Let's say you scan for Malware, and you get zero hits.
And you're like, great, what else do I do?
Maybe you only have Bit Defender,
and maybe you're not looking at signature-based Malware.
These bullets are not in order.
This is where it depends on the scenario and what you know.
If someone says to you, my device
started acting weird between this week and this week,
you want a timeline for that.
Lee and I worked an iPhone that was infected with Malware.
And we were told that the person traveled to China
for a specific week in November, but then her device
started taking pictures around 3 o'clock
in the morning every single night
between this week in January.
So what we first did was timelined
for that week in November.
After we exhausted everything we could find,
we then timelined for the week in January.
The next thing I did was went to TCC.DB
to see what had access to the camera
because we knew this Malware was initiating the camera.
From there, we focused on the applications.
Now, that was a very good scenario
where we had information.
What if you don't have that information?
What if someone says, I have no idea
when it started acting weird.
Consider how did they get the Malware?
Look at browser history.
Look at links that could have been
clicked in third-party apps, text messages, emails.
Check downloads.
So if you look at the downloads directory or cache directory,
or you look on an SD card, is there
anything that's there that doesn't look right?
If you have the phone in front of you,
and you're acquiring it, remember,
most Android devices will reboot during acquisition.
If an error message pops up on the screen,
take a photograph of it, and research it,
and see what that means.
And then that first bullet there--
check installed applications for suspicious application files.
This is difficult. This is going to take a lot of work
on your behalf.