At this point, we have covered everything from acquisitions,
how to handle locked devices.
We talked about the alphabet soup.
We did FDE, which is Full-Disk Encryption.
We did FBE, File-Based Encryption, AFU,
After First Unlock, BFU, Before First Unlock.
We then went and looked at all the different file systems
and what you can expect to get.
Remember, even if you get a full file system extraction,
best practice is state to get an advanced
logical as well because of those device
identifiers that may be overlooked.
Don't forget about chat capture.
That's another great way to go through and get application
data that could be missing.
Evidentiary locations change based
upon the version of Android.
Do not get tunnel vision.
Assume the user never updated.
It is so rare for someone to go out and buy a new device
and not restore data from an old device.
If someone's doing that, your forensic examination
will actually be easier.
Make sure you check the file paths to ensure your tools
are not missing something because what the tools commonly
do is they scan and say, oh, this is Android 12.
I am going to look this way at Android version 12.
But what about all the other things
that happened historically?
You are smarter than your tools.
In advanced decoding, we covered things like,
was the app in use?
Uncovering traces of possible deleted apps,
can we put a person at a location?
And which locations can we trust, and
which ones can we not, and why?
And then ultimately, can we put a user behind that device?
Now, in the final section here, we're
going to talk about the juicy stuff--
Google Cloud.