In our new white paper on Android 6.0 (Marshmallow) forensics, we talk a little bit about Gatekeeper password storage, a new-as-of-Lollipop feature designed to introduce a new level of obfuscation to PIN and pattern locks—both in file name and location, and in hash settings. In previous Android versions starting with 2.2, devices’ 4- to 16-digit … Continued
Mobile device encryption has been a headache for investigators ever since Apple introduced it with the iPhone 3GS and iOS 3.0. Since that time, encryption headaches have only accelerated, with Apple tying it to hardware (the A5 and later processing chips) and adding layers of data to its encryption. With Android in the game now … Continued
A new Magnet Forensics white paper is coming soon, and while it focuses on the technical aspects of Android Marshmallow Forensics, running underneath those details is another theme: the only way to stay current on mobile device technology changes is to know how to get out in front of them. Yet few, if any, forensic … Continued
Encrypted chat apps can be some of the hardest nuts to crack — especially when someone is trying to cover their tracks in advance — but they can also be vitally important to an investigation . Signal is a popular chat app with an emphasis on privacy. It uses encryption on in-transit data, and Magnet … Continued
New version also includes faster PhotoDNA processing, and support for KakaoTalk and Zalo. Magnet AXIOM 1.0.10 is now available for download! AXIOM 1.0.10 will give users: Decryption of iOS 10.2 iTunes Backups — We’re always working on giving investigators the tools to keep up with the latest encryption found in Apple’s software. Now, you can … Continued
Including Parsing iCloud Backups, Sorting in Multi-Artifact View, New Exporting Options, Musical.ly Artifact Support, and More. Customer feedback is essential to maintain the quality of our products. We’ve been able to incorporate customer input on the features they are looking for in our latest release, Magnet AXIOM 1.0.9, which is available for download now.. Here … Continued
Magnet AXIOM version 1.0.7 is now available. This new version includes support for Pebble Watch for iOS and Android. Examiners can now access the Pebble Watch artifacts to recover information held by those apps, including notification time stamps, calendar events, weather, location and health data. AXIOM 1.0.7 also adds the ability to extract artifacts from … Continued
Since its launch, Uber has become a popular alternative to taxi rides in many cities globally. As Uber is controlled through a mobile app, it only makes sense to add support for it in Magnet AXIOM and Magnet IEF. With the launch of AXIOM 1.0.4 and IEF 6.8.1, we’ve added support to parse data from … Continued
The smartphone forensics landscape is changing, and examiners need to be smart with their budgets while also equipping themselves with the right tools to get the job done. Meet Magnet ACQUIRE, a free software solution that enables digital forensic examiners to quickly and easily acquire forensic images of any iOS or Android device, hard drives, … Continued
APPLICATION NAME: WhatsApp Messenger CATEGORY: Chat RELATED ARTIFACTS: WhatsApp Contacts, WhatsApp Messages OPERATING SYSTEMS: iOS, Android SOURCE LOCATION: iOS – /root/var/mobile/Applications/net.whatsapp.WhatsApp/Documents/ChatStorage.sqlite Android – /data/data/com.whatsapp/databases/msgstore.db Android – /data/data/com.whatsapp/databases/wa.db Android –/sdcard/WhatsApp/Databases/msgstore.db.crypt* Importance to Investigators Android For Android devices, there are two SQLite databases of value for examiners recovering WhatsApp artifacts: msgstore.db and wa.db. The msgstore.db contains details on any chat conversations … Continued
