Human Trafficking and Child Exploitation (HTCE)
3 days
Intermediate-level course
Nearly every child exploitation and human trafficking case involves the use of mobile devices and mobile networks. Extracting, analyzing and reporting mobile device evidence presents a formidable challenge for investigators who are faced with increased case demands, digital evidence backlogs, limited resources, and limited time.
Participants in this course will gain a basic understanding of best practices and methodologies for extracting and viewing mobile device data, conducting on-scene previews (triage) of mobile devices, creating investigative reports and familiarity with Cellebrite Reader.
Course Content
Introduction
- Discuss the circumstances when an on-site preview is warranted and understand risks/benefits
- Identify the tools necessary to conduct on-site previews
- Develop best practices for conducting on-site previews
- Identify the common locations of files-of-interest during on-site previews.
- Use of Physical Analyzer to quickly identify suspected exploitation/trafficking material
- Conduct on-scene examinations of mobile devices and external media
Handling of Mobile Devices
- Recognize legal considerations for seizing and searching devices
- Examine mobile device and internet of things (IoT) technologies of value in an investigation
- Describe the phases of the investigative process
- Relate the correct procedures for identifying and handling digital devices as first responders
- Identify various locking mechanisms found on mobile devices
- Explain best practices to document mobile device investigations
Touch2 and 4PC
- Identify the components, features, and functions of the Touch2 and 4PC
- Describe how to purchase and maintain the licensed UFED technology
- Discuss how to update software and firmware for Touch2 and 4PC
- Modify Touch2 and 4PC configurations for the extraction of different devices and investigative needs
Cellebrite Extraction Methodology
- Discuss the methods employed to acquire data from mobile devices
- Identify best practices for the extraction of data from digital evidence devices
- Review and demonstrate the process for the sterilization of data storage media
- Apply best practice techniques to produce media storage extractions
- Operate 4PC and Physical Analyzer to perform device extractions
- Discuss the uses for UFED Camera Services
Introduction to Analyzing User Data
- Explore basic navigation and configuration options
- Explain and operate Physical Analyzer and Cellebrite Reader to examine data extractions
- Review the use of hash values for evidence authentication, inclusion and exclusion
- Examine data located in the Physical Analyzer and Reader Project Tree
- Describe the proficient use of Physical Analyzer and Reader in investigations
- Apply, search, and filter data evidence tagging techniques for effective reporting
Onsite Preview of Digital Evidence
- Discuss the circumstances when an on-site preview is warranted
- Understand the risks and benefits of on-site previews
- Identify the tools necessary to conduct on-site previews
- Develop best practices for conducting on-site previews
- Use of Physical Analyzer to quickly identify suspected exploitation/trafficking material
- Conduct on-scene examinations of mobile devices and external media
Reporting on Technical Findings
- Explain the fundamental elements of a Cellebrite Reader report produced by Physical Analyzer
- Describe the reporting options within the Physical Analyzer and Cellebrite Reader interfaces
- Compose PDF and Cellebrite Reader reports using digital evidence artifacts recovered during an investigation
Cellebrite Reader
- Discuss Cellebrite Reader capabilities
- Understand how an UFDR file is created
- Import a UFDR file into Cellebrite Reader for analysis and reporting
- Learn to tag and filter a UFDR Report
- Generating a customized Cellebrite Reader report
Last modified: Tuesday, May 19, 2020, 9:19 AM