You should also look into SANS' Security 508 Computer Forensics,
Investigation and Response. It's vendor neutral, very hands-on and
in-depth. The course presents a methodology for conducting forensic
investigations that can be adapted to any tool set, including evidence
acquisition, analysis and reporting. Each of these phases is covered
in depth, including
* Acquisition of physical memory and disk images
* Verification and maintenance of evidence through one-way hashes
* Chain of custody issues
* Creation and analysis of timelines
* Detailed explanation of filesystem structures for common Windows and
Linux filesystems
* Analysis of Windows artifacts including the registry, restore
points, volume shadow copy, etc.
* Analysis of common Windows file types (Word, Excel, etc.) and their artifacts
There's also a full day devoted to legal issues.
Again, the course doesn't teach a specific commercial tool. Instead,
you'll rely on open source tools such as the Sleuthkit. You'll learn
the command line tools first before being introduced to the GUI front
end, so you really get a deep understanding of what the tools are
doing behind the scenes.
The course materials are updated several times a year so many of the
techniques are cutting edge.
A few years ago, I took Infosec Institute's course on forensics. It
covered a broader range of topics including performing forensics on
PDAs and phones, but it did not go into as much depth as the SANS
course. If you really want to get an in-depth understanding of the
methods and tools used in computer forensics, check out the SANS
course. The principles learned there, will apply to mobile device
forensics. There are a variety of formats offered including taking it
at a week long conference, online over a 10 week period, or with a
local Mentor like myself over a 10 week period.
You can find more info at
Good luck.
Full disclosure I'm GCFA certified and a SANS Mentor for Security
508 Computer Forensics, Investigation and Response. I also hold the
EC-Council's Computer Hacking and Forensic Investigator certification.