AcademyGet a quoteLevel 01 of 4 · Foundation level
Read the record correctly and know what it does not say. Recognize, define, distinguish, and explain common mobile sources and their limitations in clear, controlled examples.
WHO THIS LEVEL IS FOR
Level describes technical sophistication, not how much help is on offer. Guidance is set separately for each activity, so an investigator can be walked through an unfamiliar platform and still be assessed independently on one they already know.
THE FOUNDATION COURSES · 11 TOTAL
A Stream is the evidence subject you study — numbered below, and taught across the Levels it carries. Each course names its recommended preparation, the competencies it assesses, and the Manual volumes it draws on. A unit does not take all of them — it takes the Streams its casework demands, at the level its investigators work.
S00 · Entry · TF TF-01..TF-08
Establishes mobile source, attribution, synchronization, confidence, validation, and source-to-claim foundations. Every other stream starts here.
| Code | Course | Level | Recommended preparation | Competencies | Manual basis |
|---|---|---|---|---|---|
| ET-S00-F01 | Technical Mobile Evidence Foundations | Foundation | Entry eligibility | TF-01..TF-08 | V1, V11 |
S10 · Evidence and platform · TE TE-01..TE-08
Why networks generate the records investigators receive — and why a serving cell describes network association rather than a location.
| Code | Course | Level | Recommended preparation | Competencies | Manual basis |
|---|---|---|---|---|---|
| ET-S10-F01 | Cellular Networks for Mobile Evidence | Foundation | ET-S00-F01 | TE-01, TE-04, TE-06 | V2 |
S11 · Evidence and platform · CE CE-01..CE-08
Reading call, message, session, and mobility records for what they actually record — and separating subscriber from device from user.
| Code | Course | Level | Recommended preparation | Competencies | Manual basis |
|---|---|---|---|---|---|
| ET-S11-F01 | Carrier Records Foundations | Foundation | ET-S00-F01 | CE-01, CE-02, CE-08 | V3 |
S20 · Evidence and platform · AP AP-01..AP-08
Apple Account, iCloud, backup, Find My, and synchronization artifacts, held apart from the person holding the phone.
| Code | Course | Level | Recommended preparation | Competencies | Manual basis |
|---|---|---|---|---|---|
| ET-S20-F01 | Apple Mobile Evidence Foundations | Foundation | ET-S00-F01 | AP-01, AP-02, AP-08 | V4 |
S21 · Evidence and platform · GO GO-01..GO-08
The widest phone-linked evidence surface: accounts, Takeout, location services, Maps Timeline, Play Services, and Android itself.
| Code | Course | Level | Recommended preparation | Competencies | Manual basis |
|---|---|---|---|---|---|
| ET-S21-F01 | Google and Android Mobile Evidence Foundations | Foundation | ET-S00-F01 | GO-01, GO-02, GO-08 | V5 |
S22 · Evidence and platform · MS MS-01..MS-08
Mobile identity, authentication, and sync across Outlook, OneDrive, Teams, Edge, and Entra ID — separating mobile activity from desktop and automated activity.
| Code | Course | Level | Recommended preparation | Competencies | Manual basis |
|---|---|---|---|---|---|
| ET-S22-F01 | Microsoft Services on Mobile Foundations | Foundation | ET-S00-F01 | MS-01, MS-02, MS-08 | V6 |
S23 · Evidence and platform · TA TA-01..TA-08
Where most phone evidence now lives: messaging, social, location and transport, health, banking, and service applications, plus their cloud synchronization.
| Code | Course | Level | Recommended preparation | Competencies | Manual basis |
|---|---|---|---|---|---|
| ET-S23-F01 | Third-Party Mobile Application Foundations | Foundation | ET-S00-F01 | TA-01, TA-02, TA-08 | V7 |
S30 · Evidence and platform · MF MF-01..MF-08
Preservation, acquisition, file systems, logs, and artifacts — with tool output validated before it is interpreted.
| Code | Course | Level | Recommended preparation | Competencies | Manual basis |
|---|---|---|---|---|---|
| ET-S30-F01 | Mobile Device Forensics Foundations | Foundation | ET-S00-F01 | MF-01..MF-03, MF-08 | V8 |
S40 · Analytical · TR TR-01..TR-08
Normalizing timestamps, separating event time from record, sync, and access time, and testing competing sequences.
| Code | Course | Level | Recommended preparation | Competencies | Manual basis |
|---|---|---|---|---|---|
| ET-S40-F01 | Mobile Timestamp Foundations | Foundation | ET-S00-F01 | TR-01..TR-03, TR-08 | V9 |
S50 · Analytical · SA SA-01..SA-08
Cellular, GPS, Wi-Fi, and application location evidence expressed as bounded areas with stated uncertainty, never as a point of certainty.
| Code | Course | Level | Recommended preparation | Competencies | Manual basis |
|---|---|---|---|---|---|
| ET-S50-F01 | Mobile Location Evidence Foundations | Foundation | ET-S00-F01 | SA-01, SA-02, SA-08 | V10 |
S70 · Integration · IR IR-01..IR-08
Where the streams converge: correlating two or more completed evidence streams, reconciling conflicting records, and defending the reconstruction that survives.
| Code | Course | Level | Recommended preparation | Competencies | Manual basis |
|---|---|---|---|---|---|
| ET-S70-F01 | Integrated Mobile Source Correlation | Foundation | ET-S00-P01 and two Foundation evidence courses | IR-01, IR-03, IR-06 | Applicable retained volumes |
PRACTICE AT THIS LEVEL
Mock investigations are optional practice in applying competencies a learner has already completed. Each is built around phone evidence that disagrees with itself, and can be worked in guided, assisted, or independent mode.
CHOOSE A LEVEL
Courses at every level can be bought individually, and every All Access tier opens all 47 courses at all 4 levels — so a unit can move someone up a level without changing its licence.
Read the record correctly and know what it does not say.
You are here — 11 courses
Work common records and document a conclusion that traces back to evidence.
Resolve conflicting evidence and defend what survives.
Validate changing or uncommon technical behaviour within a defined specialty.
NEXT STEP
Send the streams your unit works and how many investigators sit at each level. We will propose a pathway, confirm what is released today, and put a written quote in front of procurement.