Terminology matters.
You are going to hear the terms shown on this slide many times.
And I want to make sure I explain them
to you as frequently as I can.
When it comes to Android versus iPhone,
there are differences in terminology
and what will be your best acquisition.
So let's start from the bottom.
When we look at physical acquisition,
if you've done mobile forensics for a while,
we have been trained that physical acquisition is
supposed to be the very best.
It may obtain data from that first
to the last bit on that device.
Now, do you notice how "may" is in italics there?
Because we can't control all different situations.
We can't control all of the methods of acquisition.
Physical acquisition is kind of a dying
trend, which is unfortunate.
For modern Android and iOS devices,
we can no longer get a physical acquisition of these,
depending on the level of encryption on the device.
And on each section that pertains to Android and iOS,
I will tell you why.
But something you have to consider.
If you have an Android device and you've
got a physical acquisition of it,
you'd better open that extraction
to make sure the data is not encrypted.
If you do not do this, this could
be a fatal mistake for you.
If you only get the physical acquisition and everything
worked but all of the data is encrypted,
and then you give it to an investigator or examiner
to do analysis, there's no going back.
Because, remember, decryption happens on the device or not
at all.
Full file system.
This is typically the best acquisition
we can get on most Android and iOS devices.
It is going to give us access to the most application
data that is otherwise protected by that device.
And again, as this course goes on,
this will make more sense to you.
For some full file system access,
you're going to have to use tools
like GrayKey or Cellebrite Premium
or send it in to CAS, the Cellebrite Advanced Services
lab, to get access.
That is not always the case.
And I'm going to teach you tips and tricks in Section 2
and Section 3 on how to get the best acquisition.
Advanced Logical or file system is not
to be confused with full file system.
This is completely different.
You may find where a file system acquisition is simply
a backup of an Android or a backup of an iPhone.
So really, if you think about this,
when you look at file system, some people
are like, wait a second.
If it's just the backup, couldn't I
have done that for free?
Yes, you could.
And I'm going to teach you how so you understand
what this looks like.
Logical.
Logical is something I typically do not leverage,
with exception of Android.
When we talked about the terminology on GSM and CDMA,
you may find that a full file system acquisition cannot
acquire that data.
And that's where people are like, wait a second.
You just said that's the best acquisition.
I did.
Android's weird.
Android is difficult. Also, when you
look at all of these ones I've already talked about,
I did not mention SIM card or SD card.
Do not assume they are going to be acquired.
Manual examination can be your friend.
And I will show you hints on this.
Let's say you have a device and you're like, where
are all of the call logs?
Why did my extraction not get the call logs?
Look on the phone.
Click on the phone icon.
If there are no call logs, the user deleted them.
If there are call logs, something
is wrong with your extraction.
What about secure applications?
Section 5 of this course, all we talk about
are secure apps and all of the scary things that apps
do in the background that help us forensically
that are terrifying as users.
But what happens if you don't see something
in your extraction?
You can always do manual examination
of that device to verify.
Now, if you were doing manual examination of a device--
I worked an investigation once-- it was a sexual assault
investigation--
where my tool was not capturing the text messages.
And I just scrolled through that phone
and take pictures of every screen.
It's awful.
I will try to teach you tricks on each section
to avoid doing that.
But you may find that if you have an Android,
you're going to have to do multiple extractions.
If you have an iOS device and you get full file system,
that is typically good enough, with the exception
of some bonus hints that we throw in
there to get you additional log files that
may aid in your investigation.