About
This training is designed for digital forensics investigators, incident responders, SOC analysts, and anyone who wants to truly understand mobile forensics and OSINT correlation through hands-on work. By the end of the session, you'll have a deep understanding of how to conduct legally sound mobile device investigations, being able to perform complete forensic extractions using Oxygen Forensics, analyze mobile artifacts across multiple data sources, generate comprehensive forensic reports, and enrich mobile evidence with OSINT intelligence for advanced threat correlation and investigative purposes.
Full Agenda
Phase 1: Foundations of Digital Forensics Investigations
Digital Forensics in México
Overview of Mexican legislation for digital forensics
Digital forensic methodology and legal best practices
Mobile forensics within the broader investigative ecosystem
Reality vs. framework challenges in LATAM investigations
Phase 2: Tooling and Platform Setup
Installation of Oxygen Forensics Software
Configuring the forensic environment
Conceptual overview of mobile device forensics
Advanced analytics capabilities of Oxygen Detective
Oxygen Forensics Detective GUI
Case tree structure and case management
Navigating general and analytic sections
Tab customization and data visibility strategies
Phase 3: Data Ingestion and Correlation
Importing Evidence
Techniques for importing diverse mobile data sources
Managing and merging multiple extractions
Comparing device view vs. consolidated case view
Analysis and Report Generation
Filtering, keyword searches, and tagging methods
Mapping and geolocation analysis
Timeline generation and contextual data reconstruction
Generating forensic reports for legal and technical audiences
Phase 4: Extended Use Cases – OSINT & Attack Surface Intelligence
Enriching Mobile Evidence with OSINT & Surface Intel
Cross-referencing mobile data with OSINT platforms
Tracking digital identities and exposed assets via open data
Use cases: Social engineering validation, contact correlation, and exposed credentials
Linking mobile forensic artifacts to external threat intelligence feeds
Ethical and legal implications
Requirements
Bring Your Own Device (BYOD):
Windows OS with administrative privileges
Minimum 16GB RAM
30GB free disk space
Prior experience in computer forensics or investigations recommended
Materials Provided
Comprehensive PDF Manual
Publicly available forensic datasets
Cases created only for the course
One Time Licensed use of Oxygen Forensics tools (dongle-protected only available for the class)
Trainers
Erik Novas
Erik is an Attack Surface Intelligence specialist at Bishop Fox COSMOS with over a decade of experience in digital forensics and cyber threat intelligence. His career includes leadership positions at BBVA México and Banorte, where he headed cyber threat intelligence operations.
Nicolas Solano Luna
Nicolas is a Technical Account Manager at Oxygen Forensics and co-founder of Dormant Tree Consulting, specializing in digital investigations and information security. With nearly 15 years in digital forensics, he specializes in computer and mobile device forensics. His expertise bridges forensic technology capabilities with real-world investigative needs in the Mexican and Latin American markets.