Our micro-learning modules let you zero in on exactly the skill or problem you need, whether it’s decoding app data, recovering deleted records, or refreshing core methods. Built on realistic case data, each session is designed to give you fast, practical knowledge you can use the same day. Join live online or learn on demand, whenever time is short and the job demands it.
Dive into SQLite’s hidden files and learn to uncover changes most tools overlook. This specialized 2-hour micro-course teaches you how to analyze WAL and SHM files to track edits, recover uncommitted data, and reconstruct app timelines with confidence.
Duration: about 2 hours.
Format: Live online or On-Demand.
Master the core of SQLite by understanding how data is truly stored and deleted. In this advanced 5-hour micro-course, you’ll learn to manually decode pages, interpret records, and recover data your tools may miss — critical for court-ready reporting and deep-dive analysis.
Duration: approx. 5 hours.
Format: Live online or On-Demand.
Explore articles and tutorials designed to complement your training. Fast, practical learning built on real forensic challenges.
Explore the role of the Protective MBR in GPT-partitioned disks. This guide delves into its purpose, functionality, and importance in digital forensic investigations.
Explore the vital role of the GPT Header in maintaining disk integrity. This article provides insights into its structure, purpose, and relevance in forensic investigations.
Gain a deeper understanding of the GPT Partition Entry Array and its significance in digital forensic analysis. This guide explores key techniques and insights to enhance your forensic investigations.
Unlock the secrets of SQLite freeblocks and learn how to recover deleted records using forensic techniques.
Varints are the backbone of SQLite’s efficient data storage, encoding values in a compact format that digital forensic investigators must decode to uncover critical evidence. This blog dives into the decoding process, real-world examples, and tools like the Varint Calculator to simplify forensic analysis.
SQLite overflow pages store fragmented data that doesn’t fit within a single database page, requiring forensic analysts to reconstruct them for complete evidence recovery.
Discover how I decrypted a locked Apple Note from an iOS 16.7.10 device using open-source tools like Hashcat, Python, and CyberChef. This step-by-step forensic workflow reveals the process behind extracting and decrypting hidden content from Apple’s Notes app. A must-read for digital investigators and mobile forensics professionals.
Discover Backup2FS, a free tool from Elusive Data that simplifies iOS backup analysis by normalizing backups into an easy-to-navigate file system.
Instantly decode VarInts from mobile app databases with Elusive Data’s free forensic tool. Convert hex, binary, and decimal values for faster, more accurate investigations.
This free guide provides a practical walkthrough of GPT-partitioned disks, covering the Protective MBR, GPT Header, and Partition Entry Array. It’s designed to help forensic professionals understand disk structures, recover data, and validate evidence.
This guide provides a practical walkthrough for forensic analysts dealing with encrypted Apple Notes in iOS 16.x. It focuses on identifying and decrypting locked notes stored in the NoteStore.sqlite database extracted from iOS backups.
Be the first to hear about new training opportunities, free tools, case-based blog posts, and practical insights. Our monthly newsletter is built to help you learn faster, solve cases smarter, and keep up in a field that never stands still.
Fill in your email to sign up.
