So we find an app, and it's not parsed, or it is parsed,
and we need to verify.
What are you going to do?
Most often, you want to find-- if you're told
did parse it, how many messages is your tool showing?
If your tool did not parse it, where do messages
live in that database?
What about wall posts?
What about direct messages and all those things?
Can the app make calls and take calls?
If so, video, voice, or both?
Where's the message body stored?
And then the attachments.
Now, something I really want you to be aware of--
if everything above attachments is encrypted--
so the calls, the wall posts, the messages, message body--
often, the attachments are left unencrypted.
You may have amazing artifacts, especially audio files.
When I took CASA training, my instructor said, audio files
are the most ignored thing.
Nobody wants to take the time to listen.
We all want to read.
So if you're ever going to commit crimes,
just put it in an audio file because no one
will listen to it.
Always listen to the audio.
It may be some of the best messaging
you're getting in these apps.