>> Hey everyone, welcome back to the course.
The last module, we wrapped up
our discussion on email crimes.
In this video, we're going to talk about
different steps we need to take
before mobile investigation.
Just a quick pre-assessment question here,
data loss is a top threat for mobile devices,
is that true or false?
That one's easy, we all know that's true.
Data loss is a top threat for
mobile devices as well as all other devices, right?
We don't want to lose our data.
Mobile forensics, just like
>> any other type of forensics,
>> we're extracting, recovering, and analyzing data.
Some of the places we get it from on
a mobile device are going to be
the internal memory, the SD card,
the SIM card and then you can take a look
at NIST SP800-101,
which cover some more information
on mobile forensic investigations.
On to internal phone memory
is going to be things like our RAM,
our ROM, also the flash memory.
Our sim card's going to be our
contact list, our address book,
it's also going to contain messages and then we've got
different external memory that'll
be things like SD cards,
microSD, miniSD, etc.
Different steps we need to take before
a mobile forensic investigation.
Before we get started as an investigator,
what do we need to take as far as step-wise?
Number 1, building a forensic workstation
then building a investigation team,
reviewing different laws or
>> policies that are applicable,
>> notifying decision makers and
obtaining authorization from them,
performing a risk assessment and as well
as building out a mobile forensics toolkit.
Excuse me there, stumb a little bit.
Mobile forensic workstations.
We need to consider do we want
a laptop or desktop like what do we actually need?
We may need both. We
>> realistically probably do need both.
>> That way we can be mobile
as well as if a mobile device comes to our lab,
we can assess it as well.
Having things like a USB connector,
cables, SIM card reader, again,
the mobile forensic toolkit,
that way we can go to different scenes
and then also a microSD memory card reader.
Building our investigation team,
generally it should have all these people on it.
We should have an expert witness,
evidence manager and documenter, an investigator,
an attorney or someone legal, photographer,
incident responser,
the decision maker needs to be involved.
They may not necessarily go to the crime scene,
but they're going to be involved in the process,
as well as an incident analyzer.
We need to review different laws and policies,
for example, federal or state laws as well as local laws.
If there's something at the local level we need to
follow regarding
mobile crimes, then we need to follow it.
We shouldn't try to just say, "Hey,
well, at the federal
and state level doesn't say anything."
Well, that doesn't matter. It still
might get your case thrown out.
Then also following any policies,
like policies that our organization
has as far as mobile investigation,
making sure we are compliant with those.
Notifying decision-makers,
obviously decision-makers
implement the policies and procedures.
If we don't see a policy on something for example, "Hey,
I don't see a policy on iOS phone recovery."
Then let your decision maker
know so they can give you direction on that.
Then of course obtaining authorization from them.
Performing a risk assessment,
so when we're going for the mobile data,
like what are some of our risk?
Well, maybe we're going to
lose some of that internal memory,
things like our RAM and our ROM.
Let's go ahead and prioritize and
acquire that first right before we do anything else.
That's all the risk assessment is
as we're just trying to get a better handle
on what data we need to acquire first.
Then building on our mobile forensics toolkit.
Again, this is going to be dependent
upon whatever device it is,
whether it's an iPhone or an Android,
or even a Blackberry for example.
Whatever device it is,
it tells us what cables we need and what
other hardware and software
tools that we might need to actually acquire the data.
In this video, we talked about
different steps we need to take
before mobile investigation.
In the next video, we're going to talk about
some different mobile threats as
well as some laws that we need to be aware of.