Download - PFIC - Paraben's Forensic Innovations Conference

Time: Sunday, 12:30 PM – 2:00 PM
Track: Lab Track A
Room: Neuchatel
Presenter: Zeke Thackray
Title: Data Carving and Making Sense of the Unknown
During this session attendees will be introduced to the fundamental elements of data carving and making
sense of the unknown within cellular technology. Although the automated mobile forensic products identify
large volumes of “low hanging fruit (evidence)” much more is left behind. Attendees will gain hands on
practical experience to identify, recover and decode a variety of information from cellular devices, such as,
image fi les, SMS messages and their associated telephone numbers, date and times. Attendees to this session
will receive a variety of useful software tools and reference material to enhance their cellular
investigations.
Time: Sunday, 2:00 PM – 3:30 PM
Track: Lab Track A
Room: Neuchatel
Presenter: Michael Wilkinson, Champlain College
Title: Identifying the Artifacts and Behavior of an Unknown Application
This lab will focus on identifying the artifacts and behavior of unknown applications. Many times you will
run across an app you might not have seen before and you want to know what traces it leaves on the system.
What information that is left has meaning and what does not. We will focus on developing results that
are robust enough to stand up in court and more emphasis on decoding fi le structures so you are prepared.
Time: Sunday, 4:00 PM – 5:30 PM
Track: Lab Track A
Room: Neuchatel
Presenter: Don Brister, BlackBag Technologies, Inc.
Title: iOS Forensics and Top Five Artifacts
iPhone, iPad, and iPod Touch device popularity has introduced unique forensics and corporate policy enforcement
challenges. Examiners must understand the attributes and fi le types unique to Mac OS X and
iOS fi le systems. If your casework involves examining geo-location and EXIF camera metadata, evidence of
device wiping, or SMS, contacts, and phone call data marked for deletion in SQLite databases, then this lab is
for you. Attendees will gain valuable insight into the ever-evolving forensics challenges associated with iOS
devices, and learn ways to conduct highly effi cient and eff ective Mac OS X and iOS device investigations.
Lab Track B
Sunday, November 4th, 2012
Time: Sunday, 9:00 AM – 10:00 AM
Track: Lab Track B
Room: Geneve
Presenter: Glenn K Bard, PATCtech
Title: iPhone Backup Data Parsing
In this lab the attendee will be introduced to iOS backup analysis. The class will begin with identifying the
locations of iOS backups on various Operating Systems to include Windows XP, Vista and 7 as well as Mac.
Once the backups are located the folder structure will be forensically extracted from the suspect computer.
The students will then be introduced to how the backup fi les store the information on the computer system.
The class will then end with various tools ranging from free and inexpensive to full forensic applications, all
capable of extracting diff erent types of data from the backups and deconstructing various fi les into usable
information.