Your VM has many tools.
You're going to see in a slide coming up,
this is not a "press the button, get a magic answer"
type of course.
But we realize, you work in different labs.
You have different tools to access.
Lee and I aimed, when we wrote this course,
to give you the best tools available to do
the jobs that you need to do.
Are there other tools that exist?
100%.
A good example is, Oxygen Forensics is a fantastic tool.
We don't have a license to give you for this course.
However, if you want to try it, if you email them and say,
I'm taking Forensics 585 on demand with Heather Mahalik
and she said you will give me a trial license, they will.
If you need to access that, just send me an email--
hmahalik@sans.org or hmahalik@gmail.com-- and I
will help you in getting that license.
Another license that you can get is Sanderson's Forensic
Explorer.
If you find that you want to try more
with SQLite using Sanderson's tool, you can reach out to me.
I will put you in touch with Teel Tech,
and they will give you a license.
Most of these vendors want you to try their tools.
So keep that in mind.
Lee and I are giving you access to the best
we can in this course.
You're going to find that some of these, you're
going to say to yourself, I don't want to use more tools.
And you shouldn't.
Our magic number is two.
We want you to use two tools if you
find an artifact of interest.
Now, I don't mean you have to replicate everything.
But you are going to find that when
I'm doing a lab, if I find something,
I will look in another tool.
And what happens when they disagree?
Then you may have to do manual validation yourself.
And that is strongly what we recommend.
So there's a lot that's here.
Some of these are free.
Some of them are not.
Open source tools are awesome for smartphone forensics,
and we've come a long way.
We are going to be using tools like ALEAP,
iLEAP, Apollo, customized script from the Cheeky Forensic
Monkey, and others in this community who have built things
to help you do your job.
They are fantastic starting points when it comes to speed.
We all know that when you--
let's say you get a 256-gig iPhone.
It takes time to extract it.
It takes time to parse it.
You can do things quicker, on occasion.
And we're going to dive into that in Section 2 and Section 3
and show you how to leverage some of these scripts.
Mari DeGrazia wrote a free script
that will pull deleted data from SQLite databases.
Think about that.
Think about how much we pay in these tools to do just that.
You can do it for free.
And I'm going to teach you how to do these things
during this course.