Finding the data that you need for an investigation can be challenging even when you’re familiar with the data source. However, if you’re new to or just getting started with working with mobile investigations, it can make things even more challenging! Don’t worry. We’ve put together this curated list of common locations that you can … Continued
Device users are no longer relying on default applications to communicate, often migrating to 3rd party applications with additional features. Unfortunately, these same types of applications can be used by actors involved in criminal investigations to encrypt and obfuscate their activities. In this webinar, join David and Trey, digital forensic experts from Grayshift and Magnet … Continued
There are several artifacts that can be decrypted with data from the iOS Keychain. In this Tips and Tricks, we will show you how to look at Keychain data, such as that available with a Keychain image and use that data to decrypt a data from different artifacts. In this session, Jessica Hyde will show you some processing best practices to help you be able to unlock more parsed results from the iOS Keychain.
The processing and parsing of artifacts from Telegram, WeChat, KakaoTalk, and Line are all supported in AXIOM, so we’re taking a look at these chat applications, specifically for Android devices.
With the millions of applications available to users on Android devices, it becomes impossible for commercial tools to be able to parse and support them all. However, analyzing unsupported applications can sometimes be critical to your digital forensics investigations. In this session, we’ll explore one method of Android App Analysis by virtualizing the data using … Continued
When full file system acquisitions are not available for iOS devices, several key artifacts will be missed from examinations. In order to obtain several of these key pieces for investigation, examiners should understand how to capture log files from the device as well as techniques to extract and analyze them. This presentation will discuss ways … Continued
In this how-to document, we share how you can get images containing the entire file system of iOS devices with GrayKey and analyze that data with AXIOM.
Ever curious about what the equivalent of KnowledgeC on iOS is to Android? Does Android have a Live Photo feature and where would I find that data? Does iOS have a Takeout equivalent? Join Jessica Hyde, Director of Forensics, and Christopher Vance, Manager of Curriculum Development, as they compare the artifacts between Android and iOS. … Continued
What data is where? Is the data stored on the device? In the cloud? Synced to both? It is important for forensic examiners to know where to find artifacts, what data may be stored where, and what may be missing by looking at only one evidence source. In this session, join Jessica Hyde and Tarah … Continued
Chris Vance goes through the “Files” app that Apple added in iOS 11.
