YouTube Video
Mobile forensics is a constantly evolving field. While many of the roadblocks examiners face today aren't new problems, there may be new ways around them.
In this episode, we'll explore some of the biggest roadblocks in a mobile device investigation and discuss how you can navigate around them. Whether you're new to mobile or an old pro, this episode covers the issues that are undoubtedly waiting for you in your workflows.
Christopher Vance, Staff Technical Forensics Specialist at Magnet Forensics, draws on conversations with examiners to cover five major roadblocks: preserving device state (isolation, power and iOS/Android reboot timers), ever-growing device sizes, unsupported and proprietary data, collaboration beyond the sneakernet, and education across the whole investigative chain.
#MobileForensics #MagnetForensics #iOSForensics #AndroidForensics #DigitalForensics #DFIR
00:00 Welcome and Roadblocks
02:28 How Mobile Forensics Has Changed
03:31 Preserving Device State
06:08 Isolation Methods and Their Limits
10:24 Power Drain and Faraday Bags
13:00 Reboot Timers and AFU
15:43 Why AFU vs BFU Matters
18:39 Bigger Phones, Bigger Workflows
21:28 Unsupported and Proprietary Data
24:46 The Multi-Tool Approach
26:10 Validating Parsers and AI
29:11 Collaboration Beyond the Sneakernet
32:36 Education as the Fix
39:00 Wrap-Up
👉 Visit Forensic Focus: https://www.forensicfocus.com
🎧 Video/Transcript: https://www.forensicfocus.com/webinars/roadblocks-ahead-navigating-the-major-issues-of-mobile-forensics/
📝 Show Notes
Magnet Forensics – https://www.magnetforensics.com
Magnet Review – https://www.magnetforensics.com/products/magnet-review/
iLEAPP (LEAPP suite) – https://github.com/abrignoni/iLEAPP
ALEAPP (LEAPP suite) – https://github.com/abrignoni/ALEAPP
HEART by Metadata Forensics – https://github.com/MetadataForensics/HEART_by_Metadata_Forensics
APOLLO by Sarah Edwards – https://github.com/mac4n6/APOLLO
FFmpeg – https://ffmpeg.org
ExifTool – https://exiftool.org
GrapheneOS – https://grapheneos.org
👉 Follow Forensic Focus
RSS | https://www.forensicfocus.com/feed
YouTube | https://youtube.com/@ForensicFocus
Podcast | https://forensicfocus.com/podcast
LinkedIn Page | https://linkedin.com/company/forensicfocus
LinkedIn Group | https://linkedin.com/groups/693917
X (Twitter) | https://x.com/ForensicFocus
Facebook | https://facebook.com/forensicfocus
Bluesky | https://bsky.app/profile/forensicfocus.bsky.social
Instagram | https://instagram.com/forensicfocus
TikTok | https://tiktok.com/@forensicfocus
Mastodon | https://dfir.social/@forensicfocus
In this episode, we'll explore some of the biggest roadblocks in a mobile device investigation and discuss how you can navigate around them. Whether you're new to mobile or an old pro, this episode covers the issues that are undoubtedly waiting for you in your workflows.
Christopher Vance, Staff Technical Forensics Specialist at Magnet Forensics, draws on conversations with examiners to cover five major roadblocks: preserving device state (isolation, power and iOS/Android reboot timers), ever-growing device sizes, unsupported and proprietary data, collaboration beyond the sneakernet, and education across the whole investigative chain.
#MobileForensics #MagnetForensics #iOSForensics #AndroidForensics #DigitalForensics #DFIR
00:00 Welcome and Roadblocks
02:28 How Mobile Forensics Has Changed
03:31 Preserving Device State
06:08 Isolation Methods and Their Limits
10:24 Power Drain and Faraday Bags
13:00 Reboot Timers and AFU
15:43 Why AFU vs BFU Matters
18:39 Bigger Phones, Bigger Workflows
21:28 Unsupported and Proprietary Data
24:46 The Multi-Tool Approach
26:10 Validating Parsers and AI
29:11 Collaboration Beyond the Sneakernet
32:36 Education as the Fix
39:00 Wrap-Up
👉 Visit Forensic Focus: https://www.forensicfocus.com
🎧 Video/Transcript: https://www.forensicfocus.com/webinars/roadblocks-ahead-navigating-the-major-issues-of-mobile-forensics/
📝 Show Notes
Magnet Forensics – https://www.magnetforensics.com
Magnet Review – https://www.magnetforensics.com/products/magnet-review/
iLEAPP (LEAPP suite) – https://github.com/abrignoni/iLEAPP
ALEAPP (LEAPP suite) – https://github.com/abrignoni/ALEAPP
HEART by Metadata Forensics – https://github.com/MetadataForensics/HEART_by_Metadata_Forensics
APOLLO by Sarah Edwards – https://github.com/mac4n6/APOLLO
FFmpeg – https://ffmpeg.org
ExifTool – https://exiftool.org
GrapheneOS – https://grapheneos.org
👉 Follow Forensic Focus
RSS | https://www.forensicfocus.com/feed
YouTube | https://youtube.com/@ForensicFocus
Podcast | https://forensicfocus.com/podcast
LinkedIn Page | https://linkedin.com/company/forensicfocus
LinkedIn Group | https://linkedin.com/groups/693917
X (Twitter) | https://x.com/ForensicFocus
Facebook | https://facebook.com/forensicfocus
Bluesky | https://bsky.app/profile/forensicfocus.bsky.social
Instagram | https://instagram.com/forensicfocus
TikTok | https://tiktok.com/@forensicfocus
Mastodon | https://dfir.social/@forensicfocus