Why Only Working with Logical Images Isn’t Always Logical
We take a look at extracting images from iOS devices using Magnet AXIOM, including full file images, and how they can impact investigations.
Topic: Mobile
For Android and Google Takeouts: Targeted Locations Quick Reference Guide
Finding the data that you need for an investigation can be challenging even when you’re familiar with the data source. However, if you’re new to or just getting started with working with mobile investigations, it can make things even more challenging! Don’t worry. We’ve put together this curated list of common locations that you can … Continued
For Android and iOS: Targeted Locations Quick Reference Guide
Finding the data that you need for an investigation can be challenging even when you’re familiar with the data source. However, if you’re new to or just getting started with working with mobile investigations, it can make things even more challenging! Don’t worry. We’ve put together this curated list of common locations that you can … Continued
Investigative Challenges Surrounding Support for Unsupported Mobile Applications
Device users are no longer relying on default applications to communicate, often migrating to 3rd party applications with additional features. Unfortunately, these same types of applications can be used by actors involved in criminal investigations to encrypt and obfuscate their activities. In this webinar, join David and Trey, digital forensic experts from Grayshift and Magnet … Continued
Tips & Tricks // Decrypting Application Data Using the iOS Keychain and GrayKey
There are several artifacts that can be decrypted with data from the iOS Keychain. In this Tips and Tricks, we will show you how to look at Keychain data, such as that available with a Keychain image and use that data to decrypt a data from different artifacts. In this session, Jessica Hyde will show you some processing best practices to help you be able to unlock more parsed results from the iOS Keychain.
The Lesser Talked About Messaging Apps
The processing and parsing of artifacts from Telegram, WeChat, KakaoTalk, and Line are all supported in AXIOM, so we’re taking a look at these chat applications, specifically for Android devices.
Tips & Tricks // APK App Simulator
With the millions of applications available to users on Android devices, it becomes impossible for commercial tools to be able to parse and support them all. However, analyzing unsupported applications can sometimes be critical to your digital forensics investigations. In this session, we’ll explore one method of Android App Analysis by virtualizing the data using … Continued
Tips & Tricks // Acquiring and Parsing Sysdiagnose Log Archives from iOS Devices in AXIOM
When full file system acquisitions are not available for iOS devices, several key artifacts will be missed from examinations. In order to obtain several of these key pieces for investigation, examiners should understand how to capture log files from the device as well as techniques to extract and analyze them. This presentation will discuss ways … Continued
Loading iOS Full File System Images from GrayKey and Cellebrite into Magnet AXIOM
In this how-to document, we share how you can get images containing the entire file system of iOS devices with GrayKey and analyze that data with AXIOM.
Mobile Artifact Comparison – Understanding the Similarities Between iOS and Android Data
Ever curious about what the equivalent of KnowledgeC on iOS is to Android? Does Android have a Live Photo feature and where would I find that data? Does iOS have a Takeout equivalent? Join Jessica Hyde, Director of Forensics, and Christopher Vance, Manager of Curriculum Development, as they compare the artifacts between Android and iOS. … Continued