Python for Mobile Forensics

advanced level
A transformative program that takes students from no programming experience to proficiency in Python within one week. Designed specifically for digital forensic professionals, this course provides a structured approach to mastering Python while applying it to realistic forensic scenarios.

Course overview

This course is for forensic professionals with basic Python or scripting experience who want to go further. It’s ideal if you’re dealing with unsupported mobile apps, custom databases, or need more flexible methods to extract and process data beyond what commercial tools offer.

24 CPE credits. Course author: James Eichbaum

Course objectives

  • Learn the fundamentals of Python scripting in a forensic context.
  • Automate the parsing of SQLite databases and custom file formats.
  • Extract and analyze artifacts from unsupported mobile applications.
  • Create repeatable workflows to reduce manual effort in investigations.
  • Gain confidence working with hex, binary, and structured data using Python.
  • Build scripts that validate, transform, and report on forensic findings.

Key course features

  • Code-focused labs: Write and run scripts in real-time using real forensic datasets.
  • SQLite & beyond: Learn to extract artifacts from SQLite, JSON, XML, protobuf, and custom formats.
  • Hands-on exercises: Work through structured tasks designed to mirror real cases.
  • Tool-agnostic: Build logic you can apply across forensic tools and platforms.

Who this course is for

This course is for forensic professionals with basic Python or scripting experience who want to go further. It’s ideal if you’re dealing with unsupported mobile apps, custom databases, or need more flexible methods to extract and process data beyond what commercial tools offer.

Course learning outcomes

  • Understand core Python syntax and scripting techniques relevant to forensic workflows.
  • Automate the parsing of mobile artifacts, including SQLite databases and JSON/PList files.
  • Develop custom scripts to extract, filter, and structure app data for reporting.
  • Work with libraries like sqlite3, plistlib, and json to analyze real forensic datasets.
  • Apply Python to streamline repetitive tasks and enhance analysis accuracy.
  • Build foundational skills to create repeatable, tool-agnostic workflows using Python.

Training Features

Course Format

your instructor

James Eichbaum

This course is created by James Eichbaum, a former law enforcement examiner and one of the most experienced instructors in mobile forensics. 

With over a decade of global training experience, including Global Training Manager at MSAB, he’s trained thousands of professionals across 30+ countries, from local police units to national labs.

James has led real investigations and testified in court. His training reflects that experience: practical, structured, and focused on what actually works. Every lesson is designed to help you recover mobile app data manually, understand what it means, and explain it clearly — whether you’re writing a report, answering a QA review, or testifying on the stand.

Trusted by investigators worldwide

Sarah M. Digital Evidence Specialist

Thank you for a great course! I finally get how to work with unsupported apps. That clicked during this course. I’ve done a few trainings before, but this one stood out because it was actually useful right away. The instructor explained how app data is stored in a way that made sense, and I really appreciated all the real examples. I’ve already used a few techniques in a current case.

Carlos G. Forensic Lab Tech

Very good course! Incredibly good teacher and I think that distance learning works at least as well as in the classroom! Thanks again James! Great balance between technical depth and hands-on labs. I liked that we didn’t just rely on tools, but looked under the hood and made sense of the data. It’s definitely helped me write clearer reports and explain findings to investigators.

Emily N. Digital Forensics Student

Best course I have ever taken. I really enjoyed the week, learned a ton, and everything was clear and easy to keep up with. The labs felt real and made sense, even without loads of experience. The instructor explained things so clearly and made it all feel manageable. I would absolutely recommend it to anyone working with mobile forensics.

Élodie L. Digital Analyst

Wow! I’ve taken other training that felt like a sales pitch. This was different. Everything was clearly explained, and I didn’t feel stuck to one tool. If your work involves unsupported apps or deleted data, this course is a must!

 Martin H. Digital Evidence Analyst

Didn’t expect to enjoy this as much as I did. The way the instructor broke stuff down, especially all the app data really made it fun. James really knows his stuff and kept things moving without overwhelming us. Took away real techniques I’ll use back at work. Keep up the good work, James!

Two ways to take the course. Both include
certification and hands-on labs.

Live Online

Join instructor-led sessions remotely. Choose one of our scheduled classes or customize for your team.

$2,290

Price per participant

Need to train a group? We offer discounted rates for 5+ participants and custom delivery for teams and agencies. Contact us for enterprise pricing and onboarding support.​
In Person | On-site

On-site training for teams. We tailor delivery and scope to your organization’s needs. Contact us for a custom quote.

Custom Quote

For teams​

Instructor-led training delivered on-site. Designed exclusively for teams and organizations. Available worldwide, tailored to your workflows. Contact us for a custom quote and tailored training plan.
FAQ

Frequently Asked Questions.

We’ve trained thousands of professionals, and these are the most common questions we hear before they enroll, from what’s in the course to how it fits into busy caseloads.

  • Live Online: Instructor-led sessions conducted remotely. Delivered online over 3 days. (Timing can be customized for your team, from full-day intensives to shorter sessions across multiple weeks.)
  • In-Person: Delivered onsite over 3 days. We tailor the format and depth to match your team’s availability, goals, and existing skill level.

This course is for forensic professionals with basic Python or scripting experience who want to go further. It’s ideal if you're dealing with unsupported mobile apps, custom databases, or need more flexible methods to extract and process data beyond what commercial tools offer.

Yes. The course is certificate-based and designed by a former law enforcement examiner with real testimony experience. The workflows taught are courtroom-ready and built to hold up under review.

Yes. The course is built around real-world app data, not generic examples. You’ll learn practical workflows you can apply immediately, even when your tools fall short.

Perfect. This course complements those tools, not replaces them.

stay updated

Stay in the loop. Sign up for our monthly newsletter.

Be the first to hear about new training opportunities, free tools, case-based blog posts, and practical insights. Our monthly newsletter is built to help you learn faster, solve cases smarter, and keep up in a field that never stands still.

Fill in your email to sign up.

training with elusive data

Fast access to the knowledge you need, when you need it.

Learn by doing the way that fits you, and gain practical skills you can use immediately.

Expert-led. Always current. Fresh training, ready for the cases you work on.

Learn from experience. Our instructors bring decades of hands-on experience from both investigations and training, and still work on active cases. Get expert guidance that keeps your skills sharp and your knowledge fresh, in a field that never stands still.

Training that fits in.
And works on day one.

Pick short, focused micro-lessons when time is tight. Go at your own pace with on-demand courses. Join a live online class, or bring the classroom to your team. Learn the way that fits you, without affecting your work or investigations.

Hands-on techniques you can use right away

No matter the format, each course gives you tools and techniques you can use right away. Work through interactive labs, CTF challenges, and exercises built on real case data, grounded in the realities of digital investigations.

Certification & CPE credits

Complete any course to receive a certificate that proves your skills in that specific area. Log your hours as CPE credits and use them toward your certification renewals.

Request Training

Submit your request for Training. This is not a binding registration, we will get back shortly.