Outcome: Define the mobile-forensics mission, authority, ethics, laboratory controls and defensible professional workflow.

Case: Project Anveshak begins when a fictional Indian logistics company reports possible invoice fraud and customer-list exfiltration. Written authority covers a company Android phone, a consented encrypted iPhone backup and supplied cloud exports; the live personal iPhone remains outside scope.

Tools: Authority and scope memo, Mobile evidence map, Lab safety checklist

Outcome: Explain Android and Apple mobile architectures and predict how hardware, operating-system, application and cloud controls affect evidence availability.

Case: The two Project Anveshak sources differ: a managed Android handset is powered on and unlocked, while an encrypted iPhone backup was supplied with its backup password and a documented export process.

Tools: Architecture comparison, Evidence-source map, State-and-key worksheet

Outcome: Document, stabilise, isolate, package and transport mobile devices while preserving state, integrity, safety and other forensic opportunities.

Case: Investigators encounter the company Android on a desk, powered on and unlocked, connected to Wi-Fi and paired with a smartwatch. The acquisition laboratory is ninety minutes away.

Tools: Scene record, Isolation decision log, Packaging and transport form

Outcome: Interpret common Android acquisitions, storage structures, system records and application artifacts without overstating completeness or attribution.

Case: The company Android acquisition contains device and credential-encrypted areas, work-profile data, shared media and several app databases. The tool parses only part of the work-profile content.

Tools: Android artifact map, Package and profile worksheet, Validation notebook

Outcome: Interpret common iPhone and iPad acquisitions, backups, plists, databases, logs and Data Protection constraints without overstating access.

Case: The supplied encrypted iPhone backup contains app domains, device information, messages and media indexes, but it does not include every file that would exist in a full file-system acquisition.

Tools: Backup provenance record, Domain and plist map, Apple limitation statement

Outcome: Examine SIM, eSIM, removable-media and telecommunications records while separating device, subscriber, account, network and user identity.

Case: Project Anveshak includes a physical SIM, an eSIM profile reference, call-detail records supplied by counsel and an Android microSD card labelled portable storage.

Tools: Identity matrix, SIM and media examination plan, Telecom correlation table

Outcome: Recover and correlate communications, browser, social, cloud and application evidence within lawful scope and with privacy minimisation.

Case: The case contains a synthetic chat database, browser history, cloud-drive audit export, email container and social-media cache, all collected under separate documented authorities.

Tools: App triage matrix, Communication thread reconstruction, Cloud provenance log

Outcome: Validate SQLite, plist, log, media, location and time artifacts and construct a timezone-aware, source-linked event timeline.

Case: Project Anveshak contains SQLite databases with WAL files, binary plists, EXIF media, GNSS-related records and timestamps expressed in Unix, Apple and local formats.

Tools: Source-validation worksheet, Time-normalisation table, Event timeline

Outcome: Assess deleted, hidden, encrypted and anti-forensic conditions using safe validation, documented limitations and specialist escalation.

Case: The synthetic datasets contain deleted SQLite rows, orphaned attachments, an encrypted app container, renamed files, disabled logging and a gap caused by retention rather than deliberate deletion.

Tools: Condition assessment, Recovery-validation log, Specialist escalation note

Outcome: Correlate mobile evidence, test competing explanations, document provenance and produce a clear, reproducible examination report.

Case: The Project Anveshak findings include a device login, a cloud upload, a matching file hash, a payment message and competing explanations involving automation and shared-device access.

Tools: Hypothesis matrix, Examination report, Peer-review checklist

Outcome: Defend an end-to-end mobile-forensics plan and findings package for Project Anveshak under professional, legal, quality and ethical constraints.

Case: The final case pack combines the authorised Android acquisition, consented encrypted iPhone backup, SIM report, cloud export, provider records, business logs, conflicting timestamps and an unsupported-app database. Learners must decide what can be concluded and what requires escalation.

Tools: End-to-end examination plan, Findings and limitations report, Executive and technical briefing