Anyone can run the First Look cases free, no account and no watermark. Open a First Look case →First Look cases · free, no account. Open one →
Sign in Learn for free
Home / Pathways / Mobile Forensics (GASF)
Cert prep · Digital Forensics · aligned to the published GIAC GASF objectives

GASF practice labs, one extraction at a time

The GASF objectives expect an examiner who can take a mobile extraction and recover what matters: messages, contacts and call logs; third-party app data in SQLite; deleted records still sitting in freelists and write-ahead logs; and the location and activity artifacts that place a device at a time and a place.

This pathway starts with a single recovered phone and adds one skill per case: third-party app databases, tying messages to a complaint, deleted-record recovery, location artifacts, call detail records and an investment-fraud case that needs several of them. The capstone puts the phone evidence beside a workstation, a mailbox and cloud logs, so the final step is correlation across sources rather than one more parser.

Start a free 30-day trial Download the sample lab

8 cases · ~16 h 27 min of lab time · Easy to Expert · a different variant for everyone · verified answer keys

The pathway, in order

8 cases, about 16 h 27 min of lab time. Each step opens the case in the library, where you can read the brief, the evidence list and sample questions. Everyone gets a different variant of the same case, graded against a key that was verified in the evidence.

  1. 01

    First Look: Recovered Phone

    Read SMS, contacts and call logs from an extraction.

    EASY~33 minUp to 15 questions
  2. 02

    Off the Record (The Other Messenger)

    Look past the SMS store into third-party app databases.

    MEDIUM~1 h 10 minUp to 20 questions
  3. 03

    Open Secret (Texting Secrets to a Competitor)

    Tie SMS, contacts and timestamps to a leak complaint.

    MEDIUM~1 h 10 minUp to 20 questions
  4. 04

    Second Thoughts (The Texts They Deleted)

    Recover deleted messages from SQLite.

    MEDIUM~1 h 10 minUp to 15 questions
  5. 05

    Alibi (Placing the Phone at the Scene)

    Place a device with location artifacts.

    HARD~1 h 45 minUp to 20 questions
  6. 06

    Cold Caller (Unwanted Contact: A Harassment Case)

    Call detail records, SMS and deleted-message recovery in one case.

    HARD~1 h 40 minUp to 20 questions
  7. 07

    Fattened Calf (Pig Butchering: The Investment That Vanished)

    Trace an investment fraud across messages, app data and the call log.

    HARD~1 h 35 minUp to 20 questions
  8. 08

    Inside Job (Insider and Collusion)

    Capstone: tie phone evidence to workstation, mail and cloud logs.

    EXPERT~7 h 24 minUp to 30 questions

What this pathway covers

FoundationsMobile ForensicsWindows ForensicsAdvanced Forensics & IRAligned to the published GIAC GASF objectivesEasy to Expert

Who it's for

  • Candidates preparing for the GASF who want to work real SQLite databases and extraction layouts, not screenshots of a commercial tool.
  • Instructors teaching a mobile forensics module who need graded, per-student labs that open in free tools.
  • Investigators who inherit phones and need a structured route from the first message to a report.

What you get with every case

  • A different variant per student. Same case, same rubric, different names, hashes, timestamps and answers, so students can talk about method without sharing answers.
  • Evidence in the real on-disk format. Registry hives, EVTX, PCAP, SQLite, JSON audit logs and memory images open in the tools the exam expects.
  • A verified answer key. Every answer is re-derived from the planted evidence before the lab ships, so grading disputes end at the artifact.
  • One-click grading and LMS export. Canvas, Blackboard, Moodle, D2L and LTI 1.3 grade passback, or a CSV. See the student portal.
  • Runs on the instructor's machine. Windows installer plus macOS and Linux, fully offline after activation. Nothing to host and no student data leaves the room. Course packs on courses.

Run this pathway with your own roster

Download the app, generate a three-student version of the first case in under five minutes, and grade it. First Look cases run free with no key, and the 30-day trial needs no card. Or open the sample lab first and work a student package in your own tools.

Start a free 30-day trial Open the sample lab

Related pathways

Network Forensics (GNFA)

Reading packet captures: DNS, beacons, cleartext credentials and exfiltration.

6 cases · ~19 h 9 min · GIAC GNFA

Linux Forensics

Investigating a Linux host and server: logins, persistence, and web-server intrusion.

5 cases · ~5 h 34 min · SANS FOR577

All learning pathways

Every certification-prep and role pathway across Digital Forensics and Incident Response, side by side.

Browse the overview →

GIAC, GCFE, GASF, GNFA, GCIH, GCFR and GCFA are trademarks of GIAC. CompTIA and CySA+ are trademarks of CompTIA, Inc. SANS is a trademark of the SANS Institute. Red Herrings aligns its pathways to the published objectives of these programs for teaching; it's independent of, and not affiliated with or endorsed by, any certification body.