UFED Training Course Types

UFED Ultimate

This is a 2 day course which will provide the participants the information and tools required when examining mobile devices using UFED Ultimate: The basics of physical memory examination; Getting familiar with the UFED; How to connect a device and extract physical memory extraction data; Examining and analyzing the extracted data; Searching for information; Generating reports.

Participants will learn about:

The difference between the various extraction methods
Cloned SIMs – when is it required and how can it assist when examining phones.
Extracting and analyzing data that is inaccessible by logical analysis
Techniques to search and navigate through the extracted memory dump information
Customizing searches
Generating reports, including geotags, GPS and visualization in Google Earth / Google Maps

At the end of the course, each participant will receive a certificate and course materials.
This training will combine both frontal presentations and hands-on exercises for each of the different modules discussed in the course.

Audience
This course is intended for individuals who are familiar with UFED Logical functionality, but are not familiar with the UFED Ultimate.

UFED Logical

This is a day course which will provide the participants the information and tools required when examining mobile devices using UFED Logical: Starting with the basics; Getting familiar with the UFED; How to connect a device and extract the data; Examining and analyzing the extracted data; Searching for information; Generating reports.

Participants will learn about:

Extracting data from phone and SIM memory, including phone book, call logs, SMS text messages, photos, images etc.
Cloned SIMs – when is it required and how can it assist when examining phones.
Report Manager – Saving, printing and analyzing the extracted data, including Geotags

At the end of the course, each participant will receive a certificate and course materials.
This training will combine both frontal presentations and hands-on exercises for each of the different modules discussed in the course.

Audience
This course is intended for individuals who will be working with UFED. No prior knowledge of UFED is required.

UFED Python Scripting Course

This two-day course covers all aspects of writing scripts for UFED PHYSICAL ANALYZER, demonstrating access to the API and programming concepts in all three levels – Flash Translation Layer (FTL), file system reconstruction and content file decoding. The training contains many hours of practice and programming assisted by Cellebrite's top developers.

Requirements:

Basic Python (2.6) knowledge. Compulsory: standard collections, use of classes, ‘struct’ library, working with file streams.
Past experience in working with UFED PHYSICAL ANALYZER. Recommended – UFED training course

The course is divided into 4 parts, each lasting approximately 4 hours. In each part, one hour will be dedicated for lecture and demonstrations. The remaining time will be kept for hands-on practice.

The first part will refresh the participants’ understanding with necessary Python and Physical Analyzer functionalities.

All other parts will be based on programming decoding scripts for the different levels which can be found in a mobile phone: Flash translation layer, file system and user content. We will work on one constructive example throughout the training, and each participant will generate his own script for decoding data.

Please use the following tracking URL for the cellebrite website:http://ufedpython1-cbweba.eventbrite.com