Knowing DUT memory

A newcomer to mobile phone examination asked a question on another forum: "My first question is a general one: how can I know that the data I get in an extraction is everything that was on the device? For example, I recently acquired an image from a ZTE Z667G with prior knowledge that there were messages between 2 subjects using Facebook Messenger. The device was not able to be rooted with

Comments

Post a Comment

Popular posts from this blog

BREXIT Draft Agreement

Draft Agreement on the withdrawal ofthe United Kingdom of Great Britainand Northern Ireland from theEuropean Union and the EuropeanAtomic Energy Community14 November 2018 This post is not for political viewpoint nor is it to encourage or solicit political opinions or debate. For those who are involved in evidence, forensic examinations and/or investigations, if you wish to read the text in the
Read more

URN Namespace and IMEI

RFC8141 - A Uniform Resource Name (URN) is a Uniform Resource Identifier (URI) [ RFC3986] that is assigned under the "urn" URI scheme and a particular URN namespace, with the intent that the URN will be a persistent, location-independent resource identifier. A URN namespace is a collection of such URNs, each of which is (1) unique, (2) assigned in a consistent and managed way, and (3) assigned
Read more

Update - HERREVAD Databases Geo Location Artefacts

Back in February 2017 I wrote an article relevant to "HERREVAD Databases Geo Location Artefacts" (http://trewmte.blogspot.com/2017/02/herrevad-databases-geo-location.html) and I regularly conduct searches for any useful updates or supporting information that maybe of use. ----- I see SANS DFIR in May 2018 published "Advanced Smartphone Forensics Poster - SANS Forensics" a poster to identify "
Read more