AcademyGet a quoteThe course catalogue
Start with the Foundation gateway. Then choose an evidence Stream and follow the Level progression that matches your current work and experience. The catalogue holds 47 courses across 11 Streams; each one can be bought à la carte or opened with an All Access subscription. Compare the recognition each route leads to
HOW THE CATALOGUE IS ORGANISED
Streams tell you what you are studying. Levels tell you how far you are taking it. Courses are the individual steps.
Every learner starts at ET-S00-F01 — Technical Mobile Evidence Foundations, whatever they go on to study.
A Stream is the evidence subject — carrier records, Apple, Android, apps, device forensics, timelines, or location.
A Level is increasing technical depth inside that Stream. It is a progression, not a separate catalogue.
A Course is one focused learning step inside a Stream at a Level, and can be taken on its own.
STEP 1 · START WITH CONFIDENCE
Begin with the essential habits for reading mobile evidence carefully: separate the person, phone, account, and record; understand where evidence comes from; and state only what the records support. Everything in the 11 Streams below assumes this course.
ET-S00-F01— Start here
The habits every other course assumes: mobile source and attribution, synchronization, confidence, validation, and tracing a claim back to the record it came from.
STEP 2 · CHOOSE YOUR STREAM
A Stream is the evidence subject you study. Open one to see its Level progression and the courses inside it — or search, or filter by Level, if you already know what you need. Groups below are a reading aid only; they are not Streams, and nobody is expected to take every Stream.
Showing 47 of 47 courses in 11 streams.
S00
Start here: the habits every other stream assumes — separating person, phone, account, and record.
3 courses
Establishes mobile source, attribution, synchronization, confidence, validation, and source-to-claim foundations. Every other stream starts here.
Required foundation courseAll Streams require this course. You only need to take it once.
ET-S00-F01— Start here
Builds the source, attribution, validation, and confidence habits every later course assumes. Learners separate the person, phone, account, and record, then trace each conclusion back to its evidence.
Recommended before this courseNothing. This is the gateway course every learner starts at.
ET-S00-P01
Applies Mobile Source Evaluation and Correlation to common records, procedures, and investigative decisions, with emphasis on tracing conclusions to their sources and documenting evidential limits.
Recommended before this courseTechnical Mobile Evidence Foundations ET-S00-F01
ET-S00-A01
Develops defensible correlation and validation through Advanced Mobile Attribution and Validation, including ambiguous or conflicting records and the reasoning needed to support a bounded conclusion.
Recommended before this courseMobile Source Evaluation and Correlation ET-S00-P01Also expected: one evidence stream.
S10
Network engineering behind the records: coverage, handover, and what a serving cell does and does not show.
5 courses
Why networks generate the records investigators receive — and why a serving cell describes network association rather than a location.
Required foundation courseAll Streams require this course. You only need to take it once.
ET-S00-F01— Start here
Builds the source, attribution, validation, and confidence habits every later course assumes. Learners separate the person, phone, account, and record, then trace each conclusion back to its evidence.
Recommended before this courseNothing. This is the gateway course every learner starts at.
ET-S10-F01
Introduces the core sources, terminology, and evidential limits for Telecommunications Engineering. Learners practise recognizing what common records can support, what they cannot, and how to state a bounded finding.
Recommended before this courseTechnical Mobile Evidence Foundations ET-S00-F01from the Technical Mobile Evidence Foundations stream
ET-S10-P01
Applies LTE and 5G Mobile Architecture to common records, procedures, and investigative decisions, with emphasis on tracing conclusions to their sources and documenting evidential limits.
Recommended before this courseCellular Networks for Mobile Evidence ET-S10-F01
ET-S10-P02
Applies IMS, Mobile Voice, SMS, and Wi-Fi Calling to common records, procedures, and investigative decisions, with emphasis on tracing conclusions to their sources and documenting evidential limits.
Recommended before this courseCellular Networks for Mobile Evidence ET-S10-F01
ET-S10-A01
Develops defensible correlation and validation through Mobile Registration, Paging, and Mobility, including ambiguous or conflicting records and the reasoning needed to support a bounded conclusion.
Recommended before this courseLTE and 5G Mobile Architecture ET-S10-P01
ET-S10-S01
Builds specialist validation and technical judgment in Advanced RF and Network Behaviour, including uncommon or changing behaviour, method limitations, and defensible expert communication.
Recommended before this courseMobile Registration, Paging, and Mobility ET-S10-A01 and Cellular, GPS, Wi-Fi, and App Location ET-S50-P01from the Mobile Spatial Analysis stream
S11
Carrier records: call, message, session, and mobility data as the provider recorded it.
4 courses
Reading call, message, session, and mobility records for what they actually record — and separating subscriber from device from user.
Required foundation courseAll Streams require this course. You only need to take it once.
ET-S00-F01— Start here
Builds the source, attribution, validation, and confidence habits every later course assumes. Learners separate the person, phone, account, and record, then trace each conclusion back to its evidence.
Recommended before this courseNothing. This is the gateway course every learner starts at.
ET-S11-F01
Introduces the core sources, terminology, and evidential limits for Carrier Evidence. Learners practise recognizing what common records can support, what they cannot, and how to state a bounded finding.
Recommended before this courseTechnical Mobile Evidence Foundations ET-S00-F01from the Technical Mobile Evidence Foundations stream
ET-S11-P01
Applies Calls, SMS, and Mobility Records to common records, procedures, and investigative decisions, with emphasis on tracing conclusions to their sources and documenting evidential limits.
Recommended before this courseCarrier Records Foundations ET-S11-F01 and Cellular Networks for Mobile Evidence ET-S10-F01from the Telecommunications Engineering stream
ET-S11-P02
Applies Mobile Data Sessions and IP Allocation to common records, procedures, and investigative decisions, with emphasis on tracing conclusions to their sources and documenting evidential limits.
Recommended before this courseCarrier Records Foundations ET-S11-F01
ET-S11-A01
Develops defensible correlation and validation through Advanced Multi-Record Carrier Correlation, including ambiguous or conflicting records and the reasoning needed to support a bounded conclusion.
Recommended before this courseCalls, SMS, and Mobility Records ET-S11-P01 and Mobile Data Sessions and IP Allocation ET-S11-P02
S20
Apple evidence: Apple Account, iCloud, backups, Find My, and synchronization artifacts.
4 courses
Apple Account, iCloud, backup, Find My, and synchronization artifacts, held apart from the person holding the phone.
Required foundation courseAll Streams require this course. You only need to take it once.
ET-S00-F01— Start here
Builds the source, attribution, validation, and confidence habits every later course assumes. Learners separate the person, phone, account, and record, then trace each conclusion back to its evidence.
Recommended before this courseNothing. This is the gateway course every learner starts at.
ET-S20-F01
Introduces the core sources, terminology, and evidential limits for Apple Mobile Evidence. Learners practise recognizing what common records can support, what they cannot, and how to state a bounded finding.
Recommended before this courseTechnical Mobile Evidence Foundations ET-S00-F01from the Technical Mobile Evidence Foundations stream
ET-S20-P01
Applies iCloud, Backup, Find My, and Synchronization to common records, procedures, and investigative decisions, with emphasis on tracing conclusions to their sources and documenting evidential limits.
Recommended before this courseApple Mobile Evidence Foundations ET-S20-F01
ET-S20-A01
Develops defensible correlation and validation through Advanced Apple Mobile Artifact Analysis, including ambiguous or conflicting records and the reasoning needed to support a bounded conclusion.
Recommended before this courseiCloud, Backup, Find My, and Synchronization ET-S20-P01 and Mobile File Systems, Logs, and Artifacts ET-S30-P02from the Mobile Device Forensics stream
ET-S20-S01
Builds specialist validation and technical judgment in Apple Mobile Validation Specialist, including uncommon or changing behaviour, method limitations, and defensible expert communication.
Recommended before this courseAdvanced Apple Mobile Artifact Analysis ET-S20-A01
S21
Google and Android evidence: accounts, Takeout, location services, Maps Timeline, and Android itself.
5 courses
The widest phone-linked evidence surface: accounts, Takeout, location services, Maps Timeline, Play Services, and Android itself.
Required foundation courseAll Streams require this course. You only need to take it once.
ET-S00-F01— Start here
Builds the source, attribution, validation, and confidence habits every later course assumes. Learners separate the person, phone, account, and record, then trace each conclusion back to its evidence.
Recommended before this courseNothing. This is the gateway course every learner starts at.
ET-S21-F01
Introduces the core sources, terminology, and evidential limits for Google and Android Mobile Evidence. Learners practise recognizing what common records can support, what they cannot, and how to state a bounded finding.
Recommended before this courseTechnical Mobile Evidence Foundations ET-S00-F01from the Technical Mobile Evidence Foundations stream
ET-S21-P01
Applies Android and Google Play Services Evidence to common records, procedures, and investigative decisions, with emphasis on tracing conclusions to their sources and documenting evidential limits.
Recommended before this courseGoogle and Android Mobile Evidence Foundations ET-S21-F01
ET-S21-P02
Applies Google Location, Maps, Timeline, and Takeout to common records, procedures, and investigative decisions, with emphasis on tracing conclusions to their sources and documenting evidential limits.
Recommended before this courseGoogle and Android Mobile Evidence Foundations ET-S21-F01 and Mobile Location Evidence Foundations ET-S50-F01from the Mobile Spatial Analysis stream
ET-S21-A01
Develops defensible correlation and validation through Advanced Google Mobile Cloud Correlation, including ambiguous or conflicting records and the reasoning needed to support a bounded conclusion.
Recommended before this courseAndroid and Google Play Services Evidence ET-S21-P01 and Google Location, Maps, Timeline, and Takeout ET-S21-P02
ET-S21-S01
Builds specialist validation and technical judgment in Google and Android Mobile Validation Specialist, including uncommon or changing behaviour, method limitations, and defensible expert communication.
Recommended before this courseAdvanced Google Mobile Cloud Correlation ET-S21-A01
S22
Microsoft services on a phone: Outlook, OneDrive, Teams, Edge, and Entra ID sign-in activity.
4 courses
Mobile identity, authentication, and sync across Outlook, OneDrive, Teams, Edge, and Entra ID — separating mobile activity from desktop and automated activity.
Required foundation courseAll Streams require this course. You only need to take it once.
ET-S00-F01— Start here
Builds the source, attribution, validation, and confidence habits every later course assumes. Learners separate the person, phone, account, and record, then trace each conclusion back to its evidence.
Recommended before this courseNothing. This is the gateway course every learner starts at.
ET-S22-F01
Introduces the core sources, terminology, and evidential limits for Microsoft Services on Mobile Phones. Learners practise recognizing what common records can support, what they cannot, and how to state a bounded finding.
Recommended before this courseTechnical Mobile Evidence Foundations ET-S00-F01from the Technical Mobile Evidence Foundations stream
ET-S22-P01
Applies Outlook, OneDrive, Teams, and Edge Mobile Evidence to common records, procedures, and investigative decisions, with emphasis on tracing conclusions to their sources and documenting evidential limits.
Recommended before this courseMicrosoft Services on Mobile Foundations ET-S22-F01
ET-S22-A01
Develops defensible correlation and validation through Microsoft Mobile Authentication and Cloud Correlation, including ambiguous or conflicting records and the reasoning needed to support a bounded conclusion.
Recommended before this courseOutlook, OneDrive, Teams, and Edge Mobile Evidence ET-S22-P01
ET-S22-S01
Builds specialist validation and technical judgment in Microsoft Mobile Evidence Validation Specialist, including uncommon or changing behaviour, method limitations, and defensible expert communication.
Recommended before this courseMicrosoft Mobile Authentication and Cloud Correlation ET-S22-A01
S23
App evidence: messaging, social, transport, health, and banking apps, plus their cloud copies.
5 courses
Where most phone evidence now lives: messaging, social, location and transport, health, banking, and service applications, plus their cloud synchronization.
Required foundation courseAll Streams require this course. You only need to take it once.
ET-S00-F01— Start here
Builds the source, attribution, validation, and confidence habits every later course assumes. Learners separate the person, phone, account, and record, then trace each conclusion back to its evidence.
Recommended before this courseNothing. This is the gateway course every learner starts at.
ET-S23-F01
Introduces the core sources, terminology, and evidential limits for Third-Party Mobile Applications. Learners practise recognizing what common records can support, what they cannot, and how to state a bounded finding.
Recommended before this courseTechnical Mobile Evidence Foundations ET-S00-F01from the Technical Mobile Evidence Foundations stream
ET-S23-P01
Applies Mobile Messaging and Social Application Evidence to common records, procedures, and investigative decisions, with emphasis on tracing conclusions to their sources and documenting evidential limits.
Recommended before this courseThird-Party Mobile Application Foundations ET-S23-F01
ET-S23-P02
Applies Mobile Location, Transport, Health, and Service Apps to common records, procedures, and investigative decisions, with emphasis on tracing conclusions to their sources and documenting evidential limits.
Recommended before this courseThird-Party Mobile Application Foundations ET-S23-F01
ET-S23-A01
Develops defensible correlation and validation through Advanced Mobile App and Cloud Synchronization, including ambiguous or conflicting records and the reasoning needed to support a bounded conclusion.
Recommended before this courseMobile Messaging and Social Application Evidence ET-S23-P01 or Mobile Location, Transport, Health, and Service Apps ET-S23-P02
ET-S23-S01
Builds specialist validation and technical judgment in Mobile Application Validation Specialist, including uncommon or changing behaviour, method limitations, and defensible expert communication.
Recommended before this courseAdvanced Mobile App and Cloud Synchronization ET-S23-A01
S30
Device forensics: preservation, acquisition, file systems, logs, and validating tool output.
5 courses
Preservation, acquisition, file systems, logs, and artifacts — with tool output validated before it is interpreted.
Required foundation courseAll Streams require this course. You only need to take it once.
ET-S00-F01— Start here
Builds the source, attribution, validation, and confidence habits every later course assumes. Learners separate the person, phone, account, and record, then trace each conclusion back to its evidence.
Recommended before this courseNothing. This is the gateway course every learner starts at.
ET-S30-F01
Introduces the core sources, terminology, and evidential limits for Mobile Device Forensics. Learners practise recognizing what common records can support, what they cannot, and how to state a bounded finding.
Recommended before this courseTechnical Mobile Evidence Foundations ET-S00-F01from the Technical Mobile Evidence Foundations stream
ET-S30-P01
Applies Mobile Preservation and Acquisition to common records, procedures, and investigative decisions, with emphasis on tracing conclusions to their sources and documenting evidential limits.
Recommended before this courseMobile Device Forensics Foundations ET-S30-F01
ET-S30-P02
Applies Mobile File Systems, Logs, and Artifacts to common records, procedures, and investigative decisions, with emphasis on tracing conclusions to their sources and documenting evidential limits.
Recommended before this courseMobile Device Forensics Foundations ET-S30-F01
ET-S30-A01
Develops defensible correlation and validation through Advanced Mobile Application and Location Forensics, including ambiguous or conflicting records and the reasoning needed to support a bounded conclusion.
Recommended before this courseMobile Preservation and Acquisition ET-S30-P01 and Mobile File Systems, Logs, and Artifacts ET-S30-P02
ET-S30-S01
Builds specialist validation and technical judgment in Advanced Mobile Forensic Validation, including uncommon or changing behaviour, method limitations, and defensible expert communication.
Recommended before this courseAdvanced Mobile Application and Location Forensics ET-S30-A01Also expected: one platform course.
S40
Timelines: normalizing timestamps, separating event time from record time, and testing sequences.
4 courses
Normalizing timestamps, separating event time from record, sync, and access time, and testing competing sequences.
Required foundation courseAll Streams require this course. You only need to take it once.
ET-S00-F01— Start here
Builds the source, attribution, validation, and confidence habits every later course assumes. Learners separate the person, phone, account, and record, then trace each conclusion back to its evidence.
Recommended before this courseNothing. This is the gateway course every learner starts at.
ET-S40-F01
Introduces the core sources, terminology, and evidential limits for Mobile Timeline Reconstruction. Learners practise recognizing what common records can support, what they cannot, and how to state a bounded finding.
Recommended before this courseTechnical Mobile Evidence Foundations ET-S00-F01from the Technical Mobile Evidence Foundations stream
ET-S40-P01
Applies Mobile Timestamp Normalization and Correlation to common records, procedures, and investigative decisions, with emphasis on tracing conclusions to their sources and documenting evidential limits.
Recommended before this courseMobile Timestamp Foundations ET-S40-F01Also expected: one evidence stream.
ET-S40-A01
Develops defensible correlation and validation through Advanced Mobile Timeline Reconstruction, including ambiguous or conflicting records and the reasoning needed to support a bounded conclusion.
Recommended before this courseMobile Timestamp Normalization and Correlation ET-S40-P01Also expected: two evidence streams.
ET-S40-S01
Builds specialist validation and technical judgment in Complex Mobile Timeline Specialist, including uncommon or changing behaviour, method limitations, and defensible expert communication.
Recommended before this courseAdvanced Mobile Timeline Reconstruction ET-S40-A01 and Mobile File Systems, Logs, and Artifacts ET-S30-P02from the Mobile Device Forensics stream
S50
Location evidence: cellular, GPS, Wi-Fi, and app location expressed as bounded areas.
4 courses
Cellular, GPS, Wi-Fi, and application location evidence expressed as bounded areas with stated uncertainty, never as a point of certainty.
Required foundation courseAll Streams require this course. You only need to take it once.
ET-S00-F01— Start here
Builds the source, attribution, validation, and confidence habits every later course assumes. Learners separate the person, phone, account, and record, then trace each conclusion back to its evidence.
Recommended before this courseNothing. This is the gateway course every learner starts at.
ET-S50-F01
Introduces the core sources, terminology, and evidential limits for Mobile Spatial Analysis. Learners practise recognizing what common records can support, what they cannot, and how to state a bounded finding.
Recommended before this courseTechnical Mobile Evidence Foundations ET-S00-F01from the Technical Mobile Evidence Foundations stream
ET-S50-P01
Applies Cellular, GPS, Wi-Fi, and App Location to common records, procedures, and investigative decisions, with emphasis on tracing conclusions to their sources and documenting evidential limits.
Recommended before this courseMobile Location Evidence Foundations ET-S50-F01 and Cellular Networks for Mobile Evidence ET-S10-F01from the Telecommunications Engineering stream
ET-S50-A01
Develops defensible correlation and validation through Mobile Movement Reconstruction and GIS, including ambiguous or conflicting records and the reasoning needed to support a bounded conclusion.
Recommended before this courseCellular, GPS, Wi-Fi, and App Location ET-S50-P01 and Mobile Timestamp Normalization and Correlation ET-S40-P01from the Mobile Timeline Reconstruction stream
ET-S50-S01
Builds specialist validation and technical judgment in Advanced Mobile Spatial Validation, including uncommon or changing behaviour, method limitations, and defensible expert communication.
Recommended before this courseMobile Movement Reconstruction and GIS ET-S50-A01
S70
Putting it together: correlating completed streams into one reconstruction that can be defended.
4 courses
Where the streams converge: correlating two or more completed evidence streams, reconciling conflicting records, and defending the reconstruction that survives.
Required foundation courseAll Streams require this course. You only need to take it once.
ET-S00-F01— Start here
Builds the source, attribution, validation, and confidence habits every later course assumes. Learners separate the person, phone, account, and record, then trace each conclusion back to its evidence.
Recommended before this courseNothing. This is the gateway course every learner starts at.
ET-S70-F01
Introduces the core sources, terminology, and evidential limits for Integrated Mobile Reconstruction. Learners practise recognizing what common records can support, what they cannot, and how to state a bounded finding.
Recommended before this courseMobile Source Evaluation and Correlation ET-S00-P01from the Technical Mobile Evidence Foundations streamAlso expected: two Foundation evidence courses.
ET-S70-P01
Applies Multi-Source Mobile Reconstruction to common records, procedures, and investigative decisions, with emphasis on tracing conclusions to their sources and documenting evidential limits.
Recommended before this courseIntegrated Mobile Source Correlation ET-S70-F01 and Mobile Timestamp Normalization and Correlation ET-S40-P01from the Mobile Timeline Reconstruction stream
ET-S70-A01
Develops defensible correlation and validation through Advanced Conflicting Mobile Evidence Reconstruction, including ambiguous or conflicting records and the reasoning needed to support a bounded conclusion.
Recommended before this courseMulti-Source Mobile Reconstruction ET-S70-P01Also expected: one Advanced evidence course.
ET-S70-S01
Builds specialist validation and technical judgment in Integrated Mobile Reconstruction Specialist, including uncommon or changing behaviour, method limitations, and defensible expert communication.
Recommended before this courseAdvanced Conflicting Mobile Evidence Reconstruction ET-S70-A01Also expected: approved specialist readiness.
STEP 3 · PROGRESS THROUGH THE LEVELS
Levels are cumulative within a Stream: a higher-level course builds on the earlier learning in that subject area. Level and guidance are controlled separately, so an investigator can be walked through an unfamiliar platform and still be assessed independently on one they know.
Read the record correctly and know what it does not say.
What it means: Recognize, define, distinguish, and explain common mobile sources and their limitations in clear, controlled examples.
Who enrols here: Investigators, first responders, and supervisors who receive mobile evidence and must not misread an extraction report, a call record, or a location pin.
Communication: States a correct bounded finding.
Work common records and document a conclusion that traces back to evidence.
What it means: Interpret common real-world records, perform standard technical procedures, correlate a limited number of sources, and document supported conclusions.
Who enrols here: Serving investigators and examiners who handle mobile evidence in live casework and produce the analysis others rely on.
Communication: Traces a finding to its source and its limitation.
Resolve conflicting evidence and defend what survives.
What it means: Resolve ambiguous or conflicting mobile evidence, validate artifacts and tool output, integrate multiple sources, and defend bounded technical conclusions.
Who enrols here: Experienced examiners and analysts who reconcile conflicting sources, review the work of others, and stand behind a reconstruction under challenge.
Communication: Explains competing interpretations and why one is better supported.
Validate changing or uncommon technical behaviour within a defined specialty.
What it means: Handle uncommon, changing, or platform-specific behaviour; design validation; evaluate method limitations; and provide authoritative technical analysis within a defined specialty.
Who enrols here: Unit technical leads and subject-matter experts who validate methods, brief courts and commanders, and carry a named specialty for their agency.
Communication: Defends method boundaries and technical change.
Not every Stream carries a Specialist course. A Level Credential recognizes breadth across prescribed competencies at a stated Level; a Stream Credential recognizes specialization within one named Stream at a stated Level. Compare recognition routes
NEXT STEP
Tell us what your unit works — county-level carrier requests, Android-heavy casework, app-based offending, or contested cell site and GPS evidence — and we will propose a pathway and quote the seats to cover it. All 47 courses trace to the EchoTrace Manual.