Mobile Unpacked With Chris Vance

In this exciting monthly webinar series, noted mobile forensics expert Chris Vance tackles some of the biggest challenges in mobile forensics, including modern mobile techniques, noteworthy mobile artifacts, and how it all impacts digital investigations.

UPCOMING LIVE WEBINAR

S3:E4 // Discussing the Data Drop-Off

iOS has long been known for only storing certain records for a fixed period of time. In some cases, artifacts may only be stored on device for a few days, and in others, never deleted without the user’s intervention. This this episode of Mobile Unpacked we will break down the “best before” dates of our favorite artifacts and deeper explore how to maximize the amount of data retained and extracted. Multiple methods of data preservation will also be explored as it relates to recent industry papers.

Season 3

On Demand Webinars

S3:E1 // ADB: It’s easy as ABC – Understanding the power of ADB commands

The power of the ADB command protocol is instrumental in the forensic analysis of Android devices. In this episode of Mobile Unpacked we'll focus on learning the basics up to some advanced ADB commands that can be used to acquire key information and files that may be available with no other processes. This talk will focus on acquiring files, records, logs, and using built-in commands to even process data directly from the devices.

About a 0 minute view

January 10, 2025

corporate , le , mobile

On Demand Webinars

S3:E2 // apples, onions, and ogres: dealing with layered iOS data structures

In the Dreamworks film Shrek, the titular character said that 'Ogres are like onions. They have layers.' Well, Apple isn't so different from the green hero in that their lovable monster, iOS also features its own layers of data structures all over the file system.

About a 0 minute view

January 10, 2025

featured , magnet-graykey , mobile

On Demand Webinars

S3:E3 // The AI we carry

With major mobile operating systems incorporating artificial intelligence into base functions and third-party applications, it’s time to explore what artifacts are available. In this episode of Mobile Unpacked we talk will cover built-in AI from iOS, Android, and even 3rd party applications putting prompts in our pockets.

About a 0 minute view

February 25, 2025

cloud , computer , corporate , le , magnet-axiom , mobile

Season 2

On Demand Webinars

S2:E1 // Unlocking iOS 17’s secrets – exploring the full file system

With recent breakthroughs in Magnet GRAYKEY, we now have access to full file system images for iOS 17. This next episode of Mobile Unpacked will explore what these additional areas have given us in comparison to standard quick imaging or logical+ style imaging. Topics will include new/moved voicemail storage and transcriptions, the use of multiple SEGB formats, and more!

About a 0 minute view

December 19, 2023

corporate , le , magnet-axiom , magnet-graykey , mobile

On Demand Webinars

S2:E2 // Logging la vida loca

Most modern electronic devices keep logs running that store information about who, what, when, where, and why processes are performed. Modern smartphones are certainly no different. In fact, certain artifacts can only be recovered by an in-depth review of these logging files.

About a 0 minute view

February 6, 2024

corporate , le , magnet-axiom , magnet-axiom-cyber , magnet-graykey , mobile

On Demand Webinars

S2:E3 // Considering the keys – exploring the keychain and keystore for what value they hold

As the security of our mobile devices grow, so does our trust in their secured storage. More and more individuals are turning to iOS and Android’s key storage systems as a passcode manager, token holder, and even MFA generation tool in some cases. This next episode of Mobile Unpacked will explore the Keychain in iOS and the Keystore in Android and discuss their security settings, what data they hold, and how to use these powerful values to unlock even deeper protections in our forensic investigations.

About a 0 minute view

March 1, 2024

mobile

On Demand Webinars

S2:E4 // Exploring the possibilities of iOS shortcuts in mobile investigations

iOS introduced the Shortcuts function to help automate device tasks and make our lives easier. With the iPhone 15 Pro Series, they even gave us a hardware option to utilize them. However, with this ability came some interesting anti-forensic theories for those working with the mobile devices.

About a 0 minute view

April 5, 2024

le , magnet-axiom , mobile

On Demand Webinars

S2:E5 // Vocalizing on validation and verification

With the absolute mountain of data on mobile devices, examiners are often responsible for figuring out how certain apps and features work then trying to convey that information to those in court or clients. This month's episode focuses on establishing all the key components so examiners can build their own validation and verification toolbox to help streamline this process.

About a 0 minute view

April 19, 2024

corporate , le , mobile

On Demand Webinars

S2:E6 // Restoring the past: Exploring artifacts related to restoring data using different methods on iOS devices

How did the data get on the device? Was it populated by the user or did it get resurrected from a dead device, to live again through the next generation of iPhone? This episode will explore the different methods of restoring information between iOS devices and the valuable artifacts they leave behind so you can help to answer those questions!

About a 0 minute view

June 11, 2024

corporate , le , mobile

On Demand Webinars

S2:E7 // Restoring the past part 2: Exploring artifacts related to restoring data on Android devices

In Episode 18 we discussed artifacts relating to passing data through different backup and restore methods to iOS devices.

About a 0 minute view

July 9, 2024

le , magnet-axiom , magnet-graykey , mobile

On Demand Webinars

S2:E8 // Focusing in on Apps In Focus: Exploring the artifacts that tell us what the user was looking at on their device

With both iOS and Android capturing amazing details on what applications are considered “In Focus” over time.

About a 0 minute view

August 2, 2024

le , mobile

On Demand Webinars

S2:E9 // Investigating the Intents – Better understanding “AppIntents” and their purpose

With Android and iOS constantly providing deeper metrics on user functions and activities, one that has gained a lot of popularity

About a 0 minute view

September 4, 2024

On Demand Webinars

S2:E10 // Eyes on Eighteen

This episode of Mobile Unpacked will explore the new features Apple has added within iOS 18 as well as how those features change some artifacts that you know and love. Come learn what’s new from a file system perspective as we explore various levels of extraction and analysis. It will also take a look at what is to come this year as iOS 18 “levels up” its intelligence functions!

About a 0 minute view

September 24, 2024

corporate , le , mobile

On Demand Webinars

S2:E11 // Following the money | Tracking mobile payment artifacts

With iOS and Android both having tap-to-pay payment functionality built in, it’s opened up a great opportunity for tracking where and how they’re using this feature.

About a 0 minute view

October 29, 2024

corporate , industry-news , le , mobile

On Demand Webinars

S2:E12 // Split Personalities – understanding multiple user account purposes in Android

While multiple user-accounts are not a new thing with Android, they are gaining momentum in how much they are used. In addition to just secondary profiles and guest accounts, more and more services like Secure Folder, Dual Messenger, Private Space, and even MDM solutions are taking advantage of the functionality. This episode of Mobile Unpacked will focus on how to detect these additional accounts, how to figure out what service they may be tied to, and how to maximize the amount of data you're able to extract from them. Come learn what your forensic tools may not be targeting!

About a 0 minute view

November 26, 2024

corporate , le , magnet-automate , magnet-axiom , mobile

Season 1

On Demand Webinars

S1:E1 // Rethinking mobile forensics

In this first webinar in our Mobile Unpacked With Chris Vance series, Chris will address some of the main challenges that examiners are faced with in mobile forensics, as well as lay out a new way of addressing these challenges. He will also cover what can (and cannot) be extracted from each typical protocol used … <a href="https://www.magnetforensics.com/mobile-unpacked-with-chris-vance/">Continued</a>

About a 1 minute view

January 9, 2023 • About a 1 minute view

corporate , industry-news , le , magnet-news , mobile , training

On Demand Webinars

S1:E2 // The meaning of messages

In this Mobile Unpacked with Chris Vance webinar, Chris will focus on the Messages app on iOS and its storage components. With Apple’s notable presence in the mobile market in North America, the core Messages app is one forensic examiners are exposed to frequently. With so many additional features beyond just sending and receiving messages, … <a href="https://www.magnetforensics.com/mobile-unpacked-with-chris-vance/">Continued</a>

About a 1 minute view

January 9, 2023 • About a 1 minute view

corporate , industry-news , le , magnet-news , mobile , training

On Demand Webinars

S1:E3 // Missing data? Build back better with biomes!

Did some of your favorite data go missing in iOS 16? Events missing from your timeline? With iOS 16’s deeper adoption of the biome directory and the ‘SEGB’ file format found within, much of this information has found a new home. This Mobile Unpacked with Chris Vance episode will more deeply explore the SEGB file … <a href="https://www.magnetforensics.com/mobile-unpacked-with-chris-vance/">Continued</a>

About a 1 minute view

January 9, 2023 • About a 1 minute view

corporate , industry-news , le , magnet-news , mobile , training

On Demand Webinars

S1:E4 // The need for speed—quickly triaging mobile devices

Every case involves a mobile device. That means that we have to start prioritizing the devices as well as how much we want from them. Sometimes, we don’t want to (or can’t) collect everything due to scope or simply time to evidence. How can examiners quickly diagnose mobile devices with triage techniques? This episode will … <a href="https://www.magnetforensics.com/mobile-unpacked-with-chris-vance/">Continued</a>

About a 1 minute view

March 27, 2023 • About a 1 minute view

magnet-axiom , magnet-outrider , mobile

On Demand Webinars

S1:E5 // Getting mixed messages: Making sense of Android messaging data

Unlike its smartphone counterpart, Android’s messaging applications are as fragmented as its operating system distribution. This next Mobile Unpacked episode will discuss the key points relating to recovering SMS, MMS, and RCS messages from both the core storage locations of Android as well as the additional storage areas where information may reside. Learn how Android … <a href="https://www.magnetforensics.com/mobile-unpacked-with-chris-vance/">Continued</a>

About a 1 minute view

May 3, 2023 • About a 1 minute view

cloud , corporate , le , magnet-axiom , magnet-axiom-cyber , magnet-graykey , mobile

On Demand Webinars

S1:E6 // Watching the watchers: Using device metrics for user attribution

In this episode of Mobile Unpacked, Chris Vance will discuss user activity tracking artifacts and how they can be utilized in your forensic investigations.   Modern smartphone operating systems use multiple systems of monitoring user behavior and device metrics to craft a more user-friendly experience. This allows the OS to almost “predict” what application or person … <a href="https://www.magnetforensics.com/mobile-unpacked-with-chris-vance/">Continued</a>

About a 1 minute view

May 17, 2023 • About a 1 minute view

cloud , corporate , le , magnet-axiom , magnet-axiom-cyber , magnet-graykey , mobile

On Demand Webinars

S1:E7 // Figuring out file explorers – part 1

With iOS and Android both having file storage accessible for the end user, they need some sort of app to allow for the user to access these areas. While the entire file system is not available to the user, understanding where the data the user can access lives is crucial. This Mobile Unpacked episode is … <a href="https://www.magnetforensics.com/mobile-unpacked-with-chris-vance/">Continued</a>

About a 1 minute view

July 5, 2023 • About a 1 minute view

cloud , corporate , le , magnet-axiom , magnet-axiom-cyber , magnet-graykey , mobile

On Demand Webinars

S1:E8 // Figuring out file explorers – part 2

In Part 1 of this two-part Mobile Unpacked series, we explored the storage structures of the most popular file browser/storage applications in iOS and Android. In this part, we’ll dive deeper using these applications as our starting point to figure out how files got to where they ended up. This presentation will discuss file movement, … <a href="https://www.magnetforensics.com/mobile-unpacked-with-chris-vance/">Continued</a>

About a 1 minute view

July 5, 2023 • About a 1 minute view

cloud , corporate , le , magnet-axiom , magnet-axiom-cyber , magnet-graykey , mobile

On Demand Webinars

S1:E9 // Exploring Samsung’s secure folder feature to recover digital evidence

With Samsung’s stance on device-based encryption, there are multiple additional factors in play for those devices versus other Android handsets. One such factor is the Samsung Secure Folder which is part of their Knox security platform. Join Matt Fullerton and Chris Vance for this Mobile Unpacked episode where they will explore what Secure Folder is, how you can access it, and what information lies within.

About a 0 minute view

August 24, 2023

corporate , le , magnet-axiom , magnet-axiom-cyber , magnet-graykey , mobile

On Demand Webinars

S1:E10 // iOS 17: Let’s USB-C what’s new!

With another year comes another chance to take a byte of Apple's mobile operating system, iOS. Join us for this next Mobile Unpacked episode to explore what impacts there have been to data acquisitions, device connections, and file types. This episode will explore the current and upcoming features of iOS 17 that will impact forensic investigations in all sectors. We will look at several of these new features within the raw file system to gain first-hand experience of the newest mobile operating system artifacts.

About a 0 minute view

October 4, 2023

corporate , le , magnet-axiom , magnet-axiom-cyber , magnet-graykey , magnet-verakey , mobile

On Demand Webinars

S1:E11 // Peering into permissions – taking a look at iOS/Android permissions for insights to 3rd party apps

Whenever an app ends up on a modern smartphone, it has to first ask for permission from the user for its functions. These permissions can be standard or considered 'sensitive.' Join us for this next episode of Mobile Unpacked with Chris Vance to learn how to use this information to track insights about the 3rd party apps installed on a device, what they have done or not done, and whether or not their behavior is malicious.

About a 0 minute view

October 27, 2023

corporate , le , magnet-axiom , magnet-graykey , mobile

On Demand Webinars

S1:E12 // Messing around with media: Understand media types in modern smartphones

iOS and Android devices are usually a plethora of media data, but what types of media data await an examiner? What is the difference between a HEIC and a JPEG, a PNG and a KTX, ProRes and ProRaw, or even a Live Photo versus a Motion Photo? Which types of media are going to be natively viewable, and which ones will require a special viewer? Join Chris Vance in this next episode of Mobile Unpacked, where he will explore the different types of media files that are present on both Android and iOS devices including their proprietary formats and what each type of media file can tell us contextually about the data that awaits us.

About a 0 minute view

November 14, 2023

corporate , le , magnet-axiom , magnet-graykey , mobile

Mobile Minute Episode 1: Intro to Mobile View

This video covers an introduction and basics to the Mobile View feature of Axiom. Learn more about mobile forensics here.

About a 1 minute view

June 4, 2024 • About a 1 minute view

magnet-axiom , mobile

Mobile Minute Episode 2: How to help your stakeholders use Mobile View in Portable Cases

This video walks users how to generate mobile view within portable cases and how that data will be represented to end-line stakeholders for review. It also includes information on how to not include the mobile view if not desired as well as highlighting key features in the Portable Case version that are not in the … <a href="https://www.magnetforensics.com/mobile-unpacked-with-chris-vance/">Continued</a>

About a 1 minute view

July 19, 2024 • About a 1 minute view

magnet-axiom , mobile

Mobile Minute Episode 3: How to use the advanced options of Mobile View in Magnet Axiom

This video will walk users of Axiom through advanced features relating to the Mobile View function. These features allow an examiner to customize the workflow of using Mobile View for easier artifact view and access. It will also cover features for power-users that include how to use Mobile View to quickly locate and identify unsupported … <a href="https://www.magnetforensics.com/mobile-unpacked-with-chris-vance/">Continued</a>

About a 1 minute view

September 23, 2024 • About a 1 minute view

magnet-axiom , mobile

Mobile Minute Episode 4: Performing category-based extractions with Magnet Verakey and Magnet Graykey

This video walks users through category-based extractions and how to pull items like call logs, messages, images and more.

About a 1 minute view

November 27, 2024 • About a 1 minute view

magnet-graykey , magnet-verakey , mobile

Mobile Minute Episode 5: Disappearing Data from iOS devices

In this episode of Mobile Minute, we will discuss data that disappears from mobile devices. We look at the how, when and what disappears, how it can effect your investigation and what you can do to prevent this from happening. Learn more about mobile forensics here.

About a 1 minute view

December 20, 2024 • About a 1 minute view

magnet-axiom , mobile

Mobile Minute Episode 6: Enhancing geolocation investigations with animated maps in route view

This video demonstrates how Magnet’s Animated Maps help forensic professionals track and visualize suspect movements, establish accurate timelines, and corroborate digital evidence in location-based data cases. By animating recorded routes, investigators can gain critical insights into individuals’ behavior and activities, making it easier to identify patterns, verify alibis, and present geolocation evidence in court.

About a 1 minute view

January 21, 2025 • About a 1 minute view

magnet-axiom , mobile

Mobile Minute Episode 7: Using Magnet Copilot’s AI capabilities in mobile investigations

With the increasing storage capacity of mobile devices the the large volumes of mobile evidence in investigations can be overwhelming. This episode of Mobile Minute provides a brief overview of how Magnet Copilot’s chat style interface can be used to quickly surface potentially relevant evidence in conversation threads or web searches, helping accelerate your time … <a href="https://www.magnetforensics.com/mobile-unpacked-with-chris-vance/">Continued</a>

About a 1 minute view

February 24, 2025 • About a 1 minute view

magnet-axiom , mobile

Magnet Graykey for mobile forensics

Recover data from iOS and Android devices with Magnet Graykey, and use the artifact-first approach of Magnet Axiom to get the most relevant evidence for the most popular applications.

Learn more about Graykey

All Resources

Content Types

Resources By Industry

Enterprise Resources

Content Types

Public Safety Resources

Content Types

Service Providers Resources

Content Types

Federal Agencies Resources

Content Types

Military & Intelligence Resources

Content Types

S3:E4 // Discussing the Data Drop-Off

Season 3

S3:E1 // ADB: It’s easy as ABC – Understanding the power of ADB commands

Season 2

S2:E1 // Unlocking iOS 17’s secrets – exploring the full file system

Season 1

S1:E1 // Rethinking mobile forensics

Mobile Minute Series

Mobile Minute Episode 1: Intro to Mobile View

Magnet Graykey for mobile forensics