Our recommendations for you--
so we just looked at contacts, call logs, SMS, EXIF, location,
and browser history--
simple things that everyone should
have on their Android devices.
Start with your tools.
What are they providing to you?
What clues are they giving you?
But remember, it's not the tool failing or doing
a terrible job.
The tool is simply taking the Android,
grabbing all of the data, and saying, here you go.
You need to do the examination.
You need to be smart behind that keyboard and understand,
did the user put this there?
Did the device put this there?
Check the installed applications.
Examine browser artifacts.
Don't be afraid to just follow the source, go to the table,
and make sure everything is parsed.
Treat locations wisely.
Leverage the cheat sheet that I provided to you
that's in your Dropbox.
Understand, what can you trust, and what do you
have to validate?
This is where you have to take the time
to do a proper triage to say, OK, these artifacts now
require my attention.
And then you're going to deep dive.
Keyword search thoroughly.
Keyword search in hex, in Physical Analyzer.
Make sure you're keyword searching in content
or looking inside of the tables.
Remember, you can do a hex search inside
of each table of interest.
You can export those.
You can write your queries.
Do not overlook the SD card or Media directory.
It is your job to make sure you understand
how to carve in your tools, keyword search in your tools,
and properly manipulate databases.
If you cannot do that, choose another tool,
or keep practicing.