Verification and Validation of Findings
-
Upload
cellebrite -
Category
Technology
-
view
840 -
download
3
description
Transcript of Verification and Validation of Findings
![Page 1: Verification and Validation of Findings](https://reader033.fdocuments.us/reader033/viewer/2022052601/558e02b31a28ab786c8b4631/html5/thumbnails/1.jpg)
Digital Shield, Inc. Verifying and Validation of Findings
![Page 2: Verification and Validation of Findings](https://reader033.fdocuments.us/reader033/viewer/2022052601/558e02b31a28ab786c8b4631/html5/thumbnails/2.jpg)
Who Are We? • Former Local LE
• Conduct Live Case Work
• Specialize in Training & Dev.
• We like this stuff
![Page 3: Verification and Validation of Findings](https://reader033.fdocuments.us/reader033/viewer/2022052601/558e02b31a28ab786c8b4631/html5/thumbnails/3.jpg)
• We conduct investigations
• Testify to findings in Court / Defend our results
• How are you validating information produced by tools?
• Challenged in court yet?
So Why Are We Here?
![Page 4: Verification and Validation of Findings](https://reader033.fdocuments.us/reader033/viewer/2022052601/558e02b31a28ab786c8b4631/html5/thumbnails/4.jpg)
State of Mobile Forensics • Come along way in last few years
• Logical
• File systems
• Physical
• Password extract / bypass
• Applications
• OH MY!
![Page 5: Verification and Validation of Findings](https://reader033.fdocuments.us/reader033/viewer/2022052601/558e02b31a28ab786c8b4631/html5/thumbnails/5.jpg)
Forensics “Trust but Verify”
• Tools produce decoded data • Do you believe the tools extracted ALL the data? • Ok it extracted it, but was it decoded? • Detective is it possible you could have missed anything?
![Page 6: Verification and Validation of Findings](https://reader033.fdocuments.us/reader033/viewer/2022052601/558e02b31a28ab786c8b4631/html5/thumbnails/6.jpg)
Validation Techniques • Hand Scroll Analysis
• Database Searches
• Unallocated space
![Page 7: Verification and Validation of Findings](https://reader033.fdocuments.us/reader033/viewer/2022052601/558e02b31a28ab786c8b4631/html5/thumbnails/7.jpg)
Hand Scroll Analysis • Thumbing through a Phone
• Documenting all visible information on the phone
• Time Consuming UGH!!
• Validation collected information
• May not have access to all data through interface
![Page 8: Verification and Validation of Findings](https://reader033.fdocuments.us/reader033/viewer/2022052601/558e02b31a28ab786c8b4631/html5/thumbnails/8.jpg)
Database Verification
![Page 9: Verification and Validation of Findings](https://reader033.fdocuments.us/reader033/viewer/2022052601/558e02b31a28ab786c8b4631/html5/thumbnails/9.jpg)
Sample Number One
![Page 10: Verification and Validation of Findings](https://reader033.fdocuments.us/reader033/viewer/2022052601/558e02b31a28ab786c8b4631/html5/thumbnails/10.jpg)
Sample One Verify
![Page 11: Verification and Validation of Findings](https://reader033.fdocuments.us/reader033/viewer/2022052601/558e02b31a28ab786c8b4631/html5/thumbnails/11.jpg)
Sample Number Two
![Page 12: Verification and Validation of Findings](https://reader033.fdocuments.us/reader033/viewer/2022052601/558e02b31a28ab786c8b4631/html5/thumbnails/12.jpg)
Sample Two Verify
![Page 13: Verification and Validation of Findings](https://reader033.fdocuments.us/reader033/viewer/2022052601/558e02b31a28ab786c8b4631/html5/thumbnails/13.jpg)
Sample Number Three Verify
![Page 14: Verification and Validation of Findings](https://reader033.fdocuments.us/reader033/viewer/2022052601/558e02b31a28ab786c8b4631/html5/thumbnails/14.jpg)
Sample Number Three Verify
![Page 15: Verification and Validation of Findings](https://reader033.fdocuments.us/reader033/viewer/2022052601/558e02b31a28ab786c8b4631/html5/thumbnails/15.jpg)
Sample Number Four “Decoded”?
Is the Application supported for Decoding? If not then what?
![Page 16: Verification and Validation of Findings](https://reader033.fdocuments.us/reader033/viewer/2022052601/558e02b31a28ab786c8b4631/html5/thumbnails/16.jpg)
3rd Party Tools
![Page 17: Verification and Validation of Findings](https://reader033.fdocuments.us/reader033/viewer/2022052601/558e02b31a28ab786c8b4631/html5/thumbnails/17.jpg)
What tools do you use?
• Cellebrite • XRY • Oxygen • IEF • EPILOG • Are you serious?
![Page 18: Verification and Validation of Findings](https://reader033.fdocuments.us/reader033/viewer/2022052601/558e02b31a28ab786c8b4631/html5/thumbnails/18.jpg)
EPILOG – SQLite Deleted?
![Page 19: Verification and Validation of Findings](https://reader033.fdocuments.us/reader033/viewer/2022052601/558e02b31a28ab786c8b4631/html5/thumbnails/19.jpg)
IEF Mobile -- SMS Unallocated
![Page 20: Verification and Validation of Findings](https://reader033.fdocuments.us/reader033/viewer/2022052601/558e02b31a28ab786c8b4631/html5/thumbnails/20.jpg)
IEF Mobile – Snapchat / Skype
![Page 21: Verification and Validation of Findings](https://reader033.fdocuments.us/reader033/viewer/2022052601/558e02b31a28ab786c8b4631/html5/thumbnails/21.jpg)
Questions?
More Information? Digital Shield, Inc.
321-704-1336
Hanover, Maryland
Grant, Florida