Not being able to access such data is no judgment of your abilities, it just means you may not win this round. You can throw every tool known to civilization at it, try to manually examine it, phone a friend, look on Twitter, search the blog-o-sphere, search the Discord Channel, query a listserv, and conduct your own research and you still strike out.
If you conduct digital forensic examinations for any substantial amount of time you are going to have examinations where there is inaccesible data and nothing you do is going to change that. I think there should be a similar mantra for digital forensic examiners. One of my mentors from my time investigating homicides told me early in my career that I was not doing it right unless I had some unsolved homicides on the books he felt it was some sort of badge of honor and showed a dedication to the craft. Its existence means there is a high probability there is data on a particular mobile device that I am not going to get access to, and this is usually after I have spent a considerable amount of time trying to gain access to the device itself. Not to pick on any particular tool vendor, but seeing this window (or one simmilar to it) brings a small bit of misery. I have been seeing the above pop-up window lately.
WICKR ME EXPIRATION TIMER ANDROID
I would like to thank Heather Mahalik and Or Begam, both of Cellebrite, who helped make the Android database portion of this blog post possible, and Mike Williamson of Magnet Forensics for all the help with the underpinnings of the iOS version. Portions of this blog post appeared in the 6th issue of the INTERPOL Digital 4n6 Pulse newsletter.
0 kommentar(er)
