EchoTraceAcademyGet a quote

Online Training for Mobile Evidence Investigations

Specialized online learning for law enforcement, investigators, and analysts working with mobile phones, carrier records, cloud activity, and mobile applications.

Build the technical knowledge to understand how these systems generate evidence, what the records mean, and how they can be interpreted together during an investigation.

Explore Courses View All-Access Subscription

THE GAP MOBILE TOOLS LEAVE

A phone extraction is not the same as understood evidence.

A modern phone extraction returns tens of thousands of handset, cellular, cloud, and app records that look precise and carry limitations nobody stated. Two investigators can read the same report and reach different conclusions — then struggle to explain how either got there.

REVIEW TRACE

Precision is not proof.

One record from a mock case, read the way the curriculum teaches it: what the data shows, what it cannot show, and what has to be tested next.

MOCK CASE ET-MC-201 · CELL SITE RECORD
Observed
The handset registered on a cell whose sector covers the relevant area at 21:42 UTC.
Not established
The record does not give a position, and it does not identify who possessed or operated the phone.
Test next
Compare cellular network, app, and cloud records for agreement, then check whether the activity required a user at all.

Qualified finding The activity is consistent with the phone being within the serving sector, subject to the stated propagation limits and the two alternative explanations that remain open.

FROM COMMON ERROR TO DEFENSIBLE PRACTICE

The four mistakes the curriculum drills out.

Every technical volume closes with the errors practitioners actually make. The courses assess whether learners avoid them.

  1. 01 · COMMON ERRORExtraction output read as established fact

    Validate the artifact and the acquisition before interpreting it. An extraction report states what a parser found, not what happened.

    WHAT REPLACES ITValidated interpretation
  2. 02 · COMMON ERRORA serving cell treated as a location

    Express cellular, GPS, Wi-Fi, and application location as a bounded area with its own uncertainty, and say what the terrain and network behaviour could change.

    WHAT REPLACES ITBounded location claims
  3. 03 · COMMON ERRORDevice activity attributed to a person

    Keep phone, number, account, and person as four separate entities until evidence links them — and record what remains unlinked.

    WHAT REPLACES ITHonest attribution limits
  4. 04 · COMMON ERRORTimestamps compared before they are normalized

    Separate event time from record, sync, and access time, resolve time zones and clock drift, then correlate.

    WHAT REPLACES ITDefensible sequence

ONE ROUTE, NOT TWO CATALOGUES

Find your learning route

Streams tell you what you are studying. Levels tell you how far you are taking it. Courses are the individual steps.

  1. Start with confidence

    ET-S00-F01Start here

    Technical Mobile Evidence Foundations

    Begin with the essential habits for reading mobile evidence carefully: separate the person, phone, account, and record; understand where evidence comes from; and state only what the records support.

    Start with Foundations

  2. Choose the evidence area that matters to your work

    After Foundations, choose the Stream that matches the evidence you need to understand. Nobody takes every Stream — a unit follows the ones its casework demands.

    Networks and carrier records

    Phones, accounts, and applications

    Analysis and reconstruction

    Groups are a reading aid only — they are not Streams, and they change nothing about the curriculum. The entry Stream that holds ET-S00-F01 also continues at higher Levels. Open the 11 Streams in the catalogue

  3. Progress at the depth your work requires

    Within the Stream you chose, courses run from Foundation to Specialist. A Level is how far you take the subject — not a separate catalogue, and not a qualification on its own.

    1. FoundationLevel 01 · 11 courses

      Read the record correctly and know what it does not say.

    2. PractitionerLevel 02 · 16 courses

      Work common records and document a conclusion that traces back to evidence.

    3. AdvancedLevel 03 · 11 courses

      Resolve conflicting evidence and defend what survives.

    4. SpecialistLevel 04 · 9 courses

      Validate changing or uncommon technical behaviour within a defined specialty.

    Levels are cumulative within a Stream. A higher-level course builds on the earlier learning in that subject area, and not every Stream carries a Specialist course. Level and Stream Credentials recognize different achievement patterns: breadth across prescribed competencies at a Level, or specialization within one named Stream at a stated Level. Compare recognition routes

    Explore all learning routes

4 RECOGNITION LAYERS

From one course to Certified.

Finish a course and you hold a Course Certificate. Cover the breadth of a Level and you hold a Level Credential. Take one stream end to end and you hold a Stream Credential. Above them sits Professional Certification — ET-CMEP, ET-CMRA, and ET-CMES across 10 specializations — the only layer permitted to say Certified. Eligibility never depends on how you paid.

  1. Layer 01Course CertificateOne course, completed and mastered.The approved course mastery standard.
  2. Layer 02Level CredentialOne standard, held across the prescribed competencies.An approved Level Credential blueprint.
  3. Layer 03Stream CredentialOne named stream, at a stated Level.An approved Stream Credential blueprint.
  4. Layer 04Professional CertificationThe top tier, and the only layer that may say Certified.The approved ET-CMEP, ET-CMRA, or ET-CMES-[Specialization] blueprint and a human-authorized decision.

4 Level Credentials, 10 Stream Credentials, and 4 Level Credentials recognize breadth, 10 Stream Credentials recognize specialization, and 3 top-tier designations require a broader prescribed curriculum plus controlled independent competency assessment. Read the full recognition architecture

THE ECHOTRACE METHOD

Every conclusion keeps its chain of reasoning.

An investigation is an effort to establish which technical explanations survive the evidence — not to confirm the one you started with. The same four-part structure runs through every course, so a supervisor, a defence expert, or a court can see exactly where the evidence ends and interpretation begins.

01
Observation

What the record directly shows, and which system created it.

02
Inference

What that record may reasonably indicate, and what else could explain it.

03
Conclusion

The interpretation that survives after the alternatives are tested.

04
Limitations

What the evidence cannot establish, stated as part of the finding.

CASE REASONING TRACE

Evidence is tested before a finding is stated.

4 sources · 2 hypotheses · 1 qualified finding
01HandsetApp, log, and media artifacts on the phone
02Cellular networkCall, message, session, and mobility records
03CloudAccount activity and synchronized app data
04LocationCell site, GPS, Wi-Fi, and app position data
NORMALIZE, THEN CORRELATECompare provenance, time basis, agreement, and gaps.Observations stay separate from interpretation.
HYPOTHESIS ABetter supported

The phone travelled with the subject

Consistent with three independent mobile sources.

HYPOTHESIS BNot excluded

The phone travelled with another person

Possible, and not ruled out by the current record.

QUALIFIED FINDING
The available evidence supports Hypothesis A more strongly.

Hypothesis B is recorded as a stated limitation, because none of the records establish who physically possessed the phone.

FOUNDATION LEARNING · LEVEL 01

Start with confidence.

EchoTrace Foundation courses are designed as a clear, approachable starting point for learners who are new to digital evidence. We introduce one idea at a time, explain technical language in everyday terms, and use a consistent fictional case story so learners always understand why a skill matters.

The shape of every Foundation lesson
  1. Case context
  2. What you will learn
  3. Why it matters
  4. A worked example
  5. Short multiple-choice checks

  • One repeatable flow

    Foundation learning uses a simple, repeatable flow: case context, what you will learn, why it matters, a worked example, and short multiple-choice checks.

  • The same evidence all the way through

    The same evidence is used throughout each lesson, example, and practice question. Learners do not have to decode a new scenario every time they practise.

  • A case story worth following

    Courses use realistic fictional cases with people, places, and a clear investigative purpose, helping learners connect evidence to a meaningful story.

  • Understanding, not memorising

    Foundation courses focus on understanding and careful reasoning, not memorising terminology or writing long answers.

  • Depth comes later

    More advanced workshops, open-ended analysis, and formal assessment are introduced later in Specialist-level learning and exams.

See the Foundation courses

HOW A COURSE IS BUILT

Designed backwards from real capability.

EchoTrace uses backward design. We start by defining what a learner should be able to do in a realistic investigation, then build the explanation, evidence example, guided practice, and assessment around that outcome.

  1. Define the practical outcome

  2. Choose realistic, controlled evidence

  3. Teach the concept in plain language

  4. Let learners practise with that same evidence

  5. Assess the skill later using changed values or a new scenario

SELF-DIRECTED, NOT INSTRUCTOR-LED

There is no class to join and no timetable to keep up with.

EchoTrace Academy is studied, not attended. A learner buys or is issued access, enrols without staff intervention, and works through short learning pockets and mock investigations at whatever pace casework allows. What never moves is the standard: prerequisites, controlled evidence release, and assessment conditions apply identically to everyone.

  • No cohort, no intake, no waiting list

    There is no scheduled class to join and no term to enrol into. Access opens on purchase or on an assigned entitlement, and the first course can begin the same day.

  • No instructor sets your pace

    Each course is delivered in short learning pockets designed to be completed between casework. You decide when to start a pocket, when to stop, and how long a course takes.

  • You choose the route, not a staircase

    Every learner completes the gateway course, then branches into the streams that match the casework in front of them. The catalogue is not a mandatory sequence.

  • You are responsible for the analysis

    Nobody hands over the conclusion. Mock investigations put the learner in front of mobile evidence that has to be interpreted, bounded, and defended in their own words.

Self-directed is not unsupported. Feedback, remediation, a graded hint ladder, approved AI procedural help, and human specialists all sit inside the experience — they respond to the learner instead of scheduling them, and consequential assessment results receive human review.

How the learner experience works, stage by stage

HOW A COURSE WORKS

Learn it, practise it, then prove you can do it.

This is not a video library, and it is not a classroom. Each course delivers short technical instruction, then puts the learner in front of phone evidence that has to be interpreted, bounded, and defended in their own words — on their own schedule. Guidance use is recorded for feedback, not treated as failure.

THE OPERATIONAL AIMNot identical conclusions. Consistent, reviewable reasoning.
See both ways to buy

TWO WAYS TO BUY

Buy a course. Or subscribe to all of them.

Take one course at a time and keep it for good, or open all 47 courses across the 11 streams with an All Access subscription. The teaching, the assessment, and the recognition are identical on both routes — and courses bought individually are credited if a learner subscribes later. See what each route can lead to

  1. OPTION 01 — PER COURSE

    Buy courses à la carte

    Pay for the course in front of you, and nothing else.

    Quoted per course, one-off purchase

    • Any course in the catalogue, bought individually
    • Lifetime access to the courses you have purchased
    • Course Certificate on mastery of each completed course

    BEST FOR An investigator with one specific gap — a Google Takeout return next week, a first cell site brief, a contested app conversation — or a unit funding training case by case.

    Request à la carte pricing

  2. OPTION 02 — SUBSCRIPTION

    Subscribe to All Access

    One subscription opens all 47 courses in every stream.

    Quoted per seat, annual term

    • All 47 courses across the 11 streams
    • Every new and revised course released during the term
    • The full mock investigation library and all three practice modes

    BEST FOR A learner working across more than two or three courses, and any unit that needs a shared standard, assigned pathways, and visibility of who has demonstrated what.

    Request an All Access quote

All Access seat tiers

À la carte courses are quoted per course per learner; All Access is quoted per seat on an annual term. No public price list is published — send a course list or a seat count and we will return a written quote with procurement documentation.

Compare à la carte and All Access in full

BEFORE YOU ASK PROCUREMENT

Questions we get from training officers.

Either. Courses can be bought à la carte as one-off purchases, with lifetime access to what you buy, or you can subscribe to All Access and open the entire catalogue for the length of the term. Most learners taking more than two or three courses find All Access is the cheaper route, but nothing obliges you to subscribe.

Subscription enquiry

Get a price for your unit.

Tell us whether you want individual courses or an All Access subscription, how many investigators you need to train, and which evidence streams matter most to your casework. We will return a written quote, a recommended learning pathway, and the procurement documentation your agency requires.

Quoted, not guessedSubscriptions are priced per seat on an annual term, with volume bands for units and agency-wide terms for larger deployments.
Built for accountable judgmentAutomation supports the investigator. It never silently assigns meaning, and it never makes a credential decision.