Knowing DUT memory

A newcomer to mobile phone examination asked a question on another forum: "My first question is a general one: how can I know that the data I get in an extraction is everything that was on the device? For example, I recently acquired an image from a ZTE Z667G with prior knowledge that there were messages between 2 subjects using Facebook Messenger. The device was not able to be rooted with

Comments

Post a Comment

Popular posts from this blog

IM Telegram Replay Attack - Android

Hopefully, readers will have had the opportunity and time to read about WhatsApp here at the trewmte.blogspot: WhatsApp network forensics - http://trewmte.blogspot.co.uk/2017/06/whatsapp-network-forensics.htmlWhisper Signal WhatsApp - http://trewmte.blogspot.co.uk/2017/06/whisper-signal-whatsapp.html So it's time to move on to the next instant messaging app known as Telegram. It is relevant to
Read more

Appeal case - Boardman - phone evidence/cell site

The serving of evidence and arbitrarily what should be served or should be not served is highlighted in this Appeal case. It is noted the Appeal Court dealt with issues surrounding making burdensome requests for evidence from the police. I suspect the comments of the Appeal Court could be misconstrued meaning there is a potential for further hearings as to relevance of evidence. The Appeal Court
Read more

WhatsApp network forensics

With many companies allowing employees to use their own smartphones in the workplace it has been noted confidential information maybe being unwitting leaked as users take to using their smartphone cameras to take photos of Whiteboard content, potentially risking disclosure (mentioned by the Information Security Community). Smartphones can also scan data, reducing the need for organisation to
Read more