Mobile Device Forensics Fundamentals

Name: Mobile Device Forensics Fundamentals
Price: 497 USD
Availability: InStock

Learning Outcomes

What You'll Learn

✓Apply Riley v. California and Carpenter v. United States to mobile device seizure and legal process decisions

✓Execute proper seizure protocol: Faraday isolation, AFU/BFU state preservation, and contemporaneous documentation

✓Distinguish logical, file system, and physical acquisition types and select the appropriate method per device and OS version

✓Understand iOS and Android security architecture: Secure Enclave, FBE, Samsung Knox, ADB, and OEM extraction variation

✓Operate Cellebrite UFED, Magnet AXIOM, and GrayKey workflows and cross-validate critical findings across tools

✓Extract and interpret SMS, iMessage, WhatsApp, Signal, Telegram, and Snapchat artifacts, including deleted record recovery

✓Analyze KnowledgeC.db, Photos.sqlite, browser history, and iOS health data as behavioral artifact sources

✓Analyze GPS, Apple Significant Locations, Google Location History, and CSLI with correct precision and source language

✓Draft and serve cloud legal process under 18 U.S.C. § 2703 and correctly interpret returns from Apple, Google, Meta, and Snap

✓Write court-ready mobile forensics reports that explain acquisition type, limitations, and provider return findings to non-technical readers

Who This Course Serves

Built for Practitioners

Smartphones are the primary evidence source in most modern investigations. This course is for professionals who need to handle, extract, and explain mobile evidence correctly.

🚔

Law Enforcement

⚖️

Attorneys & Paralegals

🏛️

Government Agencies

🪖

Military & Intelligence

🏢

Corporate Security

🔍

Private Investigators

🧪

Forensic Examiners

📋

Compliance Teams

Course Curriculum

14 Modules · 21 Lessons · Final Assessment

01Why Mobile Devices Matter▾

Phones as Evidence Sources
Mobile Evidence Limitations

02Mobile Evidence Fundamentals▾

Device Identifiers: IMEI, ICCID, Apple ID, Android ID
iOS vs. Android Architecture: SIM/eSIM Handling, SD Card Acquisition

03Legal Authority & Scope▾

Legal Authority for Mobile Device Examination (Riley, Carpenter)

04Mobile Device Preservation▾

Seizure Protocol: Faraday, Network Isolation, AFU/BFU, Power State

05Mobile Acquisition Basics▾

Acquisition Types: Manual, Logical, File System, Physical, AFU vs. BFU

06iOS & Android Forensic Concepts▾

iOS Security Model: Secure Enclave, Data Protection Classes, iCloud Backup
Android Security Model: FDE/FBE, ADB Limitations, SELinux, Samsung Knox

07Tool-Based Workflow▾

Cellebrite UFED Workflow
Magnet AXIOM Workflow
GrayKey: LE-Only Extraction, Full vs. Partial, Passcode Timing

08Core Mobile Artifacts▾

Contacts, Call Logs, SMS, iMessage, MMS: Sources & Validation
Device Activity Artifacts: Photos.sqlite, KnowledgeC.db, Safari/Chrome, HealthKit

09Messaging App Evidence▾

WhatsApp, Signal, Telegram, Snapchat: Artifacts, Limits & Recovery

10Location Evidence▾

GPS, Apple Significant Locations, Google Location History, CSLI, Interpretation

11Mobile Analysis Workflow▾

Intake, Acquisition Planning, Artifact Triage, Keyword Search, Bookmarking

12Reporting & Court Readiness▾

Mobile Evidence Reporting: Acquisition Type, Limitations, Exhibits, Testimony

13Cloud Evidence & Legal Process▾

Cloud Preservation & Legal Process: 18 U.S.C. § 2703, Provider Requests
Interpreting Provider Returns: Apple, Google, Meta, Snap Timestamp Analysis

14Final Assessment▾

Course Review & Key Takeaways

★ Final Knowledge Quiz · Certificate of Completion

Everything In Your Seat

What Your Seat Includes

1

The Mobile Forensics Curriculum. 14 modules and 21 lessons: iOS and Android preservation, acquisition, core artifacts, messaging apps, location evidence, cloud evidence with legal process, and court-ready reporting. Deliberately tool-agnostic.

2

The Examiner Reference Library. 16 downloadable references, checklists, and forms for the mobile bench.

3

Module knowledge checks and the final assessment. A check for every module, then a final assessment that gates the certificate.

4

The Certificate of Completion. 10 CPE hours and a public verification URL for your training file.

5

12 months of access. All curriculum updates during your window included.

The live classroom version of this course, Fundamentals of Mobile Device Forensics (4 days), runs $2,595 per seat in person on our published training calendar. Your seat, self-paced: $497.

Your Instructor

Developed by the Practitioner Who Built It

Eric L. Waldrep

Director of Training, The Waldrep Company | U.S. State Dept. ATA Cyber Mentor | MCFE Certified

Eric Waldrep has been in law enforcement for 27 years and active digital forensics for 19+ years, examining casework in federal and state courts. Proficient with Cellebrite and Magnet AXIOM tooling. Selected by the U.S. State Department's ATA program to train allied nation law enforcement in digital forensics. His mobile forensics curriculum comes directly from active mobile evidence cases, not certification prep materials.

MCFE Certified

Cellebrite Tool Proficient

State Dept. ATA Cyber Mentor

19 years forensics

Completion

Certificate of Completion

🎓

Certificate of Completion, The Waldrep Company

Students who complete all 14 modules and the final assessment receive a Certificate of Completion from The Waldrep Company, issued in the student's name, signed by Eric L. Waldrep, and including course title, completion date, and course duration.

Note: Certificate of Completion from The Waldrep Company. Does not constitute a third-party forensic certification.

Common Questions

Frequently Asked Questions

Do I need Cellebrite or GrayKey to take this course?▾

No. This is a concept and methodology course. You don't need any tools installed. The course covers Cellebrite UFED and Magnet AXIOM workflows through detailed written instruction. Cellebrite Premium and GrayKey are covered conceptually: they are law enforcement tools not available for private purchase.

Is this course appropriate for prosecutors and defense attorneys?▾

Yes. Attorneys who review, challenge, or sponsor mobile evidence benefit from understanding how it was collected, what limitations apply, and how to question the examiner's methodology. The course is written to be accessible to non-engineers.

What does "AFU vs. BFU" mean and why does it matter?▾

After First Unlock (AFU) and Before First Unlock (BFU) describe the encryption state of an iOS device. AFU devices (those that have been unlocked at least once since boot) provide significantly more extraction data. BFU devices (just powered on, never unlocked) are much more difficult to extract from. Module 4 covers seizure protocol for preserving AFU state.

Can my agency purchase via purchase order?▾

Yes. Government PO and net-30 invoicing are accepted. Contact us at (251) 216-1164 or submit an inquiry.

Do you offer group pricing?▾

Yes. Agency pricing is 25% off at 5 or more seats. Contact us to arrange group enrollment and invoicing.

Is a refund available?▾

Two guarantees, in plain language. The 30-Day Look: enroll, open every module, download the templates, and if within 30 days you decide the course is not right for your work, email info@thewaldrepcompany.com for a full refund. One condition, for the integrity of the credential: a refund revokes any certificate issued for this course and removes it from the public verification registry. The Pass Commitment: complete every lesson and module quiz inside your 12-month window and attempt the final exam, and if you cannot pass, we extend your access at no charge and point you to exactly what to restudy until you do. What we do not guarantee: that any court will qualify you as an expert witness, that any specific agency will accept this training for a particular purpose, or any case outcome. Nobody can honestly guarantee those things, and you should be careful with anyone who does. See the full refund policy.

Educational Use & Tool Reference Notice

This course is provided for educational purposes only. References to commercial forensic products (including but not limited to Cellebrite® UFED, Cellebrite Premium, Magnet AXIOM, and GrayKey®) are made solely to illustrate concepts, methodologies, and publicly documented workflows that practitioners may encounter in the field.

Discussion of any specific tool is not intended as, and shall not be construed as: (i) an endorsement, recommendation, or comparative evaluation of one product over another; (ii) operational training, certification, or qualification in the use of that product; (iii) an authoritative statement of any vendor's current capabilities, features, version behavior, or pricing; or (iv) the disclosure of confidential, proprietary, or non-public information. This course is not a substitute for the vendor-provided training and certification required to operate any specific tool.

All tool references rely exclusively on information made publicly available by the respective vendors or in published literature. All trademarks, product names, and registered marks are the property of their respective owners and are used herein for identification and educational purposes only. The Waldrep Company is not affiliated with, sponsored by, or endorsed by any of the tool vendors mentioned in this course.

Certificate Disclaimer. The Certificate of Completion issued by The Waldrep Company evidences that the holder completed the course curriculum and passed the required assessments. It is not a license, an accreditation, a government or POST certification, vendor certification (such as Cellebrite CCO/CCPA or Magnet AXIOM Certified Examiner), or a guarantee that any specific court will qualify the holder as an expert witness under Daubert, Kumho, Frye, or any state analogue. Whether a witness is qualified in a specific matter is a determination reserved to the trial court in that matter. See our Terms of Service for full details.