When you do smartphone forensics for a while,
you are going to get frustrated.
If you have not been frustrated yet,
it's because you have not done this
for probably a week or longer.
You're going to find that these devices come
in different makes, models.
The operating system can change everything.
So if you have Android 11 versus Android 12,
could make drastic differences.
If you have iOS 13 versus 15, huge differences--
not only in where the data is stored, but also in,
what are your acquisition options?
There is not going to be one tool that's going
to work perfectly, at all.
I often have people reach out to me
and say, Heather, what do you prefer?
My preference will be shown throughout this course.
And you will see, I will tell you hurdles
that I have hit, how I've cleared them,
and things that worked.
Keep in mind, these devices are constantly
changing when they are powered on.
Something else that you're going to find
is, best practices always tell us isolate from the network.
Enable airplane mode.
Make sure there's no Wi-Fi connection.
Make sure that there is no hot spots it's going to hit.
However, disabling data from the network
could prevent you from getting all of the application data
that exists on that device.
So this is where you have to use caution during acquisition.
You have to educate yourself and your tools of choice
on how they work.
At Cellebrite, I do a lot of Tip Tuesdays, and blogs,
and Ask the Expert, on how to specifically
use Cellebrite tools correctly to extract the most
information.
I've done keynotes for Magnet where
I talked to many users saying, this
is how to get the most information from these tools.
Make sure you watch those and leverage those.
Keep in mind, for actual phones, you cannot write-block them.
If you write-block them, you will not
get a forensic acquisition.
The phone must be able to talk to your forensic workstation
or forensic tool.
It is a two-way communication.
And keep in mind, every contact leaves a trace.
So be very careful with this.
When you collect the data, make sure you
follow the rules of your lab.
If you remove the SIM card, you could actually take that device
and take it from a hot state and place it into a cold.
And I'm going to talk about hot and cold here in a moment.
If you remove the SD card, is it going to change anything?
What if that SD card's encrypted?
You have to put it back into the phone.
I strongly recommend, when a handset arrives to you,
you acquire it as quickly as possible and in the state
it's in before you remove the SD or remove the SIM.
Do you not power a phone down unless you
know the implications of this.
And this is going to be covered in a slide coming up.
But what is so important-- is the device hot or cold?
This terminology is on your poster.
And there's a little description of how
to handle hot and cold devices.
And I want to thank Cellebrite for giving that
to us to put on that poster.
When you think of hot, think of a hot potato.
You may have played this game when you were a child.
And it's literally burning your hands, and it's--
a hot device means it is in a fantastic state for you
to acquire it.
If you have a biometric unlock, meaning
the person can look at it and unlock it,
or use their fingerprint, their iris,
whatever is unlocking these devices--
face scans-- the password is running in memory.
The device is really acquirable in that state.
Now, if the person turns off their device,
or if you guess the password too many times,
or you remove the SIM card, your device is cold.
Think of cold as on ice.
It could sit there for a while, and nothing's going to change.
This is terrible, but think of a cadaver.
It's in the morgue.
It's not changing.
It's in a state that, it could sit there for a period of time
and it's not going to impact your forensic investigation.
The worst thing you can do is take a hot device
and make it cold.
That's very bad.
Here's where people make mistakes.
You look at the iPhone.
You look at the Android.
If you looked at it, how do I know
that three other police officers and examiners haven't
looked at it?
You get so many attempts at biometric
before it takes it from hot and puts it to cold.
A simple thing of, if this is a phone looking at it,
you're like, oh, no, it recognized my face, some people
put tape over the cameras to prevent that from happening.
Be very, very careful.
A reboot will take any hot device and make it cold.
Something you're going to see during acquisition
is, some of the screens specifically for Android
will say this.
Acquisition will reboot the device.
Are you OK with that?
Most people click yes.
They don't think about it.
You will think about it harshly when
your hot device becomes cold.
Hot means it is in its best state for acquisition.
It is ready to go.
You need to acquire that as quickly as possible.
Cold, you are where you are.
Turning the device off--
you are going to possibly need to brute force passcodes.
That is not our favorite state for these devices to be in,
but it's terminology you need to become familiar with.