This presentation will discuss the various artifacts created on Android mobile devices when applications are installed and linked to a user account. Additionally, it will cover some of the artifacts left behind after those accounts are disconnected from their applications, as well as artifacts remaining after the application is uninstalled from the device. Specific programs that will be discussed are: • Facebook • LinkedIn • Tumblr • Twitte 1. Introduction to Mobile Device Forensics a. What is a Mobile Device? b. What is Generally Available? i. Easily? ii. Somewhat Difficult? iii. Very In-depth? 2. Specific Details About Study/Analysis a. Phone OS/Model Tested b. Tools Utilized for Exam c. Application Versions d. Statistics on Popularity of Applications Analyzed 3. Artifacts Available While Accounts are Logged In a. Facebook b. LinkedIn c. Tumblr d. Twitter 4. Artifacts Available While Accounts are Logged Out a. Facebook b. LinkedIn c. Tumblr d. Twitter 5. Artifacts Available After Applications Have Been Uninstalled a. Facebook b. LinkedIn c. Tumblr d. Twitter 6. Conclusion 7. Q&A Ryan Ferreira is an associate forensic examiner with One Source Discovery. He specializes in mobile device forensics and has analyzed mobile devices for dozens of legal matters. He is a certified computer examiner, certified mobile examiner, and has presented at CLE seminars and for related associations on various digital forensic topics.

Back to Louisville InfoSec 2013 video list