It's time to get SMARTER!
Now that Netflix has aired, the questions and media requests are flowing in. Here are the ones I hear most: 1. Why did we get this case?2. Did we find his motive?3. Will we be called back again if he gets a trial?4. Did Netflix pay us, and how much did we make on the … Continue reading The Idaho Murders: Remembering Kaylee, Xana, Maddie, and Ethan →
When I teach SANS FOR585 Smartphone Forensic Analysis In-Depth, we really dive into iOS artifacts to validate the truth of what happened, what tools are reporting, and what they are missing. Message retention is often needed to help examiners understand why data no longer exists on the iOS device if the user didn’t delete it. … Continue reading iOS 17- The “Forever” Setting That Isn’t… Or Is It? →
I have been meaning to update this blog for years, so here goes. This blog is going to cover what I recommend to get the most data from iOS and Android devices. Many tools exist to successfully extract data from mobile devices and I am sharing some of my favorite methods that have proven to … Continue reading Android and iOS acquisition Recommendations →
It’s that time of year again – the Forensic 4:Cast awards season and nominations are open. Last year I won 4 awards and my team won an additional 2! It was mind blowing and humbling. Thank you again if you voted for me. I have taken the time to think over the last two weeks … Continue reading Forensic 4:Cast Awards – nominations are open →
By Heather Mahalik This blog is a cursory glance of iOS14, which was officially released this week. To keep with my previous trends, I focus on basic artifacts that impact almost every investigation and then dive in and take a bite from the apple. Think of this blog as the bobbing part. 😊 For this … Continue reading Rotten to the Core? Nah, iOS14 is Mostly Sweet →
First, I would like to thank Heather Mahalik for her help with this process and for allowing me to post something on her blog. It’s an honor! Additionally, thanks to Jared Barnhart for his assistance with research and with testing. I must apologize if you have already taken the time to read through this blog. … Continue reading Using Photos.sqlite to show the relationships between photos and the…
First, thank you to everyone for humoring me and submitting jokes. If we cannot laugh at ourselves, we are way too serious. Here are some of my favorites from the DFIR Summit. On a positive note – always try to find the humor in the situation. Especially with all that 2020 has thrown our way. … Continue reading DFIRSummit Laugh Track →
Most important – Sign up here: https://t.co/MqW8jmiCv6?amp=1 Working from home, social-distancing, travel restrictions, and homeschooling all related to COVID-19 have changed our lives. The new normal is not always fun, to be honest. This is why “Life Has No Ctrl+Alt+Del” was created. I wanted a forum where we could casually get together, but also include … Continue reading “Life Has no…
I have been meaning to get this out for a bit, so here it is. Something has been keeping me busy – you know kids, work, SANS and being all in the same place together 24 hours a day. 🙂 The forensic 4Cast awards by Lee Whitfield have really become quite a “thing” for many. … Continue reading 2020 Forensic 4Cast Nominations are open! →
For those of you who don’t have time to read for585.com/ios13, here is a mini summary for you. First – If the backup is NOT encrypted you will not get: Maps Calls Safari Health Keychain Wallet Apple has upped their game on protection it seems, so you need to encrypt to extract. I used iTunes … Continue reading iOS 13 – Summary for those of you who enjoy the cliffsnotes →