Then we'll have some closing remarks from Melissa and then we'll go through some questions. I'm Tayfun, I joined Magnet Forensics almost four years ago now.Originally I started off as a developer in the company with the goal of evolving the flagship product.We're also going to talk about how Magnet delivers artefact updates to ensure that you're getting the results you're looking for from these applications.Then we're going to take you through the anatomy of a mobile app, and this will go through various levels of where the data's stored, encryption, data formats, and really break down how mobile apps are storing their data in their applications.I've worked on a lot of artefacts that you see in Internet Evidence Finder.Currently now I'm responsible for product management and coming up with products and talking to customers about how we can help you in your investigations.But what's most interesting about this is that the mobile and mobile plus desktop user base is growing the most, and the desktop user base is shrinking.
Now this creates more difficulty in investigations because you're dealing with different devices, especially in mobile.
As discovered by i OS researcher Jonathan Zdziarski, both messaging services have been found to not completely delete messages when erasing them — meaning that a person with physical access to your phone, or backups of data in the cloud, may be able to retrieve “deleted” conversations.
“Forensic trace is common among any application that uses SQLite, because SQLite by default does not vacuum databases on i OS (likely in an effort to prevent wear).
And this has driven Facebook to focus more on their mobile apps and their mobile experience more than their desktop browser experience.
So one thing that we focus on here at Magnet is understanding what applications are being used most out there, and similarly what applications you see in a forensic investigation.
So diving right in, these stats here show time spent on the internet by device, so this splits up mobile and desktop computing.