Don’t touch that phone…yet! – The importance of training within DFIR

Mobile devices are now the primary focus for a lot of digital forensic investigators, with the majority of crime types now leaning heavily on mobile forensics to find the truth. However, with the implementation of new encryption methods and security features, dealing with mobile evidence comes with a whole host of pitfalls and potholes that examiners need to navigate and avoid. With a large portion of device triage and seizure still being performed by non-technical users, who are not equipped with forensic knowledge or to handle mobile devices with confidence, it highlights a skills gap that is ultimately impacting the quality of data recovered from digital devices.

This presentation aims to address some of the key issues surrounding mobile device handling within the industry, as well as highlight the importance of training within DFIR, most importantly for non-technical users. The talk will look to help attendees develop more effective strategies both at scene and in lab to maximise evidence collection, as well as look at long term goals for effective training within the field.