Mobile Forensic Examiner
Examination of Android and iOS devices: acquisition methods and their limits, app and system artifacts, messaging, location and media.
Who it is for
Examiners who acquire and analyse smartphones in criminal, civil or corporate cases.
Exam format
40 multiple-choice questions in 60 minutes
Concepts, artifacts and interpretation, weighted by the blueprint.
15 tasks on an evidence package, within 6 hours
You download a sealed package, verify its SHA-256 and answer with exact values: paths, timestamps, identifiers. Part A counts for 40% and Part B for 60% of the score.
See what it looks like
When (UTC) was “contracts_v2.pdf” last opened by the user “m.lima”?
Exact values are graded automatically. Paths are case-insensitive and timestamps accept a ±1 second difference. Any tool may be used.
Blueprint
These domains are the course modules and the weights used to draw exam questions.
| Domain | Weight | |
|---|---|---|
| 01Mobile platforms and security models | 10% | |
| 02Acquisition methods | 20% | |
| 03Android artifacts | 20% | |
| 04iOS artifacts | 20% | |
| 05Messaging and social apps | 15% | |
| 06Location, media and metadata | 10% | |
| 07Validation and limitations | 5% |
Course syllabus
- 01Mobile platforms and security modelsIn preparation
- 02Acquisition methodsIn preparation
- 03Android artifactsIn preparation
- 04iOS artifactsIn preparation
- 05Messaging and social appsIn preparation
- 06Location, media and metadataIn preparation
- 07Validation and limitationsIn preparation
Exam languages
An exam opens in a language only when its whole item bank has been translated and reviewed.