- iOS 17- The “Forever” Setting That Isn’t… Or Is It? (8/7/2024) - When I teach SANS FOR585 Smartphone Forensic Analysis In-Depth, we really dive into iOS artifacts to validate the truth of what happened, what tools are reporting, and what they are missing. Message retention is often needed to help examiners understand why data no longer exists on the iOS device if the user didn’t delete it. … Continue reading iOS 17- The “Forever” Setting That Isn’t… Or Is It? →
- Android and iOS acquisition Recommendations (12/30/2021) - I have been meaning to update this blog for years, so here goes. This blog is going to cover what I recommend to get the most data from iOS and Android devices. Many tools exist to successfully extract data from mobile devices and I am sharing some of my favorite methods that have proven to … Continue reading Android and iOS acquisition Recommendations →
- Forensic 4:Cast Awards – nominations are open (3/17/2021) - It’s that time of year again – the Forensic 4:Cast awards season and nominations are open. Last year I won 4 awards and my team won an additional 2! It was mind blowing and humbling. Thank you again if you voted for me. I have taken the time to think over the last two weeks … Continue reading Forensic 4:Cast Awards – nominations are open →
- Rotten to the Core? Nah, iOS14 is Mostly Sweet (9/18/2020) - By Heather Mahalik This blog is a cursory glance of iOS14, which was officially released this week. To keep with my previous trends, I focus on basic artifacts that impact almost every investigation and then dive in and take a bite from the apple. Think of this blog as the bobbing part. 😊 For this … Continue reading Rotten to the Core? Nah, iOS14 is Mostly Sweet →
- Using Photos.sqlite to show the relationships between photos and the application they were created with? By Scott Koenig (8/25/2020) - First, I would like to thank Heather Mahalik for her help with this process and for allowing me to post something on her blog. It’s an honor! Additionally, thanks to Jared Barnhart for his assistance with research and with testing. I must apologize if you have already taken the time to read through this blog. … Continue reading Using Photos.sqlite to show the relationships between photos and the application they were created with? By Scott Koenig →
It's time to get SMARTER!