MOBILE · Advanced Android and iOS mobile forensics training
Hands-on intermediate course in advanced Android and iOS analysis: OS internals, encryption, manual SQLite and plist parsing, cloud artefacts and validating what your tools report.
This hands-on intermediate course is designed for practitioners with foundational mobile forensic experience who want to advance their analysis and validation skills on Android and iOS devices.
The course covers advanced OS internals, security models, encryption, and artifact storage across both platforms. Participants work with full file system extractions, backups, and raw datasets to identify, parse, and validate key artifacts, with emphasis on understanding data structures and changes across OS versions.
Analysis is performed using a combination of industry-standard tools and open-source tools such as ALEAPP and iLEAPP and others. A core focus is validating tool output, identifying parsing limitations, and performing manual verification.
Practical exercises include SQLite database analysis, plist and application data parsing, artifact correlation across sources, and recovery of deleted or partially available data. Participants will also explore cloud-related evidence, including iCloud and Google account artifacts and synchronization behaviour.
The course concludes with in-depth examination of modern iOS full file system artifacts, including Health, Screen Time, analytics, usage logs, and secure storage (Keychain), along with reporting and defensibility of findings.
Practitioners with foundational mobile forensic experience who want to advance their analysis and validation skills on Android and iOS devices.
Every participant who passes the course receives an official e-DiFTA certificate confirming successful completion of the class and recognising the training hours completed.
Consultant, INsig2
Saša works at INsig2 as a consultant in the digital forensics department, where he is primarily responsible for forensic training and client education, and for support during demanding and complex investigations. Saša was involved in equipping and…
A combination of industry-standard tools and open-source tools such as ALEAPP and iLEAPP. A core focus is validating tool output and verifying results manually.
Attendance is intended exclusively for law enforcement personnel, military personnel engaged in digital forensic activities and private-sector investigators.
Five days of hands-on training (08:00–17:00), an official certificate of successful completion recognising the training hours, a buffet lunch and morning and afternoon coffee breaks every day.
Seats are limited and allocated on a “first paid – first confirmed” basis. Your registration is confirmed once payment is received; the payment deadline is 25 December 2026.
Yes. Every participant who passes the course receives an official e-DiFTA certificate confirming successful completion of the class and recognising the training hours completed.
Invoices are issued from France. Private individuals and organisations in France pay French VAT (20%). Organisations outside France are invoiced without French VAT when they provide a valid VAT number, TIN or EIN. Full VAT rules.
Learn to use AI and large language models as investigative tools – and to recognise how criminals misuse them – with hands-on work on LLMs, RAG systems, AI agents and the EU AI Act.
Acquire and analyse RAM from live machines: live forensics and incident response, memory imaging, Windows artefacts from memory, password recovery and in-depth work with the Volatility framework.
Practical open-source intelligence for investigators: a secure OSINT environment, advanced search, SOCMINT, breach data, metadata, image verification, geolocation, the dark web and evidential reporting.
Expert-level Windows 11 forensics over five days: BitLocker, WSL and Sandbox, Registry and user activity, Helium apps, OneDrive, Chromium browsers and SQLite exploitation.
