One of the hardest things you're going to do in mobile forensics
is trying to say if the device was really there.
Do not forget your location cheat sheets.
Do not forget what we show you in green as reliable.
So if you find an application artifact of interest
that puts a person in a location,
refer back to that location's cheat sheet
that's in your Section 2 Section 3 on Dropbox.
Use the items in green, and timeline.
Put the pieces together, and say, OK, this application
makes it seem like the user was in this location on this date.
Use the ones that we can trust and say, OK, well,
Wi-Fi says this.
Or there was a photo taken with EXIF that says this.
Use what you can trust to validate if it was there.
Applications can be used to lead you astray
on where you think someone was.
It's very important that you validate, you verify,
and you then--
and only then can trust--
the results you're seeing.