When it comes to smartphone considerations, most of us
have at least a smartphone.
Many of us have tablets.
There are a few people in the world
that still have a flip phone.
I recently had a student in forensics 500
who posted a picture on our Slack
channel of his flip phone, because I did not believe it.
These people still do exist.
I still have friends that have really old iPhones,
like the iPhone 4S.
You can do amazing things with that data.
But what we need to think about is, are smartphones
replacing computers?
How do smartphones sync with computers?
How does the data differ?
If you come across my iPhone, I can tell you
if I had a choice of giving you my Mac I'm
teaching from right now or my iPhone,
I'm going to give you my Mac.
I do keynotes at RSA, and I polled the 5,000 to 10,000
people in the audience wants to raise their hand
on if someone was going to steal your wallet
or steal your smartphone, which would you prefer?
And then I asked them to consider,
what if your smartphone didn't have a lock on it?
We are so tied to these devices.
They are the most personal that we own.
My smartphone has everything.
It's always with you, if you think about it.
Most of us sleep with them by our bedside.
Most of us eat with them.
We take them everywhere we are.
They are extremely personal devices.
We need to think about what our tools are going to support.
First, how are you going to acquire the data, to get it?
In each lab, I try to remind you how that data was acquired.
Some of it's really clear.
And you'll see that it has a UFD file,
so you know it was Cellebrite UFED that did the acquisition.
For some of the cloud acquisitions,
I will talk you through my methodology for acquiring it
and why I chose that method.
We need to think about all of these things.
Is your tool going to support your acquisition?
And more importantly, how far can your smartphone tool
get you in the analysis?