Description:
This course introduces students to the principles of Chain of Evidence and the process of mobile phone forensic analysis, both from legal and technical perspectives. It covers all the steps of the mobile forensics procedure from discovery/seizure through triage and securing at the crime scene, unlocking, imaging, thorough analysis and preparation of reports suitable for presentation in courts.
An eminently practical course that will prepare the student to deal with these devices forensically from three interconnected perspectives. First, the legal framework from where the forensics process arises, mainly criminal investigations, dealing with concepts encompassing the lawful forensics process to Court presentation. Second, the telecommunications framework where the mobile phone communication is carried out, covering relevant aspects such as the network data stored by the Mobile Network Carriage Service Providers and lawful call intercept. Lastly, the computer science framework, i.e. digital forensics, where the analysis of internal artifacts and relevant objects is performed. Relevant case objects may include phone logs, applications’ databases, files and other related records.
Students will use appropriate licensed data analysis tools to investigate phone contents and network records.
Due to sensitive content, it may be necessary to provide unclassified content to mainstream students; while cleared students may be able to access sensitive, protected content in some parts of the course.
Learning outcomes
After completing this course the student:
- understands the particularities and challenges of the mobile phone forensics procedure;
- understands the system-level workings of 2G, 3G and 4G mobile networks, with particular emphasis on characteristics, logs and records of relevance to investigation;
- understands the legal expectations of forensic evidence and preparation of expert reports in compliance with the Estonian Code of Criminal Procedure;
- possesses basic competence to deal with the technical aspects of the mobile forensics investigations by selecting and using the appropriate tools;
- possesses basic competence to perform all the steps for a full and lawful mobile phone forensics investigation;
- generates expert forensic reports for presentation in Estonian criminal proceedings.
