Welcome to Mobile4n6
Mobile4n6 and, coming soon, mobile4n6.com is my latest foray into posting, talking about, and engaging others about mobile device forensics and related topics. My goal is not to try and replace any or all of the other great sources of information and discussion about mobile device forensics but, rather, to add to it in hopefully a meaningful way. Each of us in the DFIR world have unique experiences, perspectives, and methods which just might help others similarly situated. Rather than have it buried in email chains, listservs, or forums, I wanted a “medium” (see what I did there?) to share to a wider audience. I happened to see that the mobile4n6.com domain was available so I snatched it up. I hope to get it connected to this Medium publication soon, possibly as a sub-domain. Until then, please follow here on Medium.
Who Am I?
I’m just a guy employed in the DFIR field doing a bit of mobile device forensics. If you want to know more about me, please see my LinkedIn profile. With that said, any information or discussion on this site will be sanitized to make sure that no confidential case information or other non-public information is revealed. I also reserve the right to take down any previously published information in case of inadvertent leakage. Please keep in mind that I cannot expand on certain things in my work cases for obvious reasons (see my LinkedIn profile). Also, my posts here are my own and do not necessarily reflect the opinions, policies, or procedures of my employer or any other organization with which I may associate. Basically, this is me, not them.
I have about 5 years of experience with mobile device forensics. When I started, my organization had a Cellebrite UFED Classic. My boss knew that I enjoyed hacking away on my Palm Pre and, later, my HTC Evo. She needed someone to take over the quick contact/call logs/text message dumping duties that were tying up the actual digital forensic examiners’ time and slowing them down. Therefore, I got that ancillary duty in addition to my other duties. That blossomed to much larger responsibilities as the various tools, both commercial and free, gained abilities. The word also spread around my organization that we could get deleted stuff off of phones and our mobile device intake took off exponentially. Eventually, I attended the IACIS BCFE training in Florida in 2013 and later attained my CFCE certification which was required to be a full-time digital forensic examiner in our shop. Since then, I’ve completed a lot more training, got a few certifications, and have examined hundreds of additional devices. From BitPim to UFED4PC, Zdziarski scripts to Oxygen Forensic Detective, I’ve used, and still use, a lot of tools.
Incidentally, I am also a Community SANS instructor for both their Advanced Smartphone Forensics course (FOR585) and their Windows Forensic Analysis course (FOR408). I highly recommend both courses and their respective GIAC certifications (GASF and GCFE).
