Human Trafficking and Child Exploitation (HTCE)

shield 

3 days
Intermediate-level course

Nearly every child exploitation and human trafficking case involves the use of mobile devices and mobile networks. Extracting, analyzing and reporting mobile device evidence presents a formidable challenge for investigators who are faced with increased case demands, digital evidence backlogs, limited resources, and limited time.

Participants in this course will gain a basic understanding of best practices and methodologies for extracting and viewing mobile device data, conducting on-scene previews (triage) of mobile devices, creating investigative reports and familiarity with Cellebrite Reader.




Course Content

sidebar image 
Introduction
  • Discuss the circumstances when an on-site preview is warranted and understand risks/benefits
  • Identify the tools necessary to conduct on-site previews
  • Develop best practices for conducting on-site previews
  • Identify the common locations of files-of-interest during on-site previews.
  • Use of Physical Analyzer to quickly identify suspected exploitation/trafficking material
  • Conduct on-scene examinations of mobile devices and external media
sidebar image 
Handling of Mobile Devices
  • Recognize legal considerations for seizing and searching devices
  • Examine mobile device and internet of things (IoT) technologies of value in an investigation
  • Describe the phases of the investigative process
  • Relate the correct procedures for identifying and handling digital devices as first responders
  • Identify various locking mechanisms found on mobile devices
  • Explain best practices to document mobile device investigations
sidebar image 
Touch2 and 4PC
  • Identify the components, features, and functions of the Touch2 and 4PC
  • Describe how to purchase and maintain the licensed UFED technology
  • Discuss how to update software and firmware for Touch2 and 4PC
  • Modify Touch2 and 4PC configurations for the extraction of different devices and investigative needs
sidebar image 
Cellebrite Extraction Methodology
  • Discuss the methods employed to acquire data from mobile devices
  • Identify best practices for the extraction of data from digital evidence devices
  • Review and demonstrate the process for the sterilization of data storage media
  • Apply best practice techniques to produce media storage extractions
  • Operate 4PC and Physical Analyzer to perform device extractions
  • Discuss the uses for UFED Camera Services
sidebar image 
Introduction to Analyzing User Data
  • Explore basic navigation and configuration options 
  • Explain and operate Physical Analyzer and Cellebrite Reader to examine data extractions
  • Review the use of hash values for evidence authentication, inclusion and exclusion
  • Examine data located in the  Physical Analyzer and Reader Project Tree
  • Describe the proficient use of Physical Analyzer and Reader in investigations
  • Apply, search, and filter data evidence tagging techniques for effective reporting
sidebar image 
Onsite Preview of Digital Evidence
  • Discuss the circumstances when an on-site preview is warranted
  • Understand the risks and benefits of on-site previews
  • Identify the tools necessary to conduct on-site previews
  • Develop best practices for conducting on-site previews
  • Use of Physical Analyzer to quickly identify suspected exploitation/trafficking material
  • Conduct on-scene examinations of mobile devices and external media
sidebar image 
Reporting on Technical Findings
  • Explain the fundamental elements of a Cellebrite Reader report produced by Physical Analyzer
  • Describe the reporting options within the Physical Analyzer and Cellebrite Reader interfaces
  • Compose PDF and Cellebrite Reader reports using digital evidence artifacts recovered during an investigation
sidebar image 
Cellebrite Reader
Last modified: Tuesday, May 19, 2020, 9:19 AM