Every contact leaves a trace.
This is the actual Latin phrase that's
on the coin for this course.
Now, what I want you to think about is not only the user
interacting with their phone, but you
interacting with that device.
Every single thing we do leaves a trace
on a log somewhere on that Android or iPhone.
This is very, very important that you think about this.
If you're doing covert operations,
you're going to find little tidbits in this course
where I'm speaking to you, and you
will realize that I'm speaking to you when I say, hey,
use caution here if you do covert operations.
Keep in mind, every single thing you do leaves a trace.
So if someone is flying through an airport,
and you get their phone, and you're doing things covertly,
and it's powered off and you power it on,
you've left a trace.
If you plug it into your forensic workstation,
you've left another trace.
Now, what you have to think about
is, if someone does counter-forensics
on that device, how much smarter are than you
when it comes to uncovering these artifacts?
What type of acquisition can they
get to uncover these artifacts?
So when you're doing the labs, think about it
from the flip side.
What type of trace did I leave behind during my acquisition
that you can uncover?
In Section 1, at the end of the section, one of the questions
is, was the device rooted prior to acquisition?
Some people are like, why do I care?
You care for multiple reasons.
One, if you have a rooted Android,
you can get a full physical acquisition of that.
And I'm going to talk about what this means.
Two, what if a forensic tool did that, and someone's
doing counter-forensics on you, and now they know
that you rooted that device?
Why would you do that?
Key things to keep in mind.
It is very difficult for a user to remove all traces.
In Section 4, we're going to talk
about what that looks like.
When the user is trying to cover traces,
what does that actually look like
from a forensic perspective?
What does it look like when the phone simply does clean up?
That is one of the hardest things.
When the phone goes through and cleans up
the device for user privacy or user efficiency,
what does that look like for you?
All of these things are going to be covered.
But keep in mind, it is almost impossible--
almost impossible-- with current devices, to halt time,
to turn everything off and still get the most access
to the applications and data that exists on these phones.