Mobile Device Acquisition and Analysis

Description

Mobile technology is constantly evolving and in Canadian society today, most people own and use mobile devices in all aspects of their lives. Thus, the data that these devices contain can afford valuable evidence to virtually every modern investigation with the help of trained digital forensic examiners. Digital forensic examiners trained in mobile device forensics are the experts that can use specialized tools, software and techniques to access, extract, analyze, and disclose information from these devices in a court-acceptable fashion.

The course will educate learners about the fundamentals of mobile device data extraction and analysis for evidentiary purposes. The learner will benefit from an approach that aligns mobile forensics with the full process of a supported criminal investigation. Aspiring mobile forensics examiners will understand their role and know how to act to solve issues that go beyond just the technical aspects of their work. They will learn how to support investigations by assisting investigators with mobile technology handling and mobile device seizures; how to acquire and analyze mobile device data; how to report on and testify to mobile device exhibit handling, acquisition and data analysis; and how to advance their post-course professional development in the field of mobile device forensics.

Format and delivery

This course is divided into two parts: an online phase and an in-person phase. The online phase focuses on learning theoretical concepts with many practical hands-on activities, and the in-person phase focuses on practical exercises and projects. Each phase must be successfully completed to receive credit for this course. Registration for the course enrolls registrants in both course phases. The online phase must be completed successfully to participate in the in-person phase.

Length of course

10 days, from a combined 80 hours of learning activity as follows:

• Phase 1 - eLearning: Approximately 80 hours of self-paced online learning modules (including assignments and quizzes), to be completed within a 10-week period
• Phase 2 - Classroom: 5 days of in-person learning and lab work

Class size

Maximum of 20 participants in each course phase

Delivery setting

• Phase 1 - eLearning: Delivered using the CPC online learning platform
• Phase 2 - Classroom: Delivered on-site in class

Learning outcomes

• Assisting investigators with mobile device seizure and handling, and with understanding mobile technology in an investigative context
• Acquiring mobile device data
• Analyzing mobile device data
• Reporting on mobile device exhibit handling, extractions, and data analysis
• Testifying on mobile device exhibit handling, extractions, and data analysis
• Continuous professional development in the context of mobile device forensics and mobile technology in an investigative context

Eligibility and mandatory requirements

• Registrants must meet the following eligibility and mandatory requirements in order to be considered for registration on the course:
  • registrant must be in a digital forensics examiner position
  • registrants must be authorized by their police service or law enforcement agency to perform digital forensics
• Successful completion of Phase 1 the course is a mandatory requirement for participation in Phase 2 of the course
• Prior to applying to this course, registrants are strongly encouraged to be trained on the use of at least one commercial digital forensics extraction tool and at least one commercial digital forensics analysis software package
  • During the in-person portion of the course, the Canadian Police College will provide the following tools and software:
    • extraction: Cellebrite UFED4PC, Cellebrite UFED Touch 2, MSAB XRY, Magnet AXIOM
    • analysis: Cellebrite Physical Analyzer, MSAB XAMN, Magnet AXIOM
• Acceptance or refusal in the course is at the discretion of the Canadian Police College

Assessment

• Success in the course is based on participation and successful completion of all required assignments
• Various evaluation methods are used, including practical exercises, quizzes, and assignments
• Re-testing or re-evaluation is conducted in accordance with the CPC Academic Directives and at the discretion of the Canadian Police College

Contact

For more details or other information about the course, please email the CPC Registrar at cpc_registrar-registraire_ccp@rcmp-grc.gc.ca.

Date modified:

2025-01-15