Deep Diving for Forensic Gold - Applications and Deleted Data
Author: ForensicFocus.com
590 View
0m 0s Lenght
3 Rating
Presenter: Lee Reiber, COO at Oxygen Forensics Several years ago, forensic software manufacturers prided themselves on the amount of device profiles they supported. Nowadays what really matters is the amount of supported applications. Beyond all doubt, all the vital evidence is stored in apps: contacts, group and private chats, plans, geo coordinates, cache and much more. But it is not enough to parse apps databases: in many cases you need to decrypt and retrieve securely stored data in apps, like Whatsapp, Snapchat, Telegram, etc. Moreover, the situation with apps is constantly changing: popular apps are updated almost every week and forensic software manufacturers have to catch up with it adding support for newer versions. A variety of supported applications also matters: criminals prefer to choose unknown apps to communicate which is why support for popular apps is not enough.