Instructor-Led Training | Aug 17 ET - Live Online

A properly configured system is required to fully participate in this course. These requirements are the mandatory minimums. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.

This is common sense, but we will say it anyway: Back up your system before class. Better yet, do not have any sensitive data stored on the system. SANS cannot be responsible for your system or data.

MANDATORY FOR585 SYSTEM HARDWARE REQUIREMENTS

• CPU: 64-bit Intel i5/i7 (4th generation+) - x64 bit 2.0+ GHz processor or more recent processor is mandatory for this class (Important - Please Read: a 64-bit system processor is mandatory).
• It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machine will run on your laptop. VMware provides a free tool for Windows that will detect whether your host supports 64-bit guest virtual machines. For further troubleshooting, this article also provides good instructions for Windows users to determine more about the CPU and OS capabilities. For Macs, please use this support page from Apple to determine 64-bit capability.
• BIOS settings must be set to enable virtualization technology, such as "Intel-VT."
• Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary. Test it!
• 16 gigabytes of RAM or higher is mandatory for this class (Important - Please Read: 16 gigabytes of RAM or higher of RAM is mandatory and minimum.)
• USB 3.0 Type-A port is required. At least one open and working USB 3.0 Type-A port is required. (A Type-C to Type-A adapter may be necessary for newer laptops.) (Note: Some endpoint protection software prevents the use of USB devices - test your system with a USB drive before class to ensure you can load the course data.)
• 200 gigabytes of free space on your system hard drive is required. This space is critical to host the VMs we distribute.
• Local administrator access is required. This is absolutely required. Don't let your IT team tell you otherwise. If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
• Wireless 802.11 capability

MANDATORY FOR585 HOST CONFIGURATION AND SOFTWARE REQUIREMENTS

• Host Operating System: Your system must be running either Windows 10 Pro or macOS 10.12 or later that also can install and run VMware virtualization products (VMware Workstation 15.5, VMware Fusion 11.5, or VMware Player 15.5).
• Please note: It is necessary to fully update your host operating system prior to the class to ensure that you have the right drivers and patches installed to utilize the latest USB 3.0 devices.

PLEASE INSTALL THE FOLLOWING SOFTWARE PRIOR TO CLASS

1. Download and install VMware Workstation 15.5, VMware Fusion 11.5, or VMware Player 15.5 or higher versions on your system prior to the start of the class. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial on its website.
2. Download and install 7Zip (for Windows Hosts) or Keka (macOS).

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.

FOR585 is designed for students who are both new to and experienced with smartphone and mobile device forensics. The course provides the core knowledge and hands-on skills that a digital forensic investigator needs to process smartphones and other mobile devices. The course is a must for:

• Experienced digital forensic examiners who want to extend their knowledge and experience to forensic analysis of mobile devices, especially smartphones
• Media exploitation analysts who need to master Tactical Exploitation or Document and Media Exploitation operations on smartphones and mobile devices by learning how individuals used their smartphones, who they communicated with, and what files they accessed
• Information security professionals who respond to data breach incidents and intrusions
• Incident response teams tasked with identifying the role that smartphones played in a breach
• Law enforcement officers, federal agents, and detectives who want to master smartphone forensics and expand their investigative skills beyond traditional host-based digital forensics
• Accident reconstruction investigators who need to determine how a phone was accessed or used during specific periods of time
• IT auditors who want to learn how smartphones can expose sensitive information
• Graduates of SANS SEC575, FOR308, FOR498, FOR563, FOR500, FOR508, FOR572, FOR526, FOR610, or FOR518 who want to take their skills to the next level

There is no prerequisite for this course, but a basic understanding of digital forensic file structures and terminology will help students grasp topics that are more advanced. Previous training in mobile device forensic acquisition is also useful, but not required. We do not teach basic acquisition methods in class, but we do provide instructions about them in the bonus course material.

FOR585 is an ideal course for graduates of SANS SEC575, FOR308, FOR563, FOR508, FOR526, FOR572, FOR610, or FOR518 who want to take their skills to the next level. Most of these courses can be taken in any order.

Related Courses

FOR585 is an ideal course for graduates of SANS SEC575, FOR498, FOR563, FOR500 (formerly FOR408), FOR508, FOR526, FOR572, FOR610, and FOR518 who want to take their skills to the next level. Most of these courses can be taken in any order.

• Smartphone Analysis Windows SIFT Workstation

  • A FOR585 SIFT Windows virtual machine (Smartphone Version) is used with all hands-on exercises to teach students how to examine and investigate information on smartphones. The SIFT virtual machine designed for this course contains free and open-source tools, custom and community scripts, commercial tools used in the class, and bonus tools that may aid in your investigations.
• Smartphone Analysis Tool Licenses
• UFED4PC License
• Physical Analyzer License
• BlackLight License
• Magnet AXIOM License
• Elcomsoft Cloud eXplorer License
• Elcomsoft Phone Password Breaker License
• Elcomsoft Phone Viewer License
• Open-Source Tools
• Bonus Acquisition Tools (Upon Request)
• Bonus SQLite Tools (Upon Request)
• Electronic Download package containing:
• FOR585 Windows SIFT workstation
• Forensic Capstone data, bonus labs, bonus course material, utilities, bonus IPA/APK files, and other documentation

• SANS Advanced Smartphone Forensic Electronic Exercise Workbook

  • The course electronic exercise book is packed full of questions and scenarios and contains detailed step-by-step instructions and examples to help you become a better smartphone examiner

• Select the most effective forensic tools, techniques, and procedures to effectively analyze smartphone data
• Reconstruct events surrounding a crime using information from smartphones, including timeline development and link analysis (e.g., who communicated with whom, where, and when)
• Understand how smartphone file systems store data, how they differ, and how the evidence will be stored on each device
• Interpret file systems on smartphones and locate information that is not generally accessible to users
• Identify how the evidence got onto the mobile device - we'll teach you how to know if the user created the data, which will help you avoid the critical mistake of reporting false evidence obtained from tools
• Incorporate manual decoding techniques to recover deleted data stored on smartphones and mobile devices
• Tie a user to a smartphone on a specific date/time and at various locations
• Recover hidden or obfuscated communication from applications on smartphones
• Decrypt or decode application data that are not parsed by your forensic tools
• Detect smartphones compromised by malware and spyware using forensic methods
• Decompile and analyze mobile malware using open-source tools
• Handle encryption on smartphones and bypass, crack, and/or decode lock codes manually recovered from smartphones, including cracking iOS backup files that were encrypted with iTunes
• Understand how data are stored on smartphone components (SD cards) and how encrypted data can be examined by leveraging the smartphone
• Extract and use information from smartphones and their components, including Android, iOS, BlackBerry 10, Windows Phone, Chinese knock-offs, and SD cards (bonus labs available focusing on BlackBerry, BlackBerry backups, Nokia [Symbian], and SIM card decoding)
• Perform advanced forensic examinations of data structures on smartphones by diving deeper into underlying data structures that many tools do not interpret
• Analyze SQLite databases and raw data dumps from smartphones to recover deleted information
• Perform advanced data-carving techniques on smartphones to validate results and extract missing or deleted data
• Apply the knowledge you acquire during the course to conduct a full-day smartphone capstone event involving multiple devices and modeled after real-world smartphone investigations

FOR585 features 31 hands-on labs and a final forensic challenge to ensure that students not only learn the material, but can also execute techniques to manually recover data. Some labs allow you to "choose your own adventure" so that students who may need to focus on a specific device can select relevant labs and go back to the others as time permits. The labs cover the following topics:

• Malware and Spyware -- Two labs are designed to teach students how to identify, manually decompile, and analyze malware recovered from an Android device. The processes used here reach beyond commercial forensic kits and methods. Bonus IPA and APK files are provided for practice. Two additional bonus labs are available on the USB.
• Android Analysis -- Four labs are designed to teach students how to manually crack locked devices, carve for deleted data, validate tool results, place the user behind an artifact, and parse third-party application files for user-created data not commonly parsed by commercial forensic tools. Open-source methods are utilized and highlighted where possible. An additional lab teaches students how to manually crack lockcodes from Android devices. A bonus lab encourages students to manually interact with a live device to pull relevant information using free methods.
• iOS Analysis -- Five labs are designed to teach students how to manually carve for deleted data, validate tool results, manually parse plists and databases of interest, and parse third-party application files for user-created data not commonly parsed by commercial forensic tools. In addition, methods for "tricking" your tools into parsing data from encrypted images are built into the labs. A bonus lab encourages students to manually interact with a live device to pull relevant information using free methods. There are other bonus iOS labs on the course USB.
• Backup File Analysis -- Three labs are designed to teach students how to parse data from iOS and Android backup files. These labs will drive students to parse data from databases, plists, and third-party application data. A bonus lab on BlackBerry backups is provided.
• Wiped Phone Analysis -- This is one of the more challenging labs for students, as the device used will have been wiped prior to acquisition. Students will be able to test all of the methods they learned during the course to see what can really be recovered from a wiped smartphone.
• BlackBerry 10 Analysis -- This all-encompassing lab provides students with a chance to tie external media (SIM cards) to a device, understand how data are manually carved and parsed, and understand how BlackBerry 10 applications differ from Android and iOS. Will you be able to identify a BlackBerry running Android applications? The methods used in this lab will apply to other smartphones that contain SIM cards and leverage third-party applications (Android, Windows Phone, Nokia, etc.)
• Knock-off Phone Analysis -- This lab focuses on handling knock-off devices, understanding the file system, and decoding the data not parsed by commercial tools.
• Third-Party Application Analysis -- These labs challenge students to examine third-party applications pulled from multiple smartphone devices, and to manually parse applications that are not commonly parsed by commercial tools.
• Parsing Application Databases -- These three labs provide students the opportunity to write SQL queries to parse tables of interest and to recover attachments associated with chats, deleted chats, and data from secure chat applications. The labs will challenge students to dig deep beyond what a commercial tool can offer.
• Browser Analysis -- This lab is focused on showing similarities and differences between computer and mobile browser artifacts. Your commercial tools may be good at parsing some evidence, but this lab will highlight what is missed!
• Smartphone Forensic Capstone -- The final challenge tests all that students have learned in the course. It features multiple smartphone devices used in various locations involving communication, third-party applications, Internet history, cloud and network activity, shared data, and more. The exercise encourages students to dig deep and showcase what they learned in FOR585 so that they can immediately apply it to their work when returning to their jobs.

"Simply brilliant! The best SANS course I have ever taken, excellently developed and expertly delivered. " - R. Pittman, NASA

"Great class to take in conjunction with SANS 408/508. I'm better prepared to do my job as a Forensic Analyst. " - B. Kelley, US Army

"I have been working on phones for 3 years & have learned so many valuable things that I would not have through normal job experience. " - J. Sikorski, 4Discovery

"Best hands-on mobile device training." - S. Surzyn, GM

"This is the best cell phone course that I have ever taken. I love that the course is vendor neutral and teaches many different skills. " - A. Bedford, NC DOJ

"This is the most advanced mobile device training that I know of and is greatly needed. It is currently the only course being taught at this level!" - Scott McNamee, DoS/CACI

"As an experienced user of the tools, I found FOR585 very instructional on how and why these tools give the results they do during an examination." - Charles Cox, FBI Computer Analysis and Response Team

"FOR585 is the best out there." - Andy Nind, British Army

"This course is worth it, even for a novice like myself." - S. Gentry, Adobe

"This course was very high-quality training that provided exactly what was advertised!....Great BlackBerry lab. I have never dug this deep in a BlackBerry before." - C. McCollom, Clark County Sheriff's Office

"I finally know what I have been missing! I did not know I was ignorant." - Mark G., Department of Justice

"If I could afford it I would take this course every year. I am sure I would learn new things as the course evolves to new technology." - Jim Stapleton, student

"I have been working with phones since 2009, and [instructor] Heather [Mahalik] very casually showed me how much I don't know. Excellent!" - Harbin Combee, MPDC