Download presentation
Presentation is loading. Please wait.
Published byKatrina Briggs Modified over 9 years ago
1
How the heck do they know that? The state of Computer and Cell Phone Forensics Ralph Gorgal, G-C Partners, LLC David Cowen, G-C Partners, LLC Ralph Gorgal, G-C Partners, LLC David Cowen, G-C Partners, LLC
2
Who the heck are you? Author of Hacking Exposed: Computer Forensics (1 st – 3 rd editions) Author of Infosec Pro Guide to Computer Forensics Co-Author of Anti Hacker Toolkit 3 rd Edition Expert Witness in Computer Forensics Captain of the National Collegiate Cyber Defense Competition Redteam Developer of Triforce ANJP Author of Hacking Exposed: Computer Forensics (1 st – 3 rd editions) Author of Infosec Pro Guide to Computer Forensics Co-Author of Anti Hacker Toolkit 3 rd Edition Expert Witness in Computer Forensics Captain of the National Collegiate Cyber Defense Competition Redteam Developer of Triforce ANJP
3
What the heck are we talking about? Computers and cell phones The state of smart phones as computers Standard Forensics on phones Recovery of deleted data The Cloud Device Specific data sources Computers and cell phones The state of smart phones as computers Standard Forensics on phones Recovery of deleted data The Cloud Device Specific data sources
4
Ask Questions! As we go ask questions, this talk is for you.. I already know this stuff
5
Cell phones as computers Smart phones have more processing power than your first computer Smart phones have their own operating systems Manufacturers control who gets to be the administrator of the OS Forensic examiners work within their confines, unless they can break out jail Smart phones have more processing power than your first computer Smart phones have their own operating systems Manufacturers control who gets to be the administrator of the OS Forensic examiners work within their confines, unless they can break out jail
6
Standard Forensics on Cell Phones Logical Extraction Support by almost every manufacturer Same function as a standard backup Physical Extraction Requires a ‘jailbreak’ or some other bypass technique Allows full access to the underlying device Logical Extraction Support by almost every manufacturer Same function as a standard backup Physical Extraction Requires a ‘jailbreak’ or some other bypass technique Allows full access to the underlying device
7
Recovery of Deleted Data Deleted database records (Logical and Physical) Deleted Files (Physical) Old Backups, we talk more about this later Deleted database records (Logical and Physical) Deleted Files (Physical) Old Backups, we talk more about this later
8
Advanced Recovery Techniques JTAG Chip Off MicroRead JTAG Chip Off MicroRead
9
Cloud Storage iCloud, OneDrive, Google Drive its all in the cloud Cloud Storage Cloud Backups iCloud, OneDrive, Google Drive its all in the cloud Cloud Storage Cloud Backups
10
Computer and Cell Phone interaction Data Transfer Backups Data Transfer Backups
11
iPhone iTunes Backups Data Transfer iCloud Generational Backups Data Transfer iTunes Backups Data Transfer iCloud Generational Backups Data Transfer
12
Android Google Drive Backups Data Transfer History Sync User data Data from all other Google connected devices Google Drive Backups Data Transfer History Sync User data Data from all other Google connected devices
13
Windows Phone OneDrive Backup Encryption Keys Data Transfer Search History Desktop sync OneDrive Backup Encryption Keys Data Transfer Search History Desktop sync
14
Blackberry Blackberry Desktop Manager Backups Data Transfer Blackberry Desktop Manager Backups Data Transfer
15
Questions? Email: dcowen@g-cpartners.comdcowen@g-cpartners.com Twitter: @hecfblog Blog: www.learndfir.comwww.learndfir.com Email: dcowen@g-cpartners.comdcowen@g-cpartners.com Twitter: @hecfblog Blog: www.learndfir.comwww.learndfir.com
Similar presentations
© 2025 SlidePlayer.com. Inc.
All rights reserved.