Teel Tech Classes at Techno Security 2020

COVID-19 Event Updates from Technosecurity

The health and safety of our staff, attendees, and sponsors is our top priority. We will continue to monitor all local, state and federal advice and directive as we assess our plans for the 2020 Techno Security & Digital Forensics Conference in Myrtle Beach, May 31-June 3. Based on current information we believe that the event will go ahead as planned. However, we expect that developments in the next 1-2 weeks will determine If the situation requires us to reassess. We will keep you apprised of any changes if/when they occur. Please be assured that we are evaluating an array of potential contingencies so that we may make responsible decisions should we have to postpone the event.

Participate in one of our trainings and receive a FREE Pass to the Techno Security Conference

A $995 Value

Our trainings

Embedded Hardware Acquisition & Analysis Training

Access digital data at the physical level from sources that include IOT devices, smart tvs, vehicle systems, skimmers/shimmers and drones.
Learn More

SQLite Forensics Training

Both Android OS and Apple iOS store their data using SQLite. Mobile forensic analysts can easily leverage this commonality to perform low-level analysis and recovery on most phones.
Learn More


Embedded Hardware Acquisition & Analysis Forensic Training

Our NEW 5-day Embedded Hardware Acquisition & Analysis Forensic Training will focus on processes that can be used to access digital data at the physical level from sources that include:

  • IOT devices
  • Smart TV’s
  • Vehicle systems
  • Drones
  • Skimmers/shimmers
  • Almost every other device that utilizes a main board, controller chip and some forms of flash memory.


Students will be provided with a foundation of how electronics work in relation to the techniques being used in this training. The processes taught will include tools from cost effective sources, open source resources, and commercial tools.

Students will learn how to adapt techniques like JTAG, ISP, Chip-Off, and apply it to embedded communication protocols such as SPI, i2C, UART and more, in order to exploit components and recover data from various sources like embedded code and the flash memory of controller chips. Data from these sources can then be analyzed for evidence or malware artifacts.



Laptop Minimum Requirements

We encourage students to bring their own laptops whenever possible. If this is not possible, TeelTech will provide one for you. If you do plan on bringing your own laptop, indicate so on the registration page and please ensure they meet the following requirements.

Laptop Requirements:

  • Windows 7
  • Windows 8.x and 10.x using these instructions
  • macOS with Bootcamp Windows 7
  • macOS with Bootcamp Windows 8.x and Win 10.x using these instructions
  • macOS alone will not work (No Virtual Machines)
  • 8GB RAM (minimum)
  • 100GB storage (minimum)
  • You must have admin rights or have the admin password for software installation.
  • NOTE: ALL Windows updates should be done prior to class



SQLite Forensics

Since their initial introduction in 2007, Smartphones have come to dominate the cellular phone marketplace quickly making feature phones nearly obsolete. This domination is split fairly evenly between two major companies: Google with their Android OS and Apple touting their own iOS. Even though both of these companies are business rivals and their file systems are significantly different, both share a commonality in that they both store a majority of their user data within a data storage container type called SQLite.

SQLite is an in-process library that implements a self-contained, serverless, zero-configuration, transactional SQL database engine. Mobile Forensic Analysts can easily leverage this commonality, by learning the skills required to perform low-level analysis and recovery on SQLite databases. Once learned and mastered, examiners can then support nearly 99% of the device data they will come across in the majority of their mobile device examinations.

To illustrate the vast amount of work to be done, as of January 2015, the Google Play Store reported 1.43 Million Applications being available in their Google Play Store. At the same time, Apple’s iTunes Store reported over 1.4 Million apps currently being available for download. That’s a total of over 2.8 MILLION apps. Even the most popular mobile forensic tool only supports parsing of 200 different applications. This support accounts for a minuscule 0.001% of the total apps and leaves a 99.999% gap!

AndroidwSQLThis class will help examiners close that gap by teaching the students:

  • How SQLite works at the byte-level
  • What are the different types of SQLite data components
  • What are the 5 common locations to recover SQLite data
  • How to perform report data validation
  • How to Reverse Engineer ANY SQLite database
  • Converting and identifying virtually any date format easily
  • Display BLOB data within the forensic tool
  • How to use a tool designed from the ground-up as a forensic tool
  • How to recover data from .WAL and .journal files
  • How to generate reports quickly from any SQLite database to include external linked images
  • SQLite Record Recovery (Incomplete and Orphaned Records)
  • Manual Parsing of: Write-Ahead Logs and Journal Files
  • Advanced Data Recovery Scenarios
  • Manual SQLite Data Recovery
  • SQLite Payload Examination/SQLite Data Construct Parsing
  • Using simulations to perform data testing/verification/decryption
  • SQLite Encryption
  • Advance Scenario Exam

This IS the future of digital mobile forensics!

Students will receive:

  • A free one-year license of Sanderson Forensics SQLite Forensic Toolkit Software
  • A free 30-day license of Andriller Software
  • Thumbdrive with a library of useful scripts used in class, course exercises and materials.


PDF: SQLite Class Brochure


For ALL SQLite Students:

All SQLite Students must be currently employed at/for a law enforcement agency and do not charge for any work that they take on. If a student works for a commercial entity (or law enforcement agency) that takes on work from other agencies and accepts payment for this work, then they are NOT eligible. Any student unable to fulfill this requirement in attendance at any SQLite class may be asked to leave by the instructor and Teel Technologies shall refund their tuition fee. Teel Technologies shall not be held responsible for any associated fees (e.g., travel hotel, transportation) should a student be asked to leave.


This is an excellent course to provide the student with the foundation to develop methodologies to validate the findings of commercial tools that attempt to parse SQLite data. This data may or may not be addressed by the tools and thus when dealing with mobile apps, many of which are not parsed out by tools, or are partially parsed, you will be able to export the “backend” data and have the skills to extract, reconstruct (relationally) and inspect the data. The class touches on the internal structure of the SQLite databases and provides the student with skills investigate the data contained in SQLite databases and corresponding journal and wal files.

Blazer Catzen



Navigating and executing programs at the Command Line (Unix or DOS) is required. Beginner programming/scripting experience is helpful (but not required).


Created by Sam Brothers

Sam Brothers is currently working as a Digital Forensic Specialist for US Law Enforcement. He has been in the IT field for over 30 years, and currently specializes in the field of Mobile Device Forensics. He has completed analysis work on hundreds of mobile and computer forensics cases. He and his team had the honor of briefing the then DHS Deputy Secretary on their accomplishments and digital forensic capabilities. He enjoys the opportunity to teach forensic analysis for various law enforcement organizations both in the US and around the world.

Mr. Brothers is an active member of the Scientific Working Group on Digital Evidence (SWGDE) serving his second term as chairman for the Forensics Committee and with the American Academy of Forensic Sciences (AAFS) as both a Fellow member and as Program committee chairman for the Digital and Multimedia Evidence Section. He also serves as Vice-Chair for the OSAC Subcommittee on Digital Evidence.

Mr. Brothers has been requested internationally for speaking engagements on the topic of Advance Mobile Device Forensic Analysis and always looks forward to sharing what he knows with other investigators in the field to make the forensic community stronger and further the field of Digital Forensics.

In 2008, he developed and published the Mobile Device Tool Classification System. Since then, this system has come to be used by many of the top practitioners in the field and has been featured in many books and digital forensic publications around the world. His classification system serves as a benchmark in the industry to classify method of mobile device forensic extraction. His work is referenced in both NIST and SWGDE best practice documentation and used in several graduate level courses on forensics.