Nordic Computer Forensic Investigators - Module 2D Mobile Extraction and Artifacts

Study information

• Your learning outcomes

  The aim of this program is to ensure that the quality of computer forensic investi-gation is of a high level, guaranteeing legal protection and the right to privacy.

  General competence

  After completion of the module candidates will:

  • perform professional tasks in the role of investigator with increased insight and confidence
  • see the role of investigation in a broader perspective during an investigation of mobile phones
  • identify ethical and legal issues during investigation

  
  Knowledge

  After completion of the module candidates will have knowledge about:

  • The logical functioning of mobile phone file and operating systems
  • The different types of mobile networks currently in use
  • The present and future challenges of mobile phone digital forensics
  • The different methods of acquisition
  • Preservation and isolation of mobile phone devices
  • External, internal and cloud sources for evidence from mobile phones
  • The functionality of the most used Apps, including how and where they save data
  • scientific principles that underlie digital evidence

  
  Skills

  After completion of the module candidates will be able to:

  • handle, preserve and acquire selected mobile phone devices
  • acquire from cloud sources used by mobile phones
  • explain how the mobile phone file and operating systems function on a logical abstraction level
  • perform an analysis of artefacts in mobile phone systems
  • validate the results of automated tools and select tools that are most appro-priate for the task in hand
  • investigate and document each phase of a mobile phone investigation
  • use open source tools as a platform for investigation
  • apply a sound methodology in all analysis of mobile phones

• Admission criteria

  The primary target group is police staff in the Nordic countries whose main task is handling and investigating digital evidence. It is a prerequisite that participants are selected in accordance with local competency plans.
  Employees in other International police services or governmental agencies who work, or will work, with digital evidence are also eligible to apply.

  Applicants are required to provide the following documentation:

  • possess Higher Education Entrance Qualification
  • be employed by a national or local governmental agency
  • have passed NCFI Module 1 Core Concepts in Digital Investigation and Foren-sics. The former NCFI Module 2 (25 ECTS) is also accepted
    
    

  Foreign applicants are only entitled to apply if:

  • the applicant's country has a partnership with PHS
  • they have been selected in accordance with the partner's competency plans

  
  Applicants who do not have the higher education entrance qualification have to provide:

  • minimum of 5 years work experience, of which maximum 2 years can be education, replace the requirements for Higher Education Entrance Qualifi-cation. This arrangement only applies to applicants over the age of 25

  
  The prerequisite for having completed NCFI modules may be overridden if the ap-plicant provides documentation for having completed equivalent education. To be considered as equivalent, the education must cover the following topic:

  • computer forensic methodology

  
  and in addition at least one of the following topics:

  • digital forensics
  • mobile forensics
  • online investigations

  
  The total workload of the education should be equivalent to approximately 15 ECTS.

• Practical information

  This module is delivered on-line as a part-time education, and the students are expected to complete the program within one semester. The approximate duration of the module is 420 hours of study.
  
  The module comprises lectures, individual and group work, exercises, quizzes, assignments and literature study. Student support will be delivered via electronic means such as: email, discussion fora, chat and virtual classrooms. Certain mandatory live online lectures, no more than 7 days, will be conducted during the course.

  The working methods of the study should help to provide students with good learning outcomes, and the emphasis is on flexible and diverse forms of work with a high degree of student activity. The program is organized around key issues and challenges in the investigation of electronic traces, which is illuminated with relevant theory.

  An e-learning platform is used for the administration and implementation of the module.

  The following requirements have to be approved before students may sit the exam:

  • Automatically graded quizzes for each topic
  • Three practical assignment
  • A Case Study
  • Attendance at mandatory lectures

• Schedule for tuition and exam

  Spring 2024 

  Exam: Online. Date 07.05.2024 - 08.05.2024

• Tuition fee

  A semester fee is required.

  An external student is defines as a student from another Nordic coutry, or an agency outside the police service (including police special agencies). The tuition fee is not applicable to students coming from insttitutions which have a reciprocal agreement with NPUC, or an agreement involving contributions to the study programme. The student fee is NOK 25 000,-.

• Contact information

  Academic questions

  Academic inquiries should be adressed to e-mail: cybercrime@phs.no.

  Questions relating to the admissions procedure

  Questions regarding the admission process (deadline, application process, documentation) should be adressed to e-mail: opptakevu@phs.no.

  Administrative questions about the study programme

  If you do not find what you are looking for, please send an email to: studiekontoret.oslo@phs.no

The course is one of a series of modules in the NCFI Programme

• All modules

  Nordic Computer Forensic Investigators - Introduction to Digital Policing

  Nordic Computer Forensic Investigators - Module 1 Core Concepts in Digital Investigation and Forensics

  Nordic Computer Forensic Investigators - Module 2A Advanced Computer Forensics

  Nordic Computer Forensic Investigators - Module 2B Online Investigation

  Nordic Computer Forensic Investigators - Module 2C Network Forensics and Cybercrime

  Nordic Computer Forensic Investigators - Module 2D Mobile Extraction and Artifacts

  Nordic Computer Forensic Investigators - Module 3A Forensic Tool Development

  Nordic Computer Forensic Investigators - Module 3B Linux Artifacts

  Nordic Computer Forensic Investigators - Module 3C Linux as an Investigative Platform

  Nordic Computer Forensic Investigators - Module 3D Macintosh Computer Forensics

  Nordic Computer Forensic Investigators - Module 3E Windows Forensics

  Nordic Computer Forensic Investigators - Module 3F Memory Investigation

  Nordic Computer Forensic Investigators - Module 3i Macintosh Forensics, Advanced

  Nordic Computer Forensic Investigators - Module 3K Report Generation Visualisation