The agenda for this section is listed on the screen.
We are going to talk about acquisition.
We touched on this in Section 1 in a wide range.
Now, I want to specify things that you
can do to be more successful in your Android acquisitions.
From there, we're going to talk about Android lock devices.
Unfortunately, this is a very short section
because locked Androids are extremely difficult when
Secure Startup is involved and when file-based encryption
is enabled on these devices.
Then, we're going to go into file system structures.
So this is going to be, what are these structures
going to look like depending on the acquisition that you get?
That then leads quickly into Section 2.4.
So you're going to see the speed that we
get from this point to Section 2.4 is quick.
And a lot of people think, wow, Heather's really
flying through this course.
All of the meat of the course starts with Section 2.4.
This Is where we look at where evidence is stored--
simple things like contacts, call logs, SMS, location, EXIF,
browsing activity.
And you're going to do the first part of the lab.
Then, I'm going to dig in a little bit
deeper and give you additional artifacts and preference
files of choice, and you are going to do Part 2 of that lab.
Then we get the hard stuff--
Advanced Decoding and Traces of User Activity.
Here, we want to put a user at a location
when something occurred.
We want to see what's hiding from the tools.
How can we prove the truth in the evidence?
And we have another lab at that point.
We end Section 2 with Google Cloud extractions, which
I think is extremely exciting.
Some people find it extremely terrifying
when they consider what is actually
being collected on themselves.
I want you to make sure you follow
this section and all the labs in order
because they build upon one another.
You're going to find that you have two data sets
for the labs in this section.
You will have Part 1 and Part 2 for each.
Please do not skip ahead without listening to the lecture.