Welcome to Forensics 585, Smartphone Forensic Analysis
in Depth.
I'm your instructor, Heather Mahalik,
and I'd like to welcome you to the SANS on-demand studio.
Together with Domenica Crognale, who goes by Lee,
we wrote this course, and we hope you enjoy it.
Please provide feedback.
Reach out to us.
And we want you to enjoy a classroom experience.
If that means that you send us an email
or you send us a tweet, please do so.
I would like to start with introducing myself.
I've been doing digital forensics for almost 20 years,
and I have a wide range of knowledge.
I actually started my career as a contractor
at the US State Department working visa fraud, passport
fraud, and child exploitation.
I then left the State Department and I tried to do some
e-discovery for a while--
so 3 and 1/2 years.
And in those investigations, that's the first time
I was presented with a phone.
And everyone knows that you are always
the lucky or unlucky person that gets a computer
or gets a phone, and you become "that" person.
So that's exactly what happened to me.
I then ran some mobile device labs for Department of Defense
as a contractor.
I worked with the military, I worked
with the federal government, and I worked with law enforcement.
I currently am the curriculum lead for DFIR at SANS.
I am a SANS faculty fellow instructor.
And I also work in my day job at Cellebrite as an evangelist,
just being a voice for the customer and a voice inward
toward product.
I am extremely passionate about smartphone forensics,
and I feel that you're going to have that come across
during this course.
There are a few things I want to cover--
just some typical Section 1 administrative things
that I want to get out of the way.
If at any point during the course,
you reach out in an email and say, Heather,
I don't remember where the Dropbox is,
or Heather, I can't remember where to find this,
I'm going to refer you back to this intro recording.
So please make sure you listen to it,
make sure you take a look at these links,
and that you follow along.
When you go into your SANS dashboard,
this is where you're going to find SANS on-demand access.
This is extremely important.
This is where you're going to have access to your media
files, this is where you're going to find your licenses,
and everything you need to succeed in this course.
This is also where you can go through your recording,
you can reach out to the SME.
Something to keep in mind is, you
don't have to listen to every portion of the recording
from beginning to end, but I really want you to do that.
Take the time to learn.
You can always speed up the recording,
but be careful with that.
I talk very quickly.
So if you're doing a high speed of listening,
it may not be as beneficial to you
as if you go with the normal rate that's recommended.
When you're preparing for your GIAC certification,
you may find that you struggle in a section
where you excel in others.
You can always go back and re-listen
to those specific sections as needed.
So keep that in mind.
I will provide GIAC hints during this course.
So please make sure you take a look for that.
My preferred location to do this is at the end of Section 5,
where I just give you hints on things
that you can do to better prepare yourself to pass GISF.
When you're licensing your Lab 0,
if you go into your SANS portal and if you go into your account
dashboard, under My Labs, Lab 0 will point you to My Labs.
And this is where you're going to go
to license some of the tools.
So please make sure you read the instructions
and you follow that exactly.
Another item that is created for you for your benefit
is a course Dropbox.
To get to this, you type for585.com/h01.
This will match the version that's in your course books.
So let's say you're taking--
you open your book and you see you're signed up for h01.
This will also match what you see in your portal.
So you can see your on-demand access is h01.
If it's at h03, your on-demand Dropbox would be
for585.com/h03.
So it really just has to match the version of your course,
and must be all lowercase.
Once you're in this Dropbox, you are
going to see each section correlates to a day.
So in Section 1, there are things
that you will find that are mentioned in the course
by me that may be of relevance to you.
Dig into this information.
It is completely bonus.
It's not something you have to prep for with the cert.
It's not something you have to print and take
to the certification with you.
The cheat sheets are super important.
These cheat sheets are designed to help you with your analysis.
You will hear me reference them several times
throughout the course.
Please make sure you're referencing them.
Now, these are something I would print and take along
to the certification with me.
And I will remind you of that at the end of Section 5.
If you go into Bonus, here, you're
going to find the GISF section, which is going
to prepare you for the cert.
You're going to find books.
These are copies of the books that Mattia Epifani and I
wrote--
not together, but separate.
You have access to those.
As we keep digging, you're going to find this magic directory
down here.
Read it.
Day 6 challenge.
Do not peek early.
If you peek at this directory early, we will know,
and you will not be eligible for a forensics challenge coin
should you be trying to go for one.
So please make sure you don't just dig through this directory
and say, oh, I didn't hear you, because you did
hear, or you wouldn't know it existed.
So let's think about that.
Do not peek if you want to go for the challenge coin.
Wait until the end of Section 5.
Listen to what I have to say before you
go into this directory.
That's extremely important.
I may continue to add items to this drop box as the course
evolves.
If you're taking this course and you're like, wow,
you know what?
I found this reference that would be
really relevant to this course.
If you send it to me, I will add it to this Dropbox.
So this is something that will continuously grow.
Keep in mind, it is always there for you to access.
It is there to help you.
Between the materials that's provided to you in your ISOs,
between this Dropbox that's provided specifically
for you in this on-demand version of this course,
in addition to the smarter forensics portal that I will
mention in Section 1, you are armed with the most information
you need to be successful not only in this course,
but when you're working smartphone forensic
investigations.