Mattia is a Senior Instructor at the SANS Institute, teaching FOR500: Windows Forensic Analysis and FOR585: Smartphone Forensic Analysis In-Depth. He is also one of the co-authors of FOR500, contributing to the development of one of SANS's flagship digital forensics courses. A topic he's particularly passionate about is smartphone forensics. "I spend my days trying to acquire and analyze digital devices, smartphones in particular," he says. An expert with extensive knowledge of forensic tools and techniques, Mattia always looks for a way to achieve his goals, even when no existing tool can provide a solution. "I do forensics on a daily basis, testing, developing new methods, and going deeper and deeper, and I love teaching by providing real cases and scenarios to my students," he says.
Mattia is also an adjunct professor at the University of Genoa in Italy, where he teaches Digital Forensics in a master's degree program. His academic activities complement his professional work and teaching at SANS, allowing him to share practical experience and investigative methodologies with students at different stages of their careers.
First introduced to SANS as a student, Mattia attended the 2010 DFIR Summit in London and subsequently pursued four years of SANS training because he was so impressed by the people, the instructors, and the quality of the content. His experience as a student eventually inspired him to become an instructor, and SANS has remained a fundamental part of his professional journey.
According to Mattia, one of the most important things students learn in his courses is the need to develop their own methodology for digital forensics. "It is a mix of techniques, rules, procedures, tools, and creativity," he says. "I want to teach students how to build their methodology based on their roles and their resources, like time and money."
Mattia recognizes that one of the biggest challenges for digital forensics professionals is keeping up with the constant changes in the digital world, including new devices, operating systems, and applications. He strives to prepare students for these changes by explaining the underlying concepts behind each area of digital forensics and demonstrating new approaches, including manual techniques he has developed to address specific investigative challenges.
He also encourages students to think outside the box when they encounter a roadblock. For example, when faced with a locked phone that cannot be accessed using available tools, he encourages investigators to consider alternative sources of evidence by asking questions such as, "Was the user using any cloud syncing?" and "Is there any request that we can submit to a provider or carrier to obtain some useful data?" As he explains, "Usage of encryption and protection mechanisms will make a full analysis of a device more and more difficult, but there are still a lot of things that can be done."
Mattia has experienced his own "think outside the box" moments and uses them as learning opportunities for his students. In one case, he received a call from a law enforcement unit requesting support with a high-profile investigation involving a locked iPhone. While teaching a SANS course in Munich, Mattia brought the device to the Cellebrite lab after class. With their support, he was able to unlock the phone and acquire the necessary data, eventually testifying in court. The information recovered from the device provided crucial evidence in the case.
Mattia has also contributed to three European research projects focused on digital evidence and digital investigations: EVIDENCE, EVIDENCE2e-CODEX, and INSPECTr. Although all three projects have concluded, their results and contributions continue to support ongoing research in the field. His involvement in these initiatives reflects his interest in advancing digital forensic capabilities, improving the handling and exchange of digital evidence, and supporting collaboration among European law enforcement and judicial authorities.
Mattia obtained a degree in computer science from the University of Genoa, Italy, and completed postgraduate training in computer forensics and digital investigations in Milan. He holds ten GIAC certifications: GCFA, GCFE, GREM, GNFA, GASF, GMOB, GIME, GCWN, GOSI, and GBFA.
A regular speaker on digital forensics at Italian and European universities, conferences, and professional events, Mattia authored *Learning iOS Forensics* and *Learning iOS Forensics, Second Edition*, published by Packt Publishing. He is the President of ONIF (Osservatorio Nazionale Informatica Forense), a member and founding member of the Digital Forensics Association (DFA), where he previously served as president, and a member of the International Information System Forensics Association (IISFA). He is also a faculty member of the SANS Technology Institute, an NSA Center of Academic Excellence in Cyber Defense.
Although computers continue to be his primary hobby, Mattia enjoys DJing at parties and cheering on his favorite soccer team, Genoa. Above all, he enjoys spending quality time with his family and their dogs. He also loves traveling to new places around the world and learning about the cultures and people of the areas he visits.
