1. How the heck do they know that? The state of Computer and Cell Phone Forensics Ralph Gorgal, G-C Partners, LLC David Cowen, G-C Partners, LLC Ralph Gorgal, G-C Partners, LLC David Cowen, G-C Partners, LLC

2. Who the heck are you?  Author of Hacking Exposed: Computer Forensics (1 st – 3 rd editions)  Author of Infosec Pro Guide to Computer Forensics  Co-Author of Anti Hacker Toolkit 3 rd Edition  Expert Witness in Computer Forensics  Captain of the National Collegiate Cyber Defense Competition Redteam  Developer of Triforce ANJP  Author of Hacking Exposed: Computer Forensics (1 st – 3 rd editions)  Author of Infosec Pro Guide to Computer Forensics  Co-Author of Anti Hacker Toolkit 3 rd Edition  Expert Witness in Computer Forensics  Captain of the National Collegiate Cyber Defense Competition Redteam  Developer of Triforce ANJP

3. What the heck are we talking about?  Computers and cell phones  The state of smart phones as computers  Standard Forensics on phones  Recovery of deleted data  The Cloud  Device Specific data sources  Computers and cell phones  The state of smart phones as computers  Standard Forensics on phones  Recovery of deleted data  The Cloud  Device Specific data sources

4. Ask Questions!  As we go ask questions, this talk is for you.. I already know this stuff

5. Cell phones as computers  Smart phones have more processing power than your first computer  Smart phones have their own operating systems  Manufacturers control who gets to be the administrator of the OS  Forensic examiners work within their confines, unless they can break out jail  Smart phones have more processing power than your first computer  Smart phones have their own operating systems  Manufacturers control who gets to be the administrator of the OS  Forensic examiners work within their confines, unless they can break out jail

6. Standard Forensics on Cell Phones  Logical Extraction  Support by almost every manufacturer  Same function as a standard backup  Physical Extraction  Requires a ‘jailbreak’ or some other bypass technique  Allows full access to the underlying device  Logical Extraction  Support by almost every manufacturer  Same function as a standard backup  Physical Extraction  Requires a ‘jailbreak’ or some other bypass technique  Allows full access to the underlying device

7. Recovery of Deleted Data  Deleted database records (Logical and Physical)  Deleted Files (Physical)  Old Backups, we talk more about this later  Deleted database records (Logical and Physical)  Deleted Files (Physical)  Old Backups, we talk more about this later

8. Advanced Recovery Techniques  JTAG  Chip Off  MicroRead  JTAG  Chip Off  MicroRead

9. Cloud Storage  iCloud, OneDrive, Google Drive its all in the cloud  Cloud Storage  Cloud Backups  iCloud, OneDrive, Google Drive its all in the cloud  Cloud Storage  Cloud Backups

10. Computer and Cell Phone interaction  Data Transfer  Backups  Data Transfer  Backups

11. iPhone  iTunes  Backups  Data Transfer  iCloud  Generational Backups  Data Transfer  iTunes  Backups  Data Transfer  iCloud  Generational Backups  Data Transfer

12. Android  Google Drive  Backups  Data Transfer  History Sync  User data  Data from all other Google connected devices  Google Drive  Backups  Data Transfer  History Sync  User data  Data from all other Google connected devices

13. Windows Phone  OneDrive  Backup  Encryption Keys  Data Transfer  Search History  Desktop sync  OneDrive  Backup  Encryption Keys  Data Transfer  Search History  Desktop sync

14. Blackberry  Blackberry Desktop Manager  Backups  Data Transfer  Blackberry Desktop Manager  Backups  Data Transfer

15. Questions?  Email: dcowen@g-cpartners.comdcowen@g-cpartners.com  Twitter: @hecfblog  Blog: www.learndfir.comwww.learndfir.com  Email: dcowen@g-cpartners.comdcowen@g-cpartners.com  Twitter: @hecfblog  Blog: www.learndfir.comwww.learndfir.com