As a reminder, your tools are not
going to be created equally.
There is not a "one size fits all" for these devices.
You may find that one tool is really, really
good at acquiring data from iPhones,
but then another one seems to work a little bit better
at Android.
You may find that you have great success with iTunes,
doing an encrypted iTunes backup versus using
a commercial tool of choice.
Every tool is going to be different.
You do not have to use more than one tool for analysis--
or, sorry, you do not have to use more than one tool
for extraction.
You do for analysis.
For extraction, if you get extracted data,
you verify it's what you expect, you
can do analysis in more than one tool.
Now, there is a community project
that SANS actually sponsored.
And I was the lead behind it.
And I reached out to 13 people in the community
that I deem as smartphone experts.
And I asked them, would they work with me
to quickly write a document called "Six Steps to Successful
Mobile Validation"?
We had all of the vendors read it, provide input, and put
their stamp of approval on it.
So you'll see the logos.
SANS hosts this in the SANS Reading Room.
You will find links to it in the books
several times throughout this course.
There was also two recorded webinars on it.
The first one was that Techno Security
in Myrtle Beach in 2001.
And the second one was at the SANS DFIR summit in 2001.
So what we did is, we broke down the first three steps,
which are on acquisition.
And it's really to protect you if you ever have to testify,
saying this is what the experts in the field recommend.
This is when I have to use more than one tool
and this is when I do not.
The second portion of that, so steps three through six,
are on analysis, and when you have to validate and go
through that.
This is something we also put through the DFIR peer review
process.
And you're going to hear me reference that.
What DFIR peer review is, it's a group of experts that
go through and peer review your research
and put a seal of approval on it, meaning,
it can be used in the courtroom.
It can be used in depositions.
It also means that the research you did is backed.
It relieves so much pressure when you
think of something like this.
So again, the links in the book are
going to refer to different things that
have been through DFIR peer review, community efforts
like this "Six Simple Steps of Successful Mobile Validation."
That's a mouthful to say.
And these community projects are always ongoing.
If this is something that's of interest to you,
again, reach out to Lee and let us know,
and we will likely involve you in this research.
Know what your tools are doing.
This bottom bullet right here.
Bootloaders, jailbreaks, and roots.
When I started using Cellebrite, I
think, 12 years ago, there used to be
this amazing document called "What Happens
When You Press the Button?"
It kind of went away.
So together with Ian Wiffen and Paul Laurence,
who I work with at Cellebrite, we recreated that document.
And I think it is going to be released soon.
We are also doing a webinar for it,
and I think we're calling it "Preparing for Court."
But it literally walks through, if you do a full file system
checkmate extraction on an iPhone, what does it mean?
If you run a chat capture against an Android,
what does that mean?
What's the difference in terminology
of parsing versus decoding?
What are all of full file system, versus file system,
versus smart EDB?
All this terminology can be really confusing.
Leverage with the vendors put out to assist you.
If you go to Magnet's website, you're going to find tons
of blogs-- and you'll see this in the course as well--
with Oxygen, ElcomSoft.
ElcomSoft has a fantastic blog.
If you do not follow it, you really should.
They do great work, and they're always releasing
things in the community.
So keep in mind, leverage what your vendor tells you,
but always, always test and validate.