Advanced iPhone Forensics Workshop

Recovering Evidence, Personal Data, and Corporate Assets

The iPhone has become America's #1 mobile device, and is increasingly being used in business, personal activities, and also crime. iPhones store an enormous amount of information useful to corporate security professionals and law enforcement agents. Enterprises must adequately manage sensitive data which may put their company at risk. Law enforcement agencies and freelance forensic examiners must process the iPhone for evidence linking its owner to crimes. 

Join us as Jonathan Zdziarski, iPhone forensics expert and author of many iPhone books including iPhone Forensics andiPhone SDK Application Development, leads your organization's security professionals through the delicate process of recovering and processing evidence stored on the iPhone. This two-day workshop will guide you, hands on, through forensic examination of iPhone, iPhone 3G, and iPhone 3G[s] devices covering iPhoneOS v1.x, v2.x, up to the latest v3.1.2 software. Attendees will receive a special iPhone forensic guide and access to automated tools used in the field by hundreds of law enforcement agencies. All of the tools and demo content will also be provided so attendees can learn and explore hands-on. Join us and follow along hands-on to learn:

• What kind of evidence is stored on the device
• How to prepare an environment for iPhone forensics
• Circumventing passcode protection and encrypted backups to gain access to the device
• Building a custom recovery toolkit for the iPhone
• Interrupting the iPhone's "secure wipe" process
• Data recovery of an iPhone user disk partition, preserving and recovering the entire raw user disk partition. Recovery over USB cable and Wi-Fi will be demonstrated.
• Recovering deleted voicemail, images, email, and other personal data using data carving techniques
• Recovering geotagged metadata from camera photos (GPS coordinates taken at the time the photo was taken)
• Electronic discovery of Google map lookups, keyboard typing cache, and other data stored on the live file system
• Extracting contact information and other data from the iPhone's database
• Collecting desktop trace and establishing trusted relationships to owners' desktops
• Different recovery strategies based on case needs

• Keyboard caches containing usernames, passwords, search terms, and historical fragments of typed communication.
• Screenshots preserved from the last state of an application, taken whenever the home button is pressed or an application is exited.
• Deleted images from the suspect's photo library, camera roll, and browsing cache.
• Deleted address book entries, contacts, calendar events, and other personal data.
• Exhaustive call history, beyond that displayed.
• Map tile images from the iPhone's Google Maps application, lookups and longitude/latitude coordinates of previous map searches, and coordinates of the last GPS fix.
• Browser cache and deleted browser objects, which identify the web sites a user has visited.
• Cached and deleted email messages, SMS messages, and other communication with corresponding time stamps.
• Deleted voicemail recordings stored on the device.
• Pairing records establishing trusted relationships between the device and one or more desktop computers.

• Mac OS X 10.5.7
• iTunes 8.1.1
• [Optional] An iPhone, iPhone 3G, or iPhone 3G[s] running firmware v1.0.2 - 3.1.2

Don't miss the opportunity to have your personnel trained by the leading expert in iPhone forensic examination. Register today, as space is limited.