Practical Mobile Forensics - Third Edition

Third-party application overview

Third-party applications are an integral part of mobile device investigations; often, the key artifacts seem to exist within an application. This requires the examiner to understand where application data is stored on the device, how application data is saved for that platform, and which tool best helps uncover the evidence. Manual parsing is often a key factor when examining third-party applications on any smartphone. While some commercial tools, such as Magnet IEF, are known for application parsing support, no tool is perfect and it's virtually impossible for tools to keep up with the frequent updates that are released for each application. Most often, you'll find that the commercial tools available parse ...