Level 03 of 4 · Advanced level

11 Advanced courses in every stream.

Resolve conflicting evidence and defend what survives. Resolve ambiguous or conflicting mobile evidence, validate artifacts and tool output, integrate multiple sources, and defend bounded technical conclusions.

Get a price for this level Advanced Level Credential

Courses at this level: 11
Streams covered: 11of the 11 streams
Practice cases: 6mock investigations at this level
Per course: ≈8learner hours, in short pockets

WHO THIS LEVEL IS FOR

Who enrols at Advanced level.

Level describes technical sophistication, not how much help is on offer. Guidance is set separately for each activity, so an investigator can be walked through an unfamiliar platform and still be assessed independently on one they already know.

Who enrols here: Experienced examiners and analysts who reconcile conflicting sources, review the work of others, and stand behind a reconstruction under challenge.
Entry requirement: Recommends the Practitioner courses in the stream, and normally a second completed evidence stream.
How a finding is stated: Explains competing interpretations and why one is better supported.
Credential route: Level Credential — Advanced

Guidance modes available at every level

Guided: The reasoning is modelled step by step so the learner sees how a bounded conclusion is built.
Assisted: The learner works the analysis with a four-level hint ladder available when they stall.
Independent: The learner completes the reconstruction unaided and their reasoning is assessed on its own terms.

Where this level sits

Before this level: Practitioner courses — work common records and document a conclusion that traces back to evidence.
After this level: Specialist courses — validate changing or uncommon technical behaviour within a defined specialty.

THE ADVANCED COURSES · 11 TOTAL

Every Advanced course, stream by stream.

A Stream is the evidence subject you study — numbered below, and taught across the Levels it carries. Each course names its recommended preparation, the competencies it assesses, and the Manual volumes it draws on. A unit does not take all of them — it takes the Streams its casework demands, at the level its investigators work.

S00 · Entry · TF TF-01..TF-08

Stream 1: Technical Mobile Evidence Foundations

Establishes mobile source, attribution, synchronization, confidence, validation, and source-to-claim foundations. Every other stream starts here.

All 3 courses in this stream, at every level

Stream 1: Technical Mobile Evidence Foundations (S00) — Advanced courses
Code	Course	Level	Recommended preparation	Competencies	Manual basis
ET-S00-A01	Advanced Mobile Attribution and Validation	Advanced	ET-S00-P01 plus one evidence stream	TF-04..TF-08, IR-03..IR-05	V1, V8, V9, V11

S10 · Evidence and platform · TE TE-01..TE-08

Stream 2: Telecommunications Engineering

Why networks generate the records investigators receive — and why a serving cell describes network association rather than a location.

All 5 courses in this stream, at every level

Stream 2: Telecommunications Engineering (S10) — Advanced courses
Code	Course	Level	Recommended preparation	Competencies	Manual basis
ET-S10-A01	Mobile Registration, Paging, and Mobility	Advanced	ET-S10-P01	TE-02, TE-05..TE-08	V2

S11 · Evidence and platform · CE CE-01..CE-08

Stream 3: Carrier Evidence

Reading call, message, session, and mobility records for what they actually record — and separating subscriber from device from user.

All 4 courses in this stream, at every level

Stream 3: Carrier Evidence (S11) — Advanced courses
Code	Course	Level	Recommended preparation	Competencies	Manual basis
ET-S11-A01	Advanced Multi-Record Carrier Correlation	Advanced	ET-S11-P01 and ET-S11-P02	CE-01..CE-08	V2, V3, V9, V11

S20 · Evidence and platform · AP AP-01..AP-08

Stream 4: Apple Mobile Evidence

Apple Account, iCloud, backup, Find My, and synchronization artifacts, held apart from the person holding the phone.

All 4 courses in this stream, at every level

Stream 4: Apple Mobile Evidence (S20) — Advanced courses
Code	Course	Level	Recommended preparation	Competencies	Manual basis
ET-S20-A01	Advanced Apple Mobile Artifact Analysis	Advanced	ET-S20-P01 and ET-S30-P02	AP-03..AP-08	V4, V8, V9

S21 · Evidence and platform · GO GO-01..GO-08

Stream 5: Google and Android Mobile Evidence

The widest phone-linked evidence surface: accounts, Takeout, location services, Maps Timeline, Play Services, and Android itself.

All 5 courses in this stream, at every level

Stream 5: Google and Android Mobile Evidence (S21) — Advanced courses
Code	Course	Level	Recommended preparation	Competencies	Manual basis
ET-S21-A01	Advanced Google Mobile Cloud Correlation	Advanced	ET-S21-P01 and ET-S21-P02	GO-01..GO-08	V5, V8, V9

S22 · Evidence and platform · MS MS-01..MS-08

Stream 6: Microsoft Services on Mobile Phones

Mobile identity, authentication, and sync across Outlook, OneDrive, Teams, Edge, and Entra ID — separating mobile activity from desktop and automated activity.

All 4 courses in this stream, at every level

Stream 6: Microsoft Services on Mobile Phones (S22) — Advanced courses
Code	Course	Level	Recommended preparation	Competencies	Manual basis
ET-S22-A01	Microsoft Mobile Authentication and Cloud Correlation	Advanced	ET-S22-P01	MS-03..MS-08	V6, V9

S23 · Evidence and platform · TA TA-01..TA-08

Stream 7: Third-Party Mobile Applications

Where most phone evidence now lives: messaging, social, location and transport, health, banking, and service applications, plus their cloud synchronization.

All 5 courses in this stream, at every level

Stream 7: Third-Party Mobile Applications (S23) — Advanced courses
Code	Course	Level	Recommended preparation	Competencies	Manual basis
ET-S23-A01	Advanced Mobile App and Cloud Synchronization	Advanced	ET-S23-P01 or ET-S23-P02	TA-01..TA-08	V7, V8, V9

S30 · Evidence and platform · MF MF-01..MF-08

Stream 8: Mobile Device Forensics

Preservation, acquisition, file systems, logs, and artifacts — with tool output validated before it is interpreted.

All 5 courses in this stream, at every level

Stream 8: Mobile Device Forensics (S30) — Advanced courses
Code	Course	Level	Recommended preparation	Competencies	Manual basis
ET-S30-A01	Advanced Mobile Application and Location Forensics	Advanced	ET-S30-P01 and ET-S30-P02	MF-03..MF-08	V8, V10

S40 · Analytical · TR TR-01..TR-08

Stream 9: Mobile Timeline Reconstruction

Normalizing timestamps, separating event time from record, sync, and access time, and testing competing sequences.

All 4 courses in this stream, at every level

Stream 9: Mobile Timeline Reconstruction (S40) — Advanced courses
Code	Course	Level	Recommended preparation	Competencies	Manual basis
ET-S40-A01	Advanced Mobile Timeline Reconstruction	Advanced	ET-S40-P01 and two evidence streams	TR-01..TR-08	V9, V11

S50 · Analytical · SA SA-01..SA-08

Stream 10: Mobile Spatial Analysis

Cellular, GPS, Wi-Fi, and application location evidence expressed as bounded areas with stated uncertainty, never as a point of certainty.

All 4 courses in this stream, at every level

Stream 10: Mobile Spatial Analysis (S50) — Advanced courses
Code	Course	Level	Recommended preparation	Competencies	Manual basis
ET-S50-A01	Mobile Movement Reconstruction and GIS	Advanced	ET-S50-P01 and ET-S40-P01	SA-01..SA-08	V9, V10

S70 · Integration · IR IR-01..IR-08

Stream 11: Integrated Mobile Reconstruction

Where the streams converge: correlating two or more completed evidence streams, reconciling conflicting records, and defending the reconstruction that survives.

All 4 courses in this stream, at every level

Stream 11: Integrated Mobile Reconstruction (S70) — Advanced courses
Code	Course	Level	Recommended preparation	Competencies	Manual basis
ET-S70-A01	Advanced Conflicting Mobile Evidence Reconstruction	Advanced	ET-S70-P01 and one Advanced evidence course	IR-01..IR-08	Applicable retained volumes

PRACTICE AT THIS LEVEL

6 mock investigations pitched at Advanced reasoning.

Mock investigations are optional practice in applying competencies a learner has already completed. Each is built around phone evidence that disagrees with itself, and can be worked in guided, assisted, or independent mode.

ET-MC-201Conflicting Mobile LocationsMulti-source spatial analysis
ET-MC-202Multi-Phone TimelineCarrier, handset, app, and cloud sequence
ET-MC-203Incomplete AcquisitionForensic and tool limitations
ET-MC-204Version ChangeThird-party app behaviour and validation
ET-MC-205Shared Cloud, Different PhonesAttribution and synchronization
ET-MC-206Network and Handset ConflictComplex technical reconciliation

How practice, simulation, and readiness assessment work

CHOOSE A LEVEL

Place each investigator at the level their casework needs.

Courses at every level can be bought individually, and every All Access tier opens all 47 courses at all 4 levels — so a unit can move someone up a level without changing its licence.

Level 01 · Foundation
Read the record correctly and know what it does not say.
11 Foundation courses
Level 02 · Practitioner
Work common records and document a conclusion that traces back to evidence.
16 Practitioner courses
Level 03 · Advanced
Resolve conflicting evidence and defend what survives.
You are here — 11 courses
Level 04 · Specialist
Validate changing or uncommon technical behaviour within a defined specialty.
9 Specialist courses

All 47 courses in every tier
Level and guidance controlled separately
Prior courses are recommendations, not enrolment conditions

NEXT STEP

Tell us who needs Advanced level, and we will quote the seats.

Send the streams your unit works and how many investigators sit at each level. We will propose a pathway, confirm what is released today, and put a written quote in front of procurement.

Request a subscription quote Back to the full catalogue