Mobile DFIR — Why Phones Are the Crime Scene

Free lesson 1 of 11 from Mobile DFIR (Forensics & Incident Response) — Sound mobile forensics on iOS & Android — chain of custody, acquisition, app artifacts, timelines, deleted-data and cloud, plus responding to a compromised device.. No account, no card.

The device that knows everything

A phone holds location history, messages, app data, photos and health data — often the single richest source in an investigation or incident. Digital Forensics & Incident Response (DFIR) is the discipline of extracting that evidence soundly and acting on it.

The two halves

What makes mobile hard

🎯 Challenge: Give the core tension between the "forensics" and "incident response" goals when you first pick up a suspect phone.
Show solution

Preservation vs. speed/containment. Pure forensics wants the device untouched and isolated to preserve every artifact and the chain of custody; IR may need to act immediately (isolate, kill a session, collect volatile data) to stop ongoing harm — which can alter the device. You balance them by documenting every action and preserving what you can before you change anything.

Liked it? 10 more lessons are waiting.

11 lessons · knowledge checks · final exam · verifiable certificate

Unlock all courses · CHF 9/month Buy only this course · CHF 19

What's in Mobile DFIR (Forensics & Incident Response)

Continue in the interactive course reader →