I also teach the Windows Forensics course here at SANS.
And something you will see is, the lecture in that course
lead you very nicely into the labs.
This class is a little bit rogue from that aspect.
You will see that I will lecture on things,
and then you'll hit your lab and say, wait,
she didn't teach me this.
But if you think back, I kind of did.
So maybe you'll have specifics on iMessage.
And I didn't teach you iMessage, but I did teach you SMS.
It's the same thing.
When we talk about Android RCS messaging versus regular text
messaging, just think--
take a moment and reflect on what
the lecture had taught you.
I am very much a hands-on learner, as is Lee.
Our labs add so much value to this course.
So if you are going to choose between listening to me
and doing the labs, please do the labs.
You will take so much away from it.
Do not skip through them.
Do not skip something because you think
that you are a master of AXIOM.
Try the labs.
We have unique questions built into these labs based
upon student questions.
Your questions drive our lab creation.
So when we see a question that someone is repeatedly asking,
we think to ourselves, let's build this into the lab.
Or if we find something that the tools commonly misinterpret,
we build that into the labs.
You are going to have 35 different labs in this course.
Now, where this is different than other SANS courses
you may have taken, it is not the same data set that builds.
These are completely different characters,
different scenarios, different situations.
You will find that you'll have repeat scenarios,
because Lee and I have only so many fake personas.
And you'll become familiar with Felicia and Hank and Lloyd
and Ace as you're seeing this data.
But the labs are designed to push you,
to challenge you to go further.
And remember what I said earlier in this section.
It's like being an artist.
How we show you the labs in the workbook
doesn't have to be your approach as long
as you get the correct answer.
That is the beauty of smartphone forensics.
There are so many different paths and tools
that you can take to get the answer.
Finding the artifact, validating the answer,
and understanding that's correct is the key goal of this course.