Your shortcut to sharper skills and fast answers
Explore certified courses, microlearning, free tools, practical guides, and expert tips. All built to support real investigations.
Time is short. Cases are complex. And tools alone won’t tell you everything.
Our certified training gives you the skills to find answers beyond the tools.
Start strong with the essentials. Learn how to collect, examine, and explain digital evidence. From data acquisition to reporting, build practical skills through real cases and guided labs. Built for those starting out or refreshing the basics.
Become an expert in mobile forensics, from acquisition to reporting. Built for real cases, updated for today’s Android and iOS challenges. Gain skills that go beyond tool output.
Explore SQLite databases in depth, the hidden layer beneath mobile apps and operating systems. Learn how to extract, decode, and interpret data to uncover user activity and forensic artifacts. This hands-on course also includes access to a custom-built analysis tool designed to make complex structures easier to understand.
Dig deep into unsupported apps with hands-on SQLite analysis. Use Python to script, automate, and extract what tools miss. Gain a technical edge for advanced mobile forensics.
Format: 90-minute live online session
Level: Foundational to Intermediate
Instructor: James Eichbaum
Language: English
Price: $195 ex VAT per participant
(non-binding expression of interest)
Mode: Live + Interactive Q&A
Format: 45-minute live online session
Level: All levels
Instructor: James Eichbaum
Language: English
Price: Free
Mode: Live + Interactive Q&A
James Eichbaum will be speaking at PFIC 2025, presenting a session for digital forensic professionals who want to go beyond what commercial tools provide. His talk, “Beyond the Database: Revealing Hidden Mobile Evidence in Forensic Investigations”, explores how WAL (Write-Ahead Log) and SHM (Shared Memory) files can uncover uncommitted or deleted data often missed during app analysis.
This free guide provides a practical walkthrough of GPT-partitioned disks, covering the Protective MBR, GPT Header, and Partition Entry Array. It’s designed to help forensic professionals understand disk structures, recover data, and validate evidence.
James Eichbaum will be speaking at PFIC 2025, presenting a session for digital forensic professionals who want to go beyond what commercial tools provide. His talk, “Beyond the Database: Revealing Hidden Mobile Evidence in Forensic Investigations”, explores how WAL (Write-Ahead Log) and SHM (Shared Memory) files can uncover uncommitted or deleted data often missed during app analysis.
Choose the training that fits you best. Learn by doing with real-life examples, clear steps and support along the way.
Learn when it works for you. Get 24/7 access to real-case modules. Pause, replay, and apply at your own pace.
Join live sessions from anywhere. Ask questions, try out techniques, and learn by doing. Get all the energy of the classroom, without the commute.
Gain in-depth knowledge through face-to-face learning with hands-on labs led by expert practitioners with real-world forensic experience.
After decades of solving cases, testifying in court, and training forensic teams around the world, James Eichbaum founded Elusive Data in early 2024.
Well known in the community from his former roles as an investigator, Global Trainer Manager, and instructor for some of the leading names in the industry, James started the company with a clear idea: training should be more hands-on, immersive, and reflect the real challenges of daily investigations. It should also be more accessible, giving investigators faster access to the knowledge they need to act quickly, make sense of complex data, and solve cases without delay.
Today, Elusive Data helps professionals around the world learn through immersive, hands-on training. Courses include interactive labs, CTF challenges, and practical exercises built around real case data. Training is available on-demand, live online, and on-site.
Elusive Data also supports active investigations through expert consulting and forensic services, for a field that never stands still.
Operational support. Strategic strength. All-in-one forensic partner.
Get help uncovering and explaining digital evidence. We deliver clear, reliable results for investigations, legal cases, and internal reviews.
Build stronger forensic capabilities with expert guidance. From setting up labs to improving workflows. We help you work smarter, faster.
Instantly decode VarInts from mobile app databases with Elusive Data’s free forensic tool. Convert hex, binary, and decimal values for faster, more accurate investigations.
Discover Backup2FS, a free tool from Elusive Data that simplifies iOS backup analysis by normalizing backups into an easy-to-navigate file system.
Discover how I decrypted a locked Apple Note from an iOS 16.7.10 device using open-source tools like Hashcat, Python, and CyberChef. This step-by-step forensic workflow reveals the process behind extracting and decrypting hidden content from Apple’s Notes app. A must-read for digital investigators and mobile forensics professionals.
SQLite overflow pages store fragmented data that doesn’t fit within a single database page, requiring forensic analysts to reconstruct them for complete evidence recovery.
Varints are the backbone of SQLite’s efficient data storage, encoding values in a compact format that digital forensic investigators must decode to uncover critical evidence. This blog dives into the decoding process, real-world examples, and tools like the Varint Calculator to simplify forensic analysis.
Unlock the secrets of SQLite freeblocks and learn how to recover deleted records using forensic techniques.
Gain a deeper understanding of the GPT Partition Entry Array and its significance in digital forensic analysis. This guide explores key techniques and insights to enhance your forensic investigations.
Explore the vital role of the GPT Header in maintaining disk integrity. This article provides insights into its structure, purpose, and relevance in forensic investigations.
Explore the role of the Protective MBR in GPT-partitioned disks. This guide delves into its purpose, functionality, and importance in digital forensic investigations.
Be the first to hear about new training opportunities, free tools, case-based blog posts, and practical insights. Our monthly newsletter is built to help you learn faster, solve cases smarter, and keep up in a field that never stands still.
Fill in your email to sign up.
Thank you for a great course! I finally get how to work with unsupported apps. That clicked during this course. I’ve done a few trainings before, but this one stood out because it was actually useful right away. The instructor explained how app data is stored in a way that made sense, and I really appreciated all the real examples. I’ve already used a few techniques in a current case.