skip to main content

DF125 - Mobile Device Examinations with EnCase

Have questions about training?   Contact us

Duration: 2 Days

Digital forensics is no longer limited to the examination of desktop computers, laptop/notebook devices, or their associated media. Examiners of digital evidence are now involved in the examination of mobile devices and their associated applications in the pursuit of uncovering information related to criminal and corporate investigations. While the field of mobile device examinations shares a crossover with more traditional digital forensics, mobile devices offer their own unique characteristics and challenges.

To meet these challenges OpenText™ EnCase™ Forensic has been developed to incorporate acquisition of such devices while EnCase™ Mobile Investigation provides an examination platform, which includes Optical Character Recognition, native support for viewing SQLite databases, and reporting functionality.

Delivery method: Group-Live. NASBA defined level: basic

CPE Credits - 16


This course is intended for digital forensic investigators, including law enforcement, government, military, corporate, IT security, and litigation support professionals who are seeking to analyze smartphones and mobile devices for evidence for criminal and corporate investigations.


Basic computer skills. Advance preparation for this course is not required.


This hands-on course provides practical demonstrations and real-life simulations to help understand the methodology of using EnCase Forensic and EnCase Mobile Investigator in mobile device examinations involving criminal, corporate, and civil investigations.

This course will provide instruction related to the acquisition of mobile devices using EnCase Forensic followed by the examination via the use of EnCase Mobile Investigator (as well as EnCase Forensic).

The course will detail performing acquisitions from both a handset and a device backup followed by examination of devices running the mobile operating systems Android and Apple iOS.

During class the automated examination functionality of EnCase Mobile Investigator / EnCase Forensic will be used as well as manual examination and via EnScript programs of file types, including SQLite databases and Apple property lists.

Students attending this course will learn the following:

  • The history of Android and Apple iOS mobile operating systems
  • How to prepare for and conduct an acquisition of an Android device
  • How to conduct an acquisition of an Android Samsung S5/S6 device via the android bootloader
  • How to conduct an acquisition of an Apple iOS device
  • How to conduct an acquisition of Apple iOS backup (including an encrypted backup)
  • How to examine the Android system, user, application, and Internet artifacts
  • How to examine the Apple iOS system, user, application, and Internet artifacts
  • How to conduct an examination of still and moving image file formats
  • Understanding the structure of file types and data structures, including (but not limited) to support mobile device applications and system artifacts:
    • SQLite databases
    • Apple property lists (pLists)
    • EXIF

     Course Syllabus


Format Currency Price
Per Student at OpenText Site €  1,961.79 
Per Student at OpenText Site GBP  1,700.44 
Per Student at OpenText Site USD  2,195.00 

Taxes: All prices exclude VAT or other taxes where applicable (all currencies).

Extra expenses: Customer site course prices do not include instructor travel expenses, which are billed separately.

Reservations: Please provide a minimum of 3 weeks advance notice when arranging courses at customer sites.

Course & Workshop Calendar

Below is a listing of all the currently available dates and locations for this course or workshop from OpenText.

To register, please select the course you want to attend by clicking the "Add to cart" button.

Date Course type Course name Language Location Price Add
Feb 25, 2020  On-site  DF125 - Mobile Device  English  GSI-Pasadena, CA 2,195.00  Add to cart
May 19, 2020  On-site  DF125 - Mobile Device  English  GSI-Washington, DC 2,195.00  Add to cart
Jun 02, 2020  On-site  DF125 - Mobile Device  English  GSI-Reading, UK 1,700.44  Add to cart