Building a Strong Foundation: What I Learned from Hexordia’s Mobile Forensics Fundamentals Course

Course: Hexordia's Mobile Forensics Fundamentals Pt. 1

Link: https://learn.hexordia.com?affCode=OKMYOP

Time Commitment: Approximately 1 hour or less

Cost: FREE

Course Description: This course teaches terminology of mobile forensics and basic components. By the end of this course, students will understand the identifiers associated with mobile phones, know possible data sources related to a mobile phone that are external to the device and understand the types of artifacts and information that can be acquired from a mobile phone.

As a reminder, I'm moving through a personal project that’s been on my mind for a long time: diving into digital forensics and OSINT training! I’ve always admired the professionals I worked with in these fields during my law enforcement career, and now I’m taking the opportunity to learn the ins and outs myself and I am starting with FREE courses!

After completing Hexordia 's Mobile Device Preservation course, I was eager to continue building on that foundational knowledge. This time, I enrolled in Hexordia's Mobile Forensics Fundamentals Pt. 1. As someone who spent years in law enforcement leadership, I often relied on technical experts for insights into mobile forensics. Now, I’m diving deeper into this area myself, one course at a time, to better understand the tools and methodologies behind mobile investigations.

Why I Chose This Course

This course was the next logical step in Hexordia’s FREE training series. After learning about preserving mobile evidence, it made sense to move into understanding mobile forensics terminology, identifiers, and data sources. These are the building blocks of mobile forensic investigations, and I wanted to solidify my grasp on these essentials.

Key Takeaways

This course covered a broad range of topics, starting with key terminology and extending into practical insights about mobile device identifiers, storage types, and data sources. While I again knew some of what was taught, there was much that was new that I learned. Here are just a few topics covered in the course:

• Mobile Data Sources: Data isn’t always stored directly on a mobile device. It might reside on SIM cards, external storage (SD cards), backups (local computers or cloud services), IoT devices, or even in call data records retrieved via warrant.
• Device Identifiers: I gained a deeper understanding of identifiers like IMEI (International Mobile Equipment Identity), ESN (Electronic Serial Number), MEID (Mobile Equipment Identifier), and MSISDN (Mobile Station International Subscriber Directory Number). Each serves a unique role in identifying and tracking mobile devices.
• Device Backups: Mobile devices often create backups both locally and in the cloud. These backups can contain valuable information, including deleted data.
• Call Data Records (CDRs): The course briefly touched on obtaining and analyzing CDRs through warrant returns. Parsing and interpreting these records typically requires specialized commercial tools.
• IoT Devices: A significant reminder was how interconnected IoT devices (like smartwatches) can store critical data about their paired mobile devices, including search history and geolocation data.
• Storage Types: The difference between portable storage (e.g., SD cards) and adoptable storage (integrated with the device) was clarified, along with the unique challenges of analyzing each type.

One particularly fascinating segment broke down the structure of an IMEI number and explained how to use it to identify device details via lookup websites.

Challenges I Faced

While the course was well-structured, I did face a few hurdles:

• SIM Cards and Storage Variants: The section on SIM cards and SD card types (SD, SDHC, SDXC, FAT12, FAT16, FAT32, exFAT) felt overwhelming. I plan to create a cheat sheet to keep these details straight. I can also always refer back to the course as needed as the format of the course and learning platform makes this easy to do.
• Technical Terminology Overload: Terms like IMSI, ICCID, and MSISDN can blur together without regular use.
• Balancing Time Commitments: As with any self-paced training, finding dedicated time between professional and personal commitments is always a challenge. Thankfully, Hexordia’s courses are modular and easy to revisit.

How This Could Have Helped Me Earlier in My Career

As a law enforcement executive, I was responsible for making decisions about tools, technologies, and training for my team. While I relied on my technical experts, having even a foundational understanding of mobile forensics would have given me greater confidence in these decisions.

Additionally, this course would have been invaluable and a great required class for new investigators joining digital forensics units. The clarity it offers on terminology, identifiers, and data sources sets a solid foundation for more advanced training.

Who Can Benefit from This Course?

• Investigators and Detectives: Anyone handling mobile devices as part of an investigation would benefit greatly.
• Supervisors and Managers: Leaders overseeing technical units should have a working knowledge of these concepts to make informed decisions and to help their work units operate more efficiently and effectively. Taking courses like this would also help develop an understanding of what tools and training are needed for those working technical crimes.
• Aspiring Digital Forensics Professionals: This course serves as an excellent starting point for anyone considering a career in mobile forensics.

Final Thoughts

This course reinforced how much information is stored not just on mobile devices, but in the networks and ecosystems surrounding them. It also reminded me of the importance of continuous learning—even seasoned professionals can benefit from refreshing their foundational knowledge.

I’m excited to continue this journey and share more insights from future courses. Stay tuned!

?