database files Archives - Digital Evidence Innocence Initiative

Digital Innocence: Data Recovery from Third-Party Mobile Applications

Finding New Evidence from Third-Party Mobile Apps with the Latest Technology At the beginning of 2019, the Google Play store had approximately 2,100,000 applications for Android and the iTunes store had almost 1,800,000 apps for Apple devices. While most of the applications installed by the device manufacturer are supported for analysis by forensic software, many of the third-party applications are not. Exculpatory evidence could be contained in these third-party mobile apps. Commonly used third-party applications such as free texting apps or navigation apps can be a great source of information, but are not always supported by forensic tools for analysis. There is a time lag as to when the forensic software can decode these applications, if ever. However, advanced analysis methods and new digital forensic technology to access and examine third-party applications are created every day. Applying this technology to older cases may uncover new digital evidence. Additional information here Digital Evidence Case Assessment Method White Paper or here IRIS LLC Digital Evidence Toolbox-Location Data

Digital Innocence: Levels of Data Recovery for Mobile Forensics

Advances in digital forensic technology provides a deeper access to mobile device data. New technology can extract deleted data from cell phones that were previously inaccessible. It is important to know the difference between the mobile device forensic extraction levels because each one can recover a different amount of data. A logical extraction obtains the least amount of data. A file system extraction obtains the database files which can recover data that has been deleted. A physical extraction will copy the entire device memory and will recover the most data including unallocated space which can contain deleted data. Not all mobile devices are supported for every level of extraction, but updates to forensic software are released often. If you had a case involving a mobile device that was only supported for logical extraction, new technology may now be able to access the area where deleted data can be found. Digital forensic experts can quickly determine when new technology updates were released and from that, determine what data can be recovered based off the make and model and operating system of the mobile device. Additional information here Digital Evidence Innocence Initiative White Paper and IRIS LLC Toolbox-Mobile Device Forensics Summary and IRIS LLC Cellebrite Report Quick Start Guide