Human Trafficking and Child Exploitation (HTCE)


Image: Cellebrite Drone Analysis Course Shield

Level - Intermediate

Course Length: 3 Days


Nearly every child exploitation and human trafficking case involves the use of mobile devices and mobile networks. Extracting, analyzing and reporting mobile device evidence presents a formidable challenge for investigators who are faced with increased case demands, digital evidence backlogs, limited resources, and limited time.

This course was specifically designed to teach child exploitation and human trafficking team members, investigators, examiners, first responders and personnel assigned to human trafficking and exploitation units the principles of evidence extraction, analysis and reporting.

Participants in this course will gain a basic understanding of best practices and methodologies for extracting and viewing mobile device data, conducting on-scene previews (triage) of mobile devices, creating investigative reports and familiarity with UFED Reader.



The Human Trafficking and Child Exploitation Course (HTCE) is a three-day intermediate level program specifically designed to deliver mobile device investigation skills to investigators, examiners and practitioners assigned to child exploitation and human trafficking investigations.


Course objectives

Upon successful completion of this course, the student will be able to:

  • Configure Touch2, 4PC and UFED Physical Analyzer software.
  • Explain best practices for the on-scene identification, collection, packaging, transporting, examination and storage of digital evidence data and devices.
  • Demonstrate best practices when conducting SIM card, SD card, and cell phone extractions and examinations.
  • Identify functions used within Touch2 or 4PC to perform supported data extractions.
  • Exhibit how to open extractions using UFED Physical Analyzer and UFED Reader.
  • Summarize how to conduct basic searches using UFED Physical Analyzer and UFED Reader.
  • Exhibit how to create reports using UFED Physical Analyzer and UFED Reader.



Introduction
  • Discuss the circumstances when an on-site preview is warranted.
  • Understand the risks and benefits of on-site previews.
  • Identify the tools necessary to conduct on-site previews.
  • Develop best practices for conducting on-site previews.
  • Identify the common locations of files-of-interest during on-site previews.
  • Use of Physical Analyzer to quickly identify suspected exploitation/trafficking material.
  • Conduct on-scene examinations of mobile devices and external media.
Handling of Mobile Devices
  • Recognize legal considerations for seizing and searching devices.
  • Examine mobile device and internet of things (IoT) technologies of value in an investigation
  • Describe the phases of the investigative process.
  • Relate the correct procedures for identifying and handling digital devices as first responders.
  • Identify various locking mechanisms found on mobile devices.
  • Explain best practices to document mobile device investigations.
Touch2 and 4PC
  • Identify the components, features, and functions of the Touch2 and 4PC
  • Describe how to purchase and maintain the licensed UFED technology.
  • Discuss how to update software and firmware for Touch2 and 4PC
  • Modify Touch2 and 4PC configurations for the extraction of different devices and investigative needs.
Cellebrite Extraction Methodology
  • Discuss the methods employed to acquire data from mobile devices.
  • Identify best practices for the extraction of data from digital evidence devices.
  • Review and demonstrate the process for the sterilization of data storage media.
  • Complete SIM card extractions and cloning using 4PC.
  • Apply best practice techniques to produce media storage extractions.
  • Operate 4PC and UFED Physical Analyzer to perform device extractions.
  • Discuss the uses for UFED Camera Services.
Introduction to Analyzing User Data
  • Explore basic navigation and options available within UFED Physical Analyzer configurations
  • Explain and operate UFED Physical Analyzer and UFED Reader to examine data extractions.
  • Review the use of hash values for evidence authentication, inclusion and exclusion.
  • Examine data located in the UFED Physical Analyzer and UFED Reader Project Tree.
  • Describe the proficient use of UFED Physical Analyzer and UFED Reader in investigations.
  • Apply search, filter and data evidence tagging techniques for effective digital forensic reporting.
Onsite Preview of Digital Evidence
  • Discuss the circumstances when an on-site preview is warranted.
  • Understand the risks and benefits of on-site previews.
  • Identify the tools necessary to conduct on-site previews.
  • Develop best practices for conducting on-site previews.
  • Identify the common locations of files-of-interest during on-site previews.
  • Use of Physical Analyzer to quickly identify suspected exploitation/trafficking material.
  • Conduct on-scene examinations of mobile devices and external media.
Reporting on Technical Findings
  • Explain the fundamental elements of a UFED Reader report produced by UFED Physical Analyzer.
  • Describe the reporting options within the UFED Physical Analyzer and UFED Reader interfaces.
  • Compose PDF and UFED Reader reports using digital evidence artifacts recovered during an investigation.
UFED Reader
  • Discuss UFED Reader capabilities.
  • Understand how an UFDR file is created.
  • Import a UFDR file into UFED Reader for analysis and reporting.
  • Learn to tag and filter a UFDR Report.
  • Generating a customized UFED Reader report.

Last modified: Sunday, July 14, 2019, 11:40 AM