Same features as Beta 2, but faster and the bugs are fixed! I hope you enjoy the Android Analyzer. If you want to hear more about Android Analyzer come to one of my talks:
#HTCIACon – Wed, August 27th at 12:15
#OSDFCon – Basis Tech Conference Nov 5th
SANS @Night – Prague and Las Vegas (Sept and Oct)
http://www.sleuthkit.org/autopsy/download.php
Autopsy version 3.1.0 Beta 2 has been released. This version provides the same support as the first Beta, but corrected the UI responsiveness issues. Try out the new Android Analyzer module! What are your thoughts? What should be added next?
http://sourceforge.net/
Happy Tuesday everyone. I am happy to say that Practical Mobile Forensics is officially released. http://www.packtpub.com/practical-mobile-forensics/book
This book was written by three of us hoping to guide those new to mobile forensics and those looking to branch into mobile device forensics. We provide practical methods for acquiring and analyzing data from smartphones and place an emphasis on open source tools, where possible.
Speaking of open source, the latest version of Autopsy is available and can be downloaded here: http://sourceforge.net/projects/autopsy/files/autopsy/3.1.0%20Beta%201/. This is a beta version, so your feedback is greatly appreciated. Let me know what you think of the Android module. What is missing? Where should we focus our efforts?
DFIRCON EAST Smartphone Forensics Challenge: https://www.surveymonkey.com/s/Smartphone-Challenge
The smartphone dataset contains Malware and an iOS backup file. The goal is to highlight application data often missed by forensic tools. Your job? Find it.
The object of our challenge is simple: Download the smartphone dataset and attempt to answer the 6 questions. To successfully submit for the contest, all answers must be attempted. Each person that correctly answers 4 of the 6 questions will be entered into a drawing to win a FREE DFIR OnDemand course. The contest ends on September 30th, 2014 and we will announce the winner by October 6th 2014. Good luck!
Win a free DFIR OnDemand course by downloading the smartphone dataset and answering the following questions.
DOWNLOAD LINK FOR SMARTPHONE IMAGE: http://dfir.to/SmartPhoneChallengeZip14
To successfully submit for the contest. All answers must be attempted. Please include your name and email address.
The winner will be able to choose from the below DFIR OnDemand courses:
SEC504: Hacker Techniques, Exploits & Incident Handling
FOR408: Computer Forensic Investigations – Windows In-Depth
FOR508: Advanced Computer Forensic Analysis and Incident Response
FOR526: Memory Forensics In-Depth
FOR572: Advanced Network Forensics and Analysis
FOR585: Advanced Smartphone Forensics
FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques
SANS OnDemand:
SANS OnDemand is the world’s leading comprehensive online training for information security professionals. OnDemand offers more than 25 SANS courses whenever and wherever you want from your computer (Windows, Mac, and Linux), iPad or Android tablet. OnDemand allows you to learn at your own pace, spend extra time on complex principles, reinforce concepts with quizzes, and repeat lab exercises – all of which increases your retention of the course material.
Your course enrollment gives you printed course books, CD/DVDs/Toolkits for hands-on exercises (as applicable), four months of online access to our OnDemand e-learning platform featuring a top SANS instructor presenting the material, quizzes, and synchronized video demonstrations/interactive labs (as applicable).
The Smartphone Challenge is sponsored by DFIRCON East. To learn more about DFIRCON East, please visit http://www.sans.org/event/dfircon-east-2014
Rules:
1. Entry: Each participant may respond only once for the challenge. Contest begins on Monday, July 21st, 2014 and ends Tuesday, September 30th, 2014. Responses must be submitted by 9pm EST on September 30th.
2. Prize: Each person that correctly answers at least 4 of the 6 questions will be entered into a drawing to win a FREE DFIR OnDemand course. SANS will choose only one winner, the seat is transferable to another in the same organization/company and does not include a certification attempt. The winner will be chosen by October 6th, 2014 and will be notified by email.
Questions regarding the challenge? Please send to DFIR-Challenge “at” sans.org. (DFIR-Challenge@sans.org ).
If you missed the NIST Mobile Device Forensics Workshop a few weeks ago, you can find the presentations here: http://www.nist.gov/forensics/mobile_forensics2.cfm.
Make sure to read about Open Source Mobile Device Forensics using Autopsy and scripts developed by the community, presented by yours truly. Other great presentations were provided by Cindy Murphy on Mobile Malware and Shafik Punja on the state of BlackBerry Forensics. There are several presentations that are fit for those breaking into Mobile Device Forensics included in the link above. For your convenience, I have downloaded and included a few of my favorites in the Presentations Page on my site.
Hello everyone! I hope you are getting ready to celebrate and enjoy the extra day off this week and the 4th of July if you are in the USA.
Now that my book is done, I am left wondering what to do with my extra time (because what new mom doesn’t have plenty of extra time). I plan to focus on the latest version of Android and iOS 8, but what else is out there that needs to be answered? Are you wanting more information on one platform, an overall OS? What do you want to see more of in regards to manual decoding? What are your tools missing?
“Help me, help you!” Yep – Jerry Maguire quote for you on this lovely Thursday morning. Thoughts?
Getting the most out of Smartphone Forensic Exams –
SANS Advanced Smartphone Forensics Poster Release
There is one certain thing in the DFIR field, and that is that there are far more facts, details and artifacts to remember than can easily be retained in any forensic examiner’s brain. SANS has produced an incredibly helpful array of Posters and Cheat Sheets for DFIR in order to assist examiners with those tidbits of information than can help to jumpstart their forensics exams and or intrusion and incident response investigations. The most recent addition to the SANS DFIR poster collection is the Advanced Smartphone Forensics Poster, created by SANS FOR585 authors Heather Mahalik, Domenica Crognale, and Cindy Murphy.
These days, digital forensic investigations often rely on data extracted from smartphones, tablets and other mobile devices. Smartphones are the most personal computing device associated to any user, and therefore often provide the most relevant data per gigabyte examined in an investigation. The Advanced Smartphone Forensics Poster will guide you through the elements of the mobile forensic process so that the results of your examination will hold up under scrutiny.
The acquisition of Smartphone evidence can be complicated by the large assortment of device makes, models, and operating systems, with varying levels of acquisition support. The Smartphone Acquisition guide included in the poster will guide you through the intricacies of acquiring data from locked and unlocked phones for the major Smartphone platforms.
Once data is acquired, interpretation of that data can involve complexities such as data encryption and encoding, and relics of flash memory storage. The Advanced Smartphone Forensics Poster will help you to work through the basics of flash memory data layout, and various types of data encryption and encoding common to Smartphone data to help you get the most out of the acquired evidence.
Commercial tools have a difficult standard to live up to in regards to data decoding and don’t fully address the challenges of mobile malware detection and analysis. With all of the apps available, it’s nearly impossible to automate the process of decoding all of the relevant data. The Advanced Smartphone Forensics poster will help walk you through the basic steps of mobile malware detection and analysis, and provides you with common evidence locations for the major smartphone platforms to help you narrow down and efficiently identify data that is important to your investigation.
Use this poster as a handy reference guide to help you remember how to handle smartphones, where to obtain actionable intelligence, and how to recover and analyze data on the latest smartphones and tablets. Whether you’re new to smartphone forensics or you’re an experienced examiner, the SANS Advanced Smartphone Forensics Poster will help you get the most relevant evidence per gigabyte.
Click to access for585-poster.pdf
Cindy Murphy, SANS Instructor and Co-Author of FOR585