Mobile Forensics & Incident Response for iOS and Android

About this course

This advanced course teaches digital forensics and incident response for smartphones. You learn the forensic process from identification to report, how to keep an unbroken chain of custody, and why isolating radios and keeping a device charged matter. Acquisition lessons compare manual, logical, filesystem and physical levels on Android and show how encrypted iOS backups and Manifest.db are used. You read app artifacts in SQLite databases with their WAL files, plists and SharedPreferences, and build a timeline in UTC while handling Unix, Cocoa and WebKit epochs. Further topics cover realistic deleted-data recovery, iCloud and Google cloud evidence with preservation requests, and the incident-response loop for a compromised phone, such as a rogue MDM profile. A reporting lesson separates fact from interpretation, and a capstone scenario combines all steps. You can practise on your own phone and accounts.