AcademyGet a quoteLevel 02 of 4 · Practitioner level
Work common records and document a conclusion that traces back to evidence. Interpret common real-world records, perform standard technical procedures, correlate a limited number of sources, and document supported conclusions.
WHO THIS LEVEL IS FOR
Level describes technical sophistication, not how much help is on offer. Guidance is set separately for each activity, so an investigator can be walked through an unfamiliar platform and still be assessed independently on one they already know.
THE PRACTITIONER COURSES · 16 TOTAL
A Stream is the evidence subject you study — numbered below, and taught across the Levels it carries. Each course names its recommended preparation, the competencies it assesses, and the Manual volumes it draws on. A unit does not take all of them — it takes the Streams its casework demands, at the level its investigators work.
S00 · Entry · TF TF-01..TF-08
Establishes mobile source, attribution, synchronization, confidence, validation, and source-to-claim foundations. Every other stream starts here.
| Code | Course | Level | Recommended preparation | Competencies | Manual basis |
|---|---|---|---|---|---|
| ET-S00-P01 | Mobile Source Evaluation and Correlation | Practitioner | ET-S00-F01 | TF-02..TF-08 | V1, V8, V9, V11 |
S10 · Evidence and platform · TE TE-01..TE-08
Why networks generate the records investigators receive — and why a serving cell describes network association rather than a location.
| Code | Course | Level | Recommended preparation | Competencies | Manual basis |
|---|---|---|---|---|---|
| ET-S10-P01 | LTE and 5G Mobile Architecture | Practitioner | ET-S10-F01 | TE-01, TE-02, TE-05 | V2 |
| ET-S10-P02 | IMS, Mobile Voice, SMS, and Wi-Fi Calling | Practitioner | ET-S10-F01 | TE-03, TE-05, TE-07 | V2 |
S11 · Evidence and platform · CE CE-01..CE-08
Reading call, message, session, and mobility records for what they actually record — and separating subscriber from device from user.
| Code | Course | Level | Recommended preparation | Competencies | Manual basis |
|---|---|---|---|---|---|
| ET-S11-P01 | Calls, SMS, and Mobility Records | Practitioner | ET-S11-F01 and ET-S10-F01 | CE-01, CE-02, CE-04..CE-06 | V2, V3 |
| ET-S11-P02 | Mobile Data Sessions and IP Allocation | Practitioner | ET-S11-F01 | CE-03, CE-05..CE-07 | V3 |
S20 · Evidence and platform · AP AP-01..AP-08
Apple Account, iCloud, backup, Find My, and synchronization artifacts, held apart from the person holding the phone.
| Code | Course | Level | Recommended preparation | Competencies | Manual basis |
|---|---|---|---|---|---|
| ET-S20-P01 | iCloud, Backup, Find My, and Synchronization | Practitioner | ET-S20-F01 | AP-01..AP-05 | V4 |
S21 · Evidence and platform · GO GO-01..GO-08
The widest phone-linked evidence surface: accounts, Takeout, location services, Maps Timeline, Play Services, and Android itself.
| Code | Course | Level | Recommended preparation | Competencies | Manual basis |
|---|---|---|---|---|---|
| ET-S21-P01 | Android and Google Play Services Evidence | Practitioner | ET-S21-F01 | GO-01, GO-02, GO-06..GO-08 | V5 |
| ET-S21-P02 | Google Location, Maps, Timeline, and Takeout | Practitioner | ET-S21-F01 and ET-S50-F01 | GO-03..GO-05, GO-08 | V5, V10 |
S22 · Evidence and platform · MS MS-01..MS-08
Mobile identity, authentication, and sync across Outlook, OneDrive, Teams, Edge, and Entra ID — separating mobile activity from desktop and automated activity.
| Code | Course | Level | Recommended preparation | Competencies | Manual basis |
|---|---|---|---|---|---|
| ET-S22-P01 | Outlook, OneDrive, Teams, and Edge Mobile Evidence | Practitioner | ET-S22-F01 | MS-02..MS-06 | V6 |
S23 · Evidence and platform · TA TA-01..TA-08
Where most phone evidence now lives: messaging, social, location and transport, health, banking, and service applications, plus their cloud synchronization.
| Code | Course | Level | Recommended preparation | Competencies | Manual basis |
|---|---|---|---|---|---|
| ET-S23-P01 | Mobile Messaging and Social Application Evidence | Practitioner | ET-S23-F01 | TA-01..TA-03, TA-06, TA-08 | V7 |
| ET-S23-P02 | Mobile Location, Transport, Health, and Service Apps | Practitioner | ET-S23-F01 | TA-04..TA-06, TA-08 | V7, V10 |
S30 · Evidence and platform · MF MF-01..MF-08
Preservation, acquisition, file systems, logs, and artifacts — with tool output validated before it is interpreted.
| Code | Course | Level | Recommended preparation | Competencies | Manual basis |
|---|---|---|---|---|---|
| ET-S30-P01 | Mobile Preservation and Acquisition | Practitioner | ET-S30-F01 | MF-01..MF-04, MF-08 | V8 |
| ET-S30-P02 | Mobile File Systems, Logs, and Artifacts | Practitioner | ET-S30-F01 | MF-04..MF-08 | V8 |
S40 · Analytical · TR TR-01..TR-08
Normalizing timestamps, separating event time from record, sync, and access time, and testing competing sequences.
| Code | Course | Level | Recommended preparation | Competencies | Manual basis |
|---|---|---|---|---|---|
| ET-S40-P01 | Mobile Timestamp Normalization and Correlation | Practitioner | ET-S40-F01 plus one evidence stream | TR-01..TR-06 | V9 |
S50 · Analytical · SA SA-01..SA-08
Cellular, GPS, Wi-Fi, and application location evidence expressed as bounded areas with stated uncertainty, never as a point of certainty.
| Code | Course | Level | Recommended preparation | Competencies | Manual basis |
|---|---|---|---|---|---|
| ET-S50-P01 | Cellular, GPS, Wi-Fi, and App Location | Practitioner | ET-S50-F01 and ET-S10-F01 | SA-01..SA-05 | V2, V3, V10 |
S70 · Integration · IR IR-01..IR-08
Where the streams converge: correlating two or more completed evidence streams, reconciling conflicting records, and defending the reconstruction that survives.
| Code | Course | Level | Recommended preparation | Competencies | Manual basis |
|---|---|---|---|---|---|
| ET-S70-P01 | Multi-Source Mobile Reconstruction | Practitioner | ET-S70-F01 and ET-S40-P01 | IR-01..IR-06, IR-08 | Applicable retained volumes |
PRACTICE AT THIS LEVEL
Mock investigations are optional practice in applying competencies a learner has already completed. Each is built around phone evidence that disagrees with itself, and can be worked in guided, assisted, or independent mode.
CHOOSE A LEVEL
Courses at every level can be bought individually, and every All Access tier opens all 47 courses at all 4 levels — so a unit can move someone up a level without changing its licence.
Read the record correctly and know what it does not say.
Work common records and document a conclusion that traces back to evidence.
You are here — 16 courses
Resolve conflicting evidence and defend what survives.
Validate changing or uncommon technical behaviour within a defined specialty.
NEXT STEP
Send the streams your unit works and how many investigators sit at each level. We will propose a pathway, confirm what is released today, and put a written quote in front of procurement.