The way this section is laid out, you'll have the overview.
And then after that, I will lecture
on each of the sections.
At the end of every section, you are going to have a lab.
So after Third-Party Application Artifacts,
I'm going to break down geolocation,
mobile device management, financial--
so specific categories of applications.
And then you are going to work a lab.
This lab has directories and files
from an iPhone and an Android.
We do not provide you with the forensic image,
so you manually have to hunt for the apps of interest.
Section 5.3 3 and Section 5.5 could technically go together.
But we're going to start with 5.3.
What happens when you have messages
that are stored in a database and the attachment stored
in a different location?
How can you hunt them and recover them?
We then dive into mobile browsers.
In mobile browsers, we assume you
could look at browsing history, and cache, and cookies, and all
the easy stuff.
But what happens if the person is intentionally destroying
or hiding browsing artifacts?
Are you going to be able to uncover where they came from
and how they got onto that device,
or where they are after they're removed?
Secure chat apps-- if it's set to time bomb, self-destruct,
go away, never save to disk, what does that look like?
And what can you actually recover?
We are going to work that.
At the end of all of this, we are
going to prep for the forensic challenge that is Section 6.
Something else that we are going to do at the end of all of this
is discuss the GIAC cert.
We are going to discuss ways that you can prepare
for it and tools that are provided to you on behalf
of SANS to make you prepared to do successful or do
successfully when you take GASF.