- Examiners who validate findings produce court-ready reports that withstand scrutiny
- Mobile malware analysis skills prepare incident response teams for emerging threats
- Staff trained on manual recovery techniques extract evidence when tools fail entirely
Meet Your Authors
- Slide 1 of 2
Heather Barnhart
FellowHeather brings 24+ years of experience supporting government agencies, defense contractors, law enforcement, and Fortune 500 companies. Her extensive case experience spans fraud investigations, crimes against children, counterterrorism, and more.
Read more about Heather Barnhart - Slide 2 of 2
Domenica (Lee) Crognale
Senior InstructorDomenica brings 20 years of mobile forensics experience supporting U.S. federal law enforcement and intelligence agencies while leading global training programs for elite investigative units including FBI and military special operations forces.
Read more about Domenica (Lee) Crognale
Slide 1 of 0
(1/0)
Course Syllabus
Explore the course syllabus below to view the full range of topics covered in FOR585: Smartphone Forensic Analysis In-Depth.
Section 1Smartphone Fundamentals, SQLite Forensics, and Tool Orientation
Build the foundation for advanced smartphone analysis: proper device handling for hot and cold acquisition states, acquisition terminology explained, and SQLite query development from scratch. Write complex table joins, parse databases manually, and learn exactly when tools report data incorrectly. Labs cover SD cards, Physical Analyzer, AXIOM, and SQL.
Topics covered
- Device handling and evidence preservation for HOT and COLD acquisition states
- SQLite database internals including query syntax development and table joins
- Cellebrite Physical Analyzer advanced analysis techniques and key features
- Magnet AXIOM examination workflows including logical and keyword searching
- WAL file forensics for recovering temporary storage and uncommitted data
Labs
- SD card forensic examination and linking extracted evidence to devices
- Cellebrite Physical Analyzer deep dive with Android extraction dataset
- Magnet AXIOM iOS backup extraction including artifact review workflows
- SQLite query development from basic SELECT to advanced multi-table joins
- WAL file modification exercise demonstrating temporary data persistence
Section 2Android Forensics
Examine Android file system structures, encryption implementations, and native application artifacts in depth. Parse third-party applications manually when tools fail, validate location data against ground truth, and leverage ALEAPP for rapid triage of large extractions. All labs use full file system acquisitions ensuring access to complete datasets.
Topics covered
- Android file system architecture including partition layouts and encryption
- Native Google and Samsung application artifacts and database locations
- Location artifact validation including carving and false positive detection
- System logs and connection data analysis for network activity tracking
- Google Cloud account data extraction and Takeout package examination
Labs
- Full file system extraction analysis covering all major artifact categories
- Third-party application manual parsing for data tools do not support
- Location artifact recovery with validation and false positive detection
- ALEAPP automated triage followed by manual system log examination
- Google Takeout cloud data extraction with device artifact correlation
Section 3iOS Device Forensics
Master iOS file system structures, backup encryption mechanisms, and jailbreak-based full file system extraction techniques. Decode native Apple applications, validate location artifacts against known positions, and leverage iLEAPP and ArtEx for rapid triage. Labs include full file system analysis, Photos.sqlite deep dives, and artifact attribution.
Topics covered
- iOS file system architecture including encryption and key management
- Backup collection methods with encryption handling and decryption steps
- Native Apple application artifacts including iOS version differences
- Location artifact sources with validation against known ground truth
- System logging analysis including Sysdiagnose and Unified Log parsing
Labs
- iOS full file system extraction examination covering all key artifacts
- Photos.sqlite deep analysis for location data and user activity traces
- Third-party app manual parsing including deleted record recovery work
- iLEAPP and ArtEx automated triage with manual validation workflows
- Artifact attribution exercise demonstrating user placement on device
Section 4AI Impact on Mobile Forensics, Malware/Spyware Forensics, and Detecting Evidence Destruction
Identify AI-generated content using operating system metadata combined with commercial tool capabilities. Use AI assistants safely to generate forensic analysis scripts without exposing case data. Detect, decompile, and analyze mobile malware samples. Recover evidence from devices where users deleted, wiped, or concealed data. Five intensive labs.
Topics covered
- AI-generated content detection using file metadata and multi-tool analysis
- Safe AI-assisted script generation for forensic automation workflows
- Mobile malware classification with detection and isolation procedures
- Android APK decompilation including reverse engineering methodologies
- Evidence destruction detection with recovery techniques and validation
Labs
- AI-generated image detection on iOS using metadata and tool comparison
- AI-assisted Python script development for custom artifact parsing work
- Android malware hunting exercise using full file system extraction data
- APK static analysis with decompilation and behavioral review exercise
- Tampered device examination with deleted and hidden data recovery work
Section 5Third-Party Application Analysis
Decode secure messaging applications, payment platforms, file sharing services, and mobile browsers across iOS and Android platforms. Write SQLite queries to recover deleted chat messages and media attachments. Parse Tor browser and incognito session artifacts. Master techniques that commercial tools miss and recover that critical evidence yourself.
Topics covered
- Secure messaging app database structures with deleted artifact recovery
- Payment application and mobile wallet forensic artifacts and locations
- Mobile browser analysis including private and incognito session traces
- File sharing application data with MDM and MAM policy artifact review
- Advanced SQL query development for chat and attachment extraction work
Labs
- Cross-platform third-party application decoding covering iOS and Android
- Secure chat deletion analysis with attachment recovery and validation
- Tor browser and incognito browsing artifact analysis across platforms
- SQL query development for recovering chat history and media artifacts
- Vacuumed database artifact recovery using methods beyond free pages
Section 6Smartphone Forensic Capstone
Apply every technique learned throughout the week in a gamified CTF environment using prior lab datasets plus new cold case evidence from multiple smartphone devices. Work individually or in teams answering investigation questions covering identification, attribution, timeline, and motive. Prove you can decode complex data under real pressure.
Topics covered
- Investigation identification and scoping methodology for mobile cases
- Cross-device artifact correlation with timeline reconstruction methods
- Communication pattern reconstruction across multiple platform sources
- Evidence of user concealment including deletion and tampering traces
- Investigation hypothesis development with supporting documentation
Labs
- Multi-device cold case investigation spanning both iOS and Android
- Samsung Android health and fitness application data examination work
- Cross-platform secure messaging analysis with communication mapping
- Location and activity timeline reconstruction from multiple sources
- Gamified CTF competition environment with live team scoring server
Things You Need To Know
Relevant Job Roles
Malware Analyst
Digital Forensics and Incident ResponseMalware analysts face attackers’ capabilities head-on, ensuring the fastest and most effective response to and containment of a cyber-attack. You look deep inside malicious software to understand the nature of the threat – how it got in, what flaw it exploited, and what it has done, is trying to do, or has the potential to achieve.
Explore learning pathInsider Threat Analysis
NICE: Protection and DefenseResponsible for identifying and assessing the capabilities and activities of cybersecurity insider threats; produces findings to help initialize and support law enforcement and counterintelligence activities and investigations.
Explore learning pathDigital Forensic Analyst Training, Salary, and Career Path
Digital Forensics and Incident ResponseThis expert applies digital forensic skills to a plethora of media that encompass an investigation. The practice of being a digital forensic examiner requires several skill sets, including evidence collection, computer, smartphone, cloud, and network forensics, and an investigative mindset. These experts analyze compromised systems or digital media involved in an investigation that can be used to determine what really happened. Digital media contain footprints that physical forensic data and the crime scene may not include.
Explore learning pathDigital Forensics (OPM 212)
NICE: Protection and DefenseResponsible for analyzing digital evidence from computer security incidents to derive useful information in support of system and network vulnerability mitigation.
Explore learning pathCybercrime Investigator Training, Salary, and Career Path (OPM 221)
NICE: InvestigationCybercrime Investigators navigate dark web forums, trace cybercriminal activity, and conduct covert investigations. They follow forensic and legal standards to gather evidence and respond to cybercrimes.
Explore learning pathMilitary Operations / Law Enforcement Agents
Digital Forensics and Incident ResponseExecute digital forensic operations under demanding conditions, rapidly extracting critical intelligence from diverse devices. Leverage advanced threat hunting and malware analysis skills to neutralize sophisticated cyber adversaries.
Explore learning pathMedia Exploitation Analyst
Digital Forensics and Incident ResponseThis expert applies digital forensic skills to a plethora of media that encompasses an investigation. If investigating computer crime excites you, and you want to make a career of recovering file systems that have been hacked, damaged or used in a crime, this may be the path for you. In this position, you will assist in the forensic examinations of computers and media from a variety of sources, in view of developing forensically sound evidence.
Explore learning pathCybersecurity Analyst/Engineer
Cyber DefenseAs this is one of the highest-paid jobs in the field, the skills required to master the responsibilities involved are advanced. You must be highly competent in threat detection, threat analysis, and threat protection. This is a vital role in preserving the security and integrity of an organization’s data.
Explore learning pathCourse Schedule & Pricing
Looking for Group Purchase Options?Contact Us
GIAC Certification Attempt
Add a GIAC certification attempt and receive free two practice tests. View pricing in the info icons below.
OnDemand Course Access
When purchasing a live instructor-led class, add an additional 4 months of online access after your course. View pricing in the info icons below.
Location & instructorDate & TimeCourse priceRegistration Options
- Date & TimeOnDemand (Anytime)Self-Paced, 4 months accessCourse price$8,780 USD*Prices exclude applicable local taxesRegistration Options
- Date & TimeFetching schedule..Course price$8,780 USD*Prices exclude applicable local taxes
- Date & TimeFetching schedule..Course price¥1,335,000 JPY*Prices exclude applicable local taxesRegistration Options
- Date & TimeFetching schedule..Course price£7,160 GBP*Prices exclude applicable taxes | EUR price available during checkout
- Date & TimeFetching schedule..Course price€8,230 EUR*Prices exclude applicable local taxesRegistration Options
- Date & TimeFetching schedule..Course price$8,780 USD*Prices exclude applicable local taxes
- Date & TimeFetching schedule..Course price$8,780 USD*Prices exclude applicable local taxes
- Date & TimeFetching schedule..Course price€8,230 EUR*Prices exclude applicable local taxes
- Date & TimeFetching schedule..Course price$8,780 USD*Prices exclude applicable local taxes
- Date & TimeFetching schedule..Course priceS$11,390 SGD*Prices exclude applicable local taxes
Showing 10 of 13
Learn Alongside Leading Cybersecurity Professionals From Around The World
- Slide 1 of 4As someone with ZERO experience/background in this subject matter, being able to go back and rewatch the videos is priceless. It's probably the best feature I have ever seen in a class.
- Slide 2 of 4This course makes me want to re-work every cell phone case I've ever done.
- Slide 3 of 4FOR585 course content provides extremely relevant material, guiding examiners to crucial artifacts for investigations and validation. It outlines key details for every forensic challenge.
- Slide 4 of 4FOR585 has been, by far, the best virtual course AND the best mobile forensics course I've ever taken.
Slide 1 of 0
(1/0)
Benefits of Learning with SANS
Get feedback from the world’s best cybersecurity experts and instructors
Choose how you want to learn - online, on demand, or at our live in-person training events
Get access to our range of industry-leading courses and resources