FOR585 - Advanced Smartphone Forensics
Focused View
15:36:41
177 View
- 1.Analysis SQLite
- 1.mp401:23
- 2. FOR585 Dedications.mp400:01
- 3. Lab 0.mp409:05
- 4. SANS DFIR.mp400:31
- 5.mp400:09
- 6.mp403:59
- 2. The SIFT Workstation
- 1. Android Backups.mp400:11
- 2. SIFT Forensic Workstation.mp402:44
- 3. Programs Installed.mp402:46
- 4. Tools Tools Tools.mp401:30
- 5. Keeping the Pace.mp402:01
- 6. Labs and Lecture.mp402:54
- 3. Smartphone Overview Acquisition Terms and Methodologies
- 1. Smartphone Overview Fundamentals of Analysis SQLite.mp401:36
- 2. Smartphones Considerations.mp401:29
- 3. The Basics.mp401:54
- 4. Solid State Flash Memory Properties.mp401:38
- 5. Wear Leveling Explained.mp401:22
- 6. Garbage Collection.mp402:02
- 7. Smartphone Forensics.mp401:47
- 8. Smartphone Handling.mp402:45
- 9. Collection of Smartphones as Evidence.mp401:29
- 10. Method 1 Always Off Rule for Smartphone Collection.mp402:33
- 11. Method 2 OnOff Rule for Smartphone Collection.mp400:09
- 12. Smartphone Component Consideration.mp402:30
- 13. SIM Card Identifiers.mp401:50
- 14. SD Cards Defined.mp401:13
- 15. SD Cards Analysis.mp400:49
- 16. Media Card Encryption.mp400:41
- 17. Smartphone Acquisition Terms.mp402:06
- 18. Not All Tools Are Equal Not All Smartphones Are Equal.mp402:17
- 19. Bootloader Extractions.mp401:58
- 20. Custom Recovery Image.mp400:26
- 21. EDL Emergency Download Mode.mp400:41
- 22. Jailbreaks and Exploits.mp402:32
- 23. Learn It Use It or Lose It.mp402:36
- 4. Cellebrite Physical Analyzer Fundamentals
- 1. Smartphone Overview Fundamentals of Analysis SQLite.mp400:41
- 2. Cellebrite Overview.mp402:36
- 3. Physical Analyzer Workspace Areas.mp416:20
- 4. Physical Analyzer Tools Menu.mp400:01
- 5. Physical Analyzer Installed Application Views.mp400:18
- 6. Physical Analyzer Browsing the File System.mp401:20
- 7. Physical Analyzer Key Features.mp401:15
- 8. Physical Analyzer Keyword Searching.mp400:58
- 9. Physical Analyzer Key Features 1.mp400:11
- 10. Physical Analyzer Key Features 2.mp400:05
- 11. Lab 11.mp406:35
- 5. AXIOM Fundamentals
- 1.mp400:17
- 2. Magnet AXIOM Overview.mp406:04
- 3. AXIOM Image Loaded.mp400:54
- 4. AXIOM ThirdParty Application Parsing.mp400:35
- 5. AXIOM Exploring the Views.mp401:58
- 6. AXIOM Key Features 1.mp400:47
- 7. AXIOM Key Features 2.mp408:04
- 6. SQLite Databases Overview
- 1.mp400:07
- 2. SQLite Databases What Are They and Why Phones Use Them.mp401:42
- 3. SQLite Temporary Files.mp401:04
- 4. SQLite Deletion.mp401:23
- 5. So How Did They Do That.mp401:47
- 6. Locate the Databases of Interest iOS.mp401:14
- 7. Locate the Databases of Interest Android.mp400:23
- 8. Information Overload.mp402:49
- 9. Basic Terminology SQLite Databases.mp401:41
- 10. SQLite Behind the Scenes.mp405:54
- 11. Narrow Down the Data Simple SQLite Query.mp400:43
- 12. Changing the Column Names.mp400:53
- 13. Accounting for Timestamps.mp401:38
- 14. Choosing the Correct Timestamp Conversion.mp402:32
- 15. Adding the Timestamp String to the Query.mp400:41
- 16. Why Is This So Important.mp401:22
- 17. Lab 13.mp408:54
- 7. Android Forensics Overview
- 1.mp400:14
- 2. Android Basics.mp402:04
- 3. Android File System Examples.mp401:59
- 4. Google and Remote Access.mp401:48
- 5. Android Updates and Considerations.mp402:10
- 6. Key Introductions The Most Prevalent OSs.mp402:48
- 7. FDE vs FBE.mp403:53
- 8. Secure Boot vs Secure Start Up.mp401:17
- 8. Android Backups
- 1.mp400:08
- 2. Android Backup Files.mp401:16
- 3. Android Backup Acquisition.mp401:12
- 4. Creating a Backup File Using UFED.mp402:06
- 5. adb Backup.mp400:54
- 6. Backup File Analysis Commercial Support.mp402:35
- 7. Lab 14.mp408:47
- 8. Course Resources and Contact Information.mp400:01
- 1. Android Acquisition Considerations
- 1. Android Forensics.mp400:14
- 2. SANS DFIR.mp400:01
- 3. Android Forensics Agenda.mp403:30
- 4. USB Debugging.mp402:42
- 5. What Is ADB.mp401:36
- 6. ADB Getting Connected 1.mp402:27
- 7. ADB Getting Connected 2.mp401:49
- 8. Defining Root Access.mp401:58
- 9. Types of Root Access.mp403:41
- 10. Example Attempting to Root During Acquisition.mp404:35
- 11. What Can Go Wrong.mp402:29
- 12. Android Download Mode.mp401:37
- 13. Attempts to Remove Tool Traces.mp402:39
- 14. Android Forensic Acquisition.mp407:17
- 15. Logical Remnants Left Behind Access via ADB.mp401:34
- 16. Example commagnetforensicsacquire baseapk.mp401:35
- 17. What if NOTHING Seems to Work.mp402:10
- 18. dumpsys Extractions.mp401:00
- 19. Examples Using dumpsys 1.mp402:06
- 20. Examples Using dumpsys 2.mp400:57
- 21. Other Useful ADB commands.mp401:55
- 2. Locked Android Devices
- 1. Android Forensics Agenda.mp400:35
- 2. Android Lock Codes.mp400:57
- 3. Best Practices for Handling Locked Android Devices.mp402:35
- 4. Reality of Locked Android Devices.mp401:19
- 5. Verifying a Lock Setting 1.mp401:01
- 6. Verifying a Lock Setting 2.mp402:04
- 7. The Reality Check.mp400:40
- 8. Acquisition Considerations and Suggested Steps.mp403:25
- 3. Android File System Structures
- 1. Android Forensics Agenda.mp400:58
- 2. Features of EXT4.mp400:49
- 3. Physical Acquisition Data Obtained.mp405:32
- 4. File System Data Obtained.mp401:49
- 5. Logical File SystemBackup Layout.mp401:23
- 4. Android Evidentiary Locations
- 1. Android Forensics Agenda.mp402:12
- 2. Android Evidentiary Locations Overview.mp402:10
- 3. Proof of SD Card Existence externaldb.mp402:38
- 4. CACHE Evidentiary Locations.mp401:13
- 5. USERDATA Evidentiary Locations.mp401:47
- 6. Call Logs 1.mp403:16
- 7. Call Logs 2.mp401:46
- 8. Contacts.mp402:14
- 9. SMSMMS.mp403:45
- 10. Additional Messages.mp401:20
- 11. User Accounts and Passwords.mp401:55
- 12. Multimedia Files EXIF Data.mp403:04
- 13. Lab 21A.mp415:56
- 14. Location Settings on Android Devices.mp400:44
- 15. Location Information 1.mp401:04
- 16. Location Information 2.mp401:17
- 17. Location Information 3.mp401:07
- 18. Location Information Google Cloud Artifacts.mp405:36
- 19. Internet History 1.mp401:16
- 20. Internet History 2.mp400:51
- 21. Application Storage on Device.mp401:21
- 22. Application Storage on SD Card or Media Directory.mp401:01
- 23. ThirdParty Communication Applications.mp401:09
- 24. Recommendations How to Handle All of This Data.mp401:07
- 25. Lab 21B.mp409:08
- 5. Advanced Decoding and Traces of User Activity
- 1. Android Forensics Agenda.mp400:10
- 2. Beyond the Tools Locating Application Data 1.mp401:02
- 3. Beyond the Tools Locating Application Data 2.mp401:16
- 4. localappstatedb.mp401:19
- 5. Android Snapshots.mp401:54
- 6. Recovering Snapshots and Graphics.mp401:35
- 7. Was the Application of Interest Used.mp401:43
- 8. Contextlog0db Samsung Devices OS 7.mp400:53
- 9. appidlestatsxml.mp400:16
- 10. frostingdb.mp400:57
- 11. notificationlogdb.mp401:18
- 12. Lab 22 A.mp409:25
- 13. Whats Draining the Battery.mp400:51
- 14. Deleted Application Traces.mp400:51
- 15. Hunting Android Malware.mp400:50
- 16. Placing the User At the Scene of the Crime 1.mp401:38
- 17. Placing the User At the Scene of the Crime 2.mp400:44
- 18. Was the Device in Use.mp401:38
- 19. nsdb.mp400:40
- 20. Herrevad and WifiConfigStore.mp400:53
- 21. Connectivity Traces You May Leave Behind.mp400:45
- 6. Google Cloud Extractions and Analysis
- 1. Android Forensics Agenda.mp400:08
- 2. Google Cloud Backup.mp402:01
- 3. Elcomsoft Cloud eXplorer 2.mp401:37
- 4. Warning The User Will Be Alerted.mp400:27
- 5. Elcomsoft Cloud eXplorer NOT Just for Android Users.mp401:22
- 6. Android Summary 1.mp401:24
- 7. Android Summary 2.mp401:05
- 8. Lab 22 B.mp408:18
- 9. Course Resources and Contact Information.mp400:01
- 1. iOS Forensics Overview
- 1. iOS Device Forensics.mp400:49
- 2. SANS DFIR.mp400:42
- 3. iOS Forensics Agenda.mp402:13
- 4. iOS Basics.mp402:44
- 5. Application Sandboxing.mp401:33
- 6. iOS Support Software.mp402:48
- 7. iCloud Sync.mp404:15
- 8. Apple Continuity.mp402:20
- 9. iOS 13 Changed the Game.mp402:25
- 2. iOS Device Acquisition Considerations
- 1. iOS Forensics Agenda.mp400:07
- 2. USB Accessories ModeLock.mp404:14
- 3. Finally The Jailbreak and Exploit We Have Been Wanting.mp401:04
- 4. iOS Forensic Acquisition.mp403:16
- 5. The Golden Age of Mobile.mp403:10
- 6. Recommended Acquisition Guide.mp401:31
- 7. Acquisition Overview UFED Physical Analyzer 1.mp401:10
- 8. Acquisition Overview UFED Physical Analyzer 2.mp401:56
- 9. Acquisition Overview UFED Physical Analyzer 3.mp401:04
- 10. iBackupBot Method for Obtaining Log Files.mp402:05
- 11. Sysdiagnose The Apple Logging Profiles.mp403:51
- 12. Wifi Crash Logs.mp400:46
- 13. Sysdiagnose 3.mp401:09
- 14. Acquisition Considerations and Suggested Steps.mp403:46
- 3. iOS File System Structures
- 1. iOS Forensics Agenda.mp400:07
- 2. Whats APFS.mp400:54
- 3. File System Layouts.mp401:12
- 4. Physical Acquisition Data Obtained.mp401:03
- 5. Full File System Data Obtained.mp400:57
- 6. Advanced Logical Data Obtained.mp403:15
- 7. Encrypted vs Not Encrypted iOS 13 File System Extraction.mp403:37
- 8. LogicalBackup Data Obtained.mp400:54
- 4. iOS Evidentiary Locations
- 1. iOS Forensics Agenda.mp400:21
- 2. Call Logs Contacts and Messages.mp403:10
- 3. Manually Decoding SMS and iMessages.mp401:22
- 4. iOS 11 SMS.mp401:48
- 5. Missing Deleted SMS Messages.mp403:30
- 6. Timing is Everything Where did the Messages Go.mp403:08
- 7. Did the Tool Miss the Results of an Upgrade.mp401:46
- 8. Multimedia Files.mp403:04
- 9. iOS Snapshots.mp404:04
- 10. HEIC Views in Commercial Tools.mp400:33
- 11. Location Services Settings.mp401:06
- 12. Multimedia Files EXIF Data.mp403:46
- 13. Multimedia Files EXIF Data and Deletion.mp401:10
- 14. Photossqlite.mp403:37
- 15. Multimedia Does the User Know Its There.mp401:11
- 16. SIM Card Artifacts.mp401:00
- 17. Lab 31 A.mp413:55
- 18. Location Information.mp400:23
- 19. comapplewifiplist.mp401:05
- 20. Apple Maps 1 Its a MESS.mp403:32
- 22. Apple Maps 3 Protobuf Reality iOS 13.mp401:20
- 23. ThirdParty Application Location Artifacts 1.mp401:32
- 24. ThirdParty Application Location Artifacts 2.mp402:06
- 25. Bonus Locations Full File System Required.mp401:00
- 26. Internet Activity.mp400:30
- 27. Mobile Safari Be Ready for Differences Pre iOS 13.mp402:22
- 28. iOS 13 Safari.mp400:58
- 29. Preference Files of Interest.mp402:49
- 30. Lab 31 B.mp412:10
- 5. Handling Locked iOS Devices
- 1. iOS Forensics Agenda.mp400:22
- 2. iOS Lock Codes.mp400:28
- 3. What about the Lockdown File.mp400:24
- 4. Lockdown SuccessFailures.mp401:07
- 5. Grayshift GrayKeyCellebrite Premium.mp400:51
- 6. iOS Encryption Explained.mp402:10
- 7. BFU.mp402:24
- 6. Advanced Decoding and Traces of User Activity
- 1. iOS Forensics Agenda.mp400:55
- 2. Siri.mp401:35
- 3. The Apple Watch 1.mp401:45
- 4. The Apple Watch 2.mp401:23
- 5. Locating Application Data.mp400:55
- 6. Application Storage.mp401:56
- 7. Unique Identifiers within Applications.mp404:00
- 8. Did the Tool Really Decode the Application.mp401:25
- 9. TCCDB Transparency Consent and Control.mp400:55
- 10. Was the Application of Interest Used.mp401:57
- 11. Crash Logs.mp400:49
- 12. DataUsagesqlite.mp400:21
- 13. Did the Application Ever Exist.mp401:16
- 14. Notifications.mp400:29
- 15. Whats Draining the Battery.mp400:44
- 16. Lab 32.mp418:30
- 17. Placing the User at the Scene of the Crime.mp400:36
- 18. Health More than Exercise.mp402:01
- 19. Forensic Scenarios Scene of a Crime.mp400:26
- 20. Health Validate Tool Findings.mp401:18
- 21. Was the Device in Use.mp401:23
- 22. comappleidentityservicesidstatuscacheplist.mp401:41
- 23. KnowledgeC.mp400:46
- 24. APOLLO.mp403:15
- 25. iLEAPP A Free Parser.mp403:51
- 26. Hunting for Malware.mp400:43
- 27. Best Practices for iOS Analysis.mp400:57
- 28. Lab 33.mp413:48
- 29. Course Resources and Contact Information.mp400:01
- 1. iOS Backup File Forensics
- 1.mp400:01
- 2. SANS DFIR.mp400:01
- 3.mp403:53
- 5. iTunes vs iCloud.mp401:24
- 6. iOS Backup Files 2.mp402:14
- 7. Encryption Matters iOS 13.mp400:52
- 8. iOS Backup Files Requires Manual Examination.mp400:59
- 9. Recovering Deleted Data from SQLite Databases 1.mp402:24
- 10. Dont Miss the BLOBs.mp406:11
- 11. Evidentiary Locations.mp401:04
- 12. Plist Timestamp Examination Considerations.mp402:11
- 13. Infoplist Examination.mp401:50
- 14. Statusplist Examination.mp401:27
- 15. Manifestplist.mp400:30
- 16. Datetime Comparison of Key Plists.mp403:15
- 17. iOS 10 iOS 13 Backups Manifestdb.mp400:40
- 18. NetworkConnections Artifacts.mp401:18
- 19. Device Identification Artifacts.mp401:06
- 20. iOS Backup File Forensic Summary.mp400:44
- 21. Dynamic Text and Dictionary.mp402:10
- 22. Lab 41.mp411:54
- 2. Locked iOS Backup Files
- 1.mp400:22
- 2. Backup File Keychains.mp401:38
- 3. Remember Your Tools May Provide a Clue.mp400:32
- 4. Elcomsoft Phone Password Breaker.mp402:19
- 5. Elcomsoft Attacks 1.mp401:03
- 6. Elcomsoft Attacks 2.mp400:08
- 7. Elcomsoft BruteForce Results.mp400:56
- 8. AnyTrans A Solution to Unlock the iOS Backup 1.mp400:50
- 9. AnyTrans A Solution to Unlock the iOS Backup 2.mp400:50
- 10. A Potential Solution for Previously Encrypted Backups.mp402:16
- 11. Testing Is important.mp401:55
- 3. iCloud Extractions
- 1.mp400:04
- 2. Cloud Extraction Techniques.mp401:33
- 3. Accessing iCloud Backup Files 1.mp400:53
- 4. Accessing iCloud Backup Files 2.mp400:24
- 5. Accessing iCloud Backup Files 3.mp401:18
- 6. Accessing iCloud Backup Files 4.mp400:36
- 7. Downloading iCloud Backup Files 1.mp400:31
- 8. Downloading iCloud Backup Files 2.mp400:14
- 9. Additional Features.mp402:30
- 4. Malware and Spyware Forensics
- 1.mp401:16
- 2. Mobile Malware Threat.mp400:53
- 3. Affected Platforms.mp402:16
- 4. Example Stagefright Android OS.mp401:21
- 5. Example RedDrop Android OS.mp401:06
- 6. Example XcodeGhost iOS.mp402:10
- 7. Example Bootrom Exploit checkm8 iOS.mp401:39
- 8. Remote Exploitation iOS and Android OS.mp400:52
- 9. Types of Mobile Malware.mp401:50
- 10. Trend Mobile RansomwareCrypto Malware.mp402:04
- 11. Potentially Unwanted Applications PUA.mp402:03
- 12. Carrier Family Monitoring Tools.mp402:59
- 13. Evolution of Mobile Malware Threats.mp400:57
- 14. Mobile Malware Infection Vectors.mp401:43
- 15. Stages of a Typical Mobile Malware Attack.mp401:43
- 16. Signs and Symptoms of Mobile Malware Infection.mp400:51
- 17. Mobile Malware Detection.mp402:11
- 18. Scanning for Malware with Cellebrite Physical Analyzer.mp400:32
- 19. Mobile Malware and Spyware Examination Tips.mp402:47
- 20. Focus on Android Suspicious apk Files.mp401:40
- 21. Locating Problem apk Files.mp401:02
- 22.mp402:34
- 23. Lab 43 A.mp416:32
- 24. Anatomy of Application Files iOS.mp401:12
- 25. Unzipped ipa file.mp400:13
- 26. ipa Payload Package Contents.mp401:41
- 27. Anatomy of Application Files Android.mp400:34
- 28. Dalvik Virtual Machines and the dex file.mp400:46
- 29. Analyzing Mobile Applications.mp401:13
- 30. Mobile Malware Reverse Engineering and Analysis Android.mp400:41
- 31. Unpacking Decompiling and Performing Static Analysis.mp403:14
- 32. Static Analysis Step 3 Viewing Decompiled Code with JADX.mp401:10
- 33.mp401:08
- 34. What Should You Be Examining Inside the Application.mp400:59
- 35. Automated apk Analysis Using Online Sandboxes.mp400:36
- 36. Summary of Findings NowSecure.mp400:27
- 37. Lab 43 B.mp405:24
- 5. Detecting Evidence Destruction
- 1.mp401:16
- 2. Evidence Hiding.mp400:35
- 3. Evidence of iOS Wiping 1.mp400:49
- 4. Evidence of iOS Wiping 2.mp402:22
- 5. Evidence of a Wipe.mp400:32
- 6.mp400:45
- 7. Usagestats Timestamps.mp401:46
- 8. Provider or Service Messages.mp400:36
- 9. Keyword Searching.mp400:37
- 10. Interpreting Search Hits.mp400:34
- 11. Carving for Data.mp400:30
- 12. Lab 44.mp413:53
- 13. Course Resources and Contact Information.mp400:01
- 1. ThirdParty Applications Overview
- 1. ThirdParty Application Analysis 1.mp400:55
- 2. SANS DFIR.mp401:16
- 3. What Next.mp404:06
- 4. ThirdParty Application Analysis 2.mp402:43
- 5. What Are ThirdParty Apps.mp400:47
- 6. What Are People Installing.mp400:45
- 7. Alternative App Stores.mp400:33
- 8. Impact on Mobile Forensics.mp400:45
- 9. iOS and Data Storage.mp401:02
- 10. Android and Data Storage.mp400:30
- 11. Other Platforms Utilizing SQLite.mp400:54
- 12. Application Storage Where Is the User Data.mp400:40
- 13. WAL and SHM Aid the Investigation.mp400:49
- 14. How the WAL Gets Populated Initial State.mp400:37
- 15. How the WAL Gets Populated New Page Is Written.mp401:31
- 16. How the WAL Gets Populated Checkpoint.mp402:38
- 17. Is the Database Using Journaling or WAL.mp401:24
- 18. Alternative Storage Formats JSON Files.mp400:59
- 19. Alternative Storage Formats Realm Databases.mp401:23
- 20. Alternative Storage Formats Protobufs.mp402:31
- 21. Encoding versus Encryption.mp401:12
- 22. Base64 Encoding.mp401:25
- 23. Decoding the Data.mp400:06
- 24. Python PlugIns and Free Parsers.mp402:58
- 25. Compare the Apps Functionality to What is Parsed.mp404:13
- 26. Detecting ALL the Evidence Usually Requires TEST DATA.mp402:47
- 27. Application Examples.mp401:52
- 2. ThirdParty Application Artifacts
- 1. ThirdParty Application Analysis.mp400:05
- 2. ThirdParty Application Artifacts.mp400:23
- 3. Geo Data Think Outside the Box.mp401:08
- 4. Are You Getting ALL of the Geolocation Data.mp400:59
- 5. Finding Geolocation Data Show Me What You Can Analyze.mp401:08
- 6. What Was Missed.mp400:38
- 7. Making Sense of Your Location Artifacts.mp401:35
- 8. Was the Device Really There.mp400:43
- 9. MDM and MAM.mp400:06
- 10. MDMs and Why We Care.mp401:07
- 11. MDM and MAM Applications.mp402:14
- 12. How MDMs Impact Investigations.mp400:35
- 13. FileSharing Artifacts.mp400:05
- 14. File Sharing.mp401:39
- 15. File Sharing Example Dropbox.mp400:54
- 16. Dropbox Plist File Example.mp400:23
- 17. Looking for Artifacts Outside of the Application Directory.mp400:48
- 18. Payment Apps and Mobile Wallets.mp400:48
- 19. Payment Applications.mp400:47
- 20. Mobile Banking and InApp Purchases.mp400:42
- 21. PayPal Example.mp402:35
- 22. Apple Pay.mp401:14
- 23. Any App Can Store Payment Details.mp401:01
- 24. Lab 51.mp419:52
- 3. Messaging Applications and Recovering Attachments
- 1. ThirdParty Application Analysis.mp400:25
- 2. Why Chat.mp400:53
- 3. Common Chat Applications.mp400:32
- 4. Messaging App Artifacts.mp400:50
- 5. Recovering Attachments Embedded in Database.mp400:42
- 6. SQLite Storage Classes BLOBs.mp400:47
- 7. Recovering Attachments Located by FilenamePath.mp401:08
- 8. Navigate to Referenced Path.mp400:35
- 9. Locating Attachments by Joining Two Tables.mp401:43
- 10. Attachment JOINS Query Language.mp400:52
- 11. Refresher on SQLite Query Language.mp400:58
- 12. Building the Query.mp401:03
- 13. Changing the Column Names.mp400:16
- 14. Timestamp Is Determined and Applied.mp400:31
- 15. Combining Data from Another Table.mp400:34
- 16. Matching on Like COLUMN Entries.mp400:12
- 17. TABLE JOINS.mp400:32
- 18. Adding a JOIN Statement to the Query.mp400:56
- 19. Did I Use the Correct JOIN.mp400:52
- 20. Adding the Username JOIN.mp400:16
- 21. Aligning the Tables with Matching Column Entries.mp400:15
- 22. JOIN the ZMEMBER Table.mp400:11
- 23. Adding a Second JOIN Statement to the Query.mp409:10
- 24. Lab 52.mp411:55
- 4. Mobile Browsers
- 1. ThirdParty Application Analysis.mp400:09
- 2. Why Install a ThirdParty Browser.mp400:56
- 3. Popular Browsers.mp400:32
- 4. Alternative Browser Artifacts.mp400:42
- 5. Review All Tables for Relevant Items.mp400:40
- 6. What Happens When History Is Cleared.mp401:07
- 7. No SQLite Check for Internet History Contained in LOG Files.mp401:22
- 8. Whats the Difference Between Secure and Anonymous.mp401:37
- 9. The Secure Browser Difference Making Use of Cookies.mp401:27
- 10. Private Browsing Evidence in Tabs and Snapshots.mp400:42
- 11. TOR Browsers.mp400:50
- 12. Tips for Examining Uncommon Browsers.mp401:16
- 13. Lab 53.mp417:27
- 5. Secure Chat Applications
- 1. ThirdParty Application Analysis.mp400:15
- 2. Ephemeral Applications.mp400:23
- 3. Secure Messaging Applications.mp400:29
- 4. Recovering Deleted Data.mp401:01
- 5. Using What You Have to Enhance Your Search.mp400:35
- 6. Dont Overlook Data BLOBs.mp400:28
- 7. BLOBs Used to Store Plaintext Data.mp400:25
- 8. Using Python to Parse BLOBs.mp400:23
- 9. When Apps Dont Live Up to Their Expectations.mp400:51
- 10. Cyber Dust Example 1.mp400:52
- 11. Cyber Dust Example 2.mp400:38
- 12. Snapchat Example 1.mp400:52
- 13. Discord Example No Database No Problem.mp400:57
- 14. Discord Yet Another Way Applications Store Attachments.mp400:56
- 15. Todays Reality When You Are NOT Rooted or Jailbroken.mp401:13
- 16. Todays Reality When You Have Root or Jailbreak.mp400:41
- 17. What Can You Normally Recover.mp401:21
- 18. Signal Decryption.mp400:48
- 19. Wickr Example.mp400:45
- 20. Snapchat Example 2.mp400:46
- 21. Lab 54.mp411:04
- 6. Forensic Capstone Prep
- 1. ThirdParty Application Analysis.mp400:07
- 2. Forensic Challenge Prep.mp402:08
- 3. Course Resources and Contact Information.mp400:01
- 1. Smartphone Forensic Capstone Exercise
- 1. Smartphone Forensic Capstone Exercise.mp400:21
- 2. Rules of Engagement.mp401:39
- 3. Your Goal.mp400:50
- 4. Good Luck.mp408:18
More details
User Reviews
Rating
average 0
Focused display

Sans
View courses SansThe SANS Institute is a private U.S. for-profit company founded in 1989 that specializes in information security, cybersecurity training, and selling certificates. Topics available for training include cyber and network defenses, penetration testing, incident response, digital forensics, and auditing.
- language english
- Training sessions 478
- duration 15:36:41
- Release Date 2023/06/16