There is some terminology here that I
want to make sure I clear up.
The first is garbage collection.
You can see, here we have the 585 trash truck
coming through and cleaning up.
What garbage collection does is, if you think back
to that solid state slide where I talked
about that blue chunk moving around,
garbage collection does not wait for all of those pages
to be marked ready for deletion before it clears it.
So garbage collection could go in, let's say, once an hour,
once a week, and go through and say, you know what?
I'm going to clean up.
I'm going to overwrite those pages that
are no longer in use.
This protects your user privacy.
This, unfortunately, does not help us forensically.
Now, some of you may say, yes, that's very helpful
because it's fewer things that I have to manually uncover.
It is cleaning up on the go.
Garbage collection happens across the entire device.
Now, this is very important.
Android introduced garbage collection,
I think, with the Samsung Galaxy S3-- so many, many moons ago.
Apple does not use garbage collection
across the entire iPhone.
Now, someone like me-- and I am a Mac user.
I have an iPhone.
I have a watch.
I buy into Apple.
I love Apple products.
I think that garbage collection doesn't
happen across the entire device because we've run out of space.
Now, that's just my personal opinion.
As you run out of space, what do you do?
You buy bigger.
You get more space.
You pay for more.
So remember, garbage collection on an Apple device,
the entire device, is going to wait for all of those pages
to be marked for deletion before it clears it.
Garbage collection will run on an Android periodically.
Now, where this is different--
some people think, oh, my gosh, what about my text messages?
What about my call logs?
What about my apps?
Both Apple and Android will do something
called database vacuuming.
Vacuuming happens on a container.
So this is completely different than garbage collection.
You could have Facebook that vacuums
its database every hour.
You could have Whatsapp that does it every time the user
closes the application.
You could have some that happens weekly,
or every time you sync to cloud.
Every single application is going to be different.
Now, how I want you to think about this--
garbage collection is the entire device.
So think about throwing out your devices.
It's going through and cleaning everything.
Vacuuming is happening in small rooms or containers.
Think of that.
It's a database.
You're not going to vacuum an entire house in five seconds.
Garbage collection would do that.
Vacuuming is specific to application containers,
specifically, databases.
So make sure you do not confuse that terminology.
I hear it confused all the time, where people say,
garbage collection happened on Facebook.
No, vacuuming happened on the Orca DB,
which stores Facebook information, or FB Sync Store.
So database-- vacuuming.
And this is also why, if you go and you
look for deleted text messages on iPhone,
you're like, where are they?
Depending on how quickly you respond,
vacuuming may have taken place.
And I have a fantastic example and student scenario
that I'm going to share with you in Section 3
to show you what this really looks like.