Level 04 of 4 · Specialist level

9 Specialist courses in 9 of the 11 streams.

Validate changing or uncommon technical behaviour within a defined specialty. Handle uncommon, changing, or platform-specific behaviour; design validation; evaluate method limitations; and provide authoritative technical analysis within a defined specialty.

Get a price for this level Specialist Level Credential

Courses at this level: 9
Streams covered: 9of the 11 streams
Practice cases: 2mock investigations at this level
Per course: ≈8learner hours, in short pockets

WHO THIS LEVEL IS FOR

Who enrols at Specialist level.

Level describes technical sophistication, not how much help is on offer. Guidance is set separately for each activity, so an investigator can be walked through an unfamiliar platform and still be assessed independently on one they already know.

Who enrols here: Unit technical leads and subject-matter experts who validate methods, brief courts and commanders, and carry a named specialty for their agency.
Entry requirement: Recommends the Advanced course in the stream plus approved specialist readiness. Not every stream carries a Specialist level.
How a finding is stated: Defends method boundaries and technical change.
Credential route: Level Credential — Specialist

Guidance modes available at every level

Guided: The reasoning is modelled step by step so the learner sees how a bounded conclusion is built.
Assisted: The learner works the analysis with a four-level hint ladder available when they stall.
Independent: The learner completes the reconstruction unaided and their reasoning is assessed on its own terms.

Where this level sits

Before this level: Advanced courses — resolve conflicting evidence and defend what survives.
After this level: Specialist is the deepest level in the catalogue. Beyond it sits maintained practice: validation work, method review, and keeping pace with platform change.

THE SPECIALIST COURSES · 9 TOTAL

Every Specialist course, stream by stream.

A Stream is the evidence subject you study — numbered below, and taught across the Levels it carries. Each course names its recommended preparation, the competencies it assesses, and the Manual volumes it draws on. A unit does not take all of them — it takes the Streams its casework demands, at the level its investigators work.

S10 · Evidence and platform · TE TE-01..TE-08

Stream 2: Telecommunications Engineering

Why networks generate the records investigators receive — and why a serving cell describes network association rather than a location.

All 5 courses in this stream, at every level

Stream 2: Telecommunications Engineering (S10) — Specialist courses
Code	Course	Level	Recommended preparation	Competencies	Manual basis
ET-S10-S01	Advanced RF and Network Behaviour	Specialist	ET-S10-A01 and ET-S50-P01	TE-04..TE-08	V2, V10, V11

S20 · Evidence and platform · AP AP-01..AP-08

Stream 4: Apple Mobile Evidence

Apple Account, iCloud, backup, Find My, and synchronization artifacts, held apart from the person holding the phone.

All 4 courses in this stream, at every level

Stream 4: Apple Mobile Evidence (S20) — Specialist courses
Code	Course	Level	Recommended preparation	Competencies	Manual basis
ET-S20-S01	Apple Mobile Validation Specialist	Specialist	ET-S20-A01	AP-05..AP-08	V4, V8, V11

S21 · Evidence and platform · GO GO-01..GO-08

Stream 5: Google and Android Mobile Evidence

The widest phone-linked evidence surface: accounts, Takeout, location services, Maps Timeline, Play Services, and Android itself.

All 5 courses in this stream, at every level

Stream 5: Google and Android Mobile Evidence (S21) — Specialist courses
Code	Course	Level	Recommended preparation	Competencies	Manual basis
ET-S21-S01	Google and Android Mobile Validation Specialist	Specialist	ET-S21-A01	GO-06..GO-08	V5, V8, V11

S22 · Evidence and platform · MS MS-01..MS-08

Stream 6: Microsoft Services on Mobile Phones

Mobile identity, authentication, and sync across Outlook, OneDrive, Teams, Edge, and Entra ID — separating mobile activity from desktop and automated activity.

All 4 courses in this stream, at every level

Stream 6: Microsoft Services on Mobile Phones (S22) — Specialist courses
Code	Course	Level	Recommended preparation	Competencies	Manual basis
ET-S22-S01	Microsoft Mobile Evidence Validation Specialist	Specialist	ET-S22-A01	MS-04..MS-08	V6, V11

S23 · Evidence and platform · TA TA-01..TA-08

Stream 7: Third-Party Mobile Applications

Where most phone evidence now lives: messaging, social, location and transport, health, banking, and service applications, plus their cloud synchronization.

All 5 courses in this stream, at every level

Stream 7: Third-Party Mobile Applications (S23) — Specialist courses
Code	Course	Level	Recommended preparation	Competencies	Manual basis
ET-S23-S01	Mobile Application Validation Specialist	Specialist	ET-S23-A01	TA-06..TA-08	V7, V8, V11

S30 · Evidence and platform · MF MF-01..MF-08

Stream 8: Mobile Device Forensics

Preservation, acquisition, file systems, logs, and artifacts — with tool output validated before it is interpreted.

All 5 courses in this stream, at every level

Stream 8: Mobile Device Forensics (S30) — Specialist courses
Code	Course	Level	Recommended preparation	Competencies	Manual basis
ET-S30-S01	Advanced Mobile Forensic Validation	Specialist	ET-S30-A01 plus one platform course	MF-04..MF-08	V4/V5/V7, V8, V11

S40 · Analytical · TR TR-01..TR-08

Stream 9: Mobile Timeline Reconstruction

Normalizing timestamps, separating event time from record, sync, and access time, and testing competing sequences.

All 4 courses in this stream, at every level

Stream 9: Mobile Timeline Reconstruction (S40) — Specialist courses
Code	Course	Level	Recommended preparation	Competencies	Manual basis
ET-S40-S01	Complex Mobile Timeline Specialist	Specialist	ET-S40-A01 and ET-S30-P02	TR-03..TR-08, IR-02	V8, V9, V11

S50 · Analytical · SA SA-01..SA-08

Stream 10: Mobile Spatial Analysis

Cellular, GPS, Wi-Fi, and application location evidence expressed as bounded areas with stated uncertainty, never as a point of certainty.

All 4 courses in this stream, at every level

Stream 10: Mobile Spatial Analysis (S50) — Specialist courses
Code	Course	Level	Recommended preparation	Competencies	Manual basis
ET-S50-S01	Advanced Mobile Spatial Validation	Specialist	ET-S50-A01	SA-04..SA-08	V2, V3, V10, V11

S70 · Integration · IR IR-01..IR-08

Stream 11: Integrated Mobile Reconstruction

Where the streams converge: correlating two or more completed evidence streams, reconciling conflicting records, and defending the reconstruction that survives.

All 4 courses in this stream, at every level

Stream 11: Integrated Mobile Reconstruction (S70) — Specialist courses
Code	Course	Level	Recommended preparation	Competencies	Manual basis
ET-S70-S01	Integrated Mobile Reconstruction Specialist	Specialist	ET-S70-A01 plus approved specialist readiness	IR-01..IR-08	Applicable retained volumes and V11

PRACTICE AT THIS LEVEL

2 mock investigations pitched at Specialist reasoning.

Mock investigations are optional practice in applying competencies a learner has already completed. Each is built around phone evidence that disagrees with itself, and can be worked in guided, assisted, or independent mode.

ET-MC-301Integrated Mobile ReconstructionComplex multi-source case
ET-MC-302Mobile Validation ChallengeControlled disputed-artifact analysis

How practice, simulation, and readiness assessment work

CHOOSE A LEVEL

Place each investigator at the level their casework needs.

Courses at every level can be bought individually, and every All Access tier opens all 47 courses at all 4 levels — so a unit can move someone up a level without changing its licence.

Level 01 · Foundation
Read the record correctly and know what it does not say.
11 Foundation courses
Level 02 · Practitioner
Work common records and document a conclusion that traces back to evidence.
16 Practitioner courses
Level 03 · Advanced
Resolve conflicting evidence and defend what survives.
11 Advanced courses
Level 04 · Specialist
Validate changing or uncommon technical behaviour within a defined specialty.
You are here — 9 courses

All 47 courses in every tier
Level and guidance controlled separately
Prior courses are recommendations, not enrolment conditions

NEXT STEP

Tell us who needs Specialist level, and we will quote the seats.

Send the streams your unit works and how many investigators sit at each level. We will propose a pathway, confirm what is released today, and put a written quote in front of procurement.

Request a subscription quote Back to the full catalogue