Here, we're looking at an Android device.
You can see it's an Android SD card.
What is interesting about this?
Now, this is where I want you to dig down and say, OK,
what is interesting?
First things first.
I'm in FTK Imager.
This is a free tool that you can use to glance at the file
system.
You can't keyword search.
There are several restrictions.
But it is great for learning if the device is encrypted
or how to interact with it.
A red X means marked for deletion.
It does not mean overwritten.
So the first thing I want to look at here is are these red
X's.
Down here, I'm on this !OSMS.
When we look over here, we can see
all of these pictures marked for deletion.
Just because they're marked for deletion
doesn't mean you can't see them.
However, if your phone thinks they're deleted
and it broke that link for that app, when
I looked at this on my Android, I could not see these pictures.
Another reason to acquire it outside of the device
and make sure you get everything so nothing is hidden to you.
Something else that's interesting.
And this will really play into Section 6
should you choose to do the CTF.
Other devices.
Do you notice that BlackBerry directory there?
This SD card was actually in a BlackBerry.
I am guilty of owning a BlackBerry back in the day.
This SD card was in my BlackBerry.
When I took it out of my BlackBerry
and put it into the Android, the Android
told me that it was going to reformat that SD card
and I would lose all information.
I said, OK.
I never realized it was there until years
later, when I took this SD card and acquired it
outside of a device.
So BlackBerry-- I would say, hey, Heather,
where's the BlackBerry?
Can I examine that?
Now, keep looking down here.
We see .trashes and .fseventsd.
What is that?
A Mac.
This SD card was also put in a Mac.
So if you're doing a forensic investigation
at this point on this Android, you should say,
the user had a BlackBerry.
I'm going to need that.
And the user had a Mac.
Why are they taking stuff out of this device from this Android
and plugging it into a Mac?
It could be relevant.
So make sure you look for pieces that will lead you down a path
to further your investigation.