iPhone Forensics Workshop

iPhone Forensics WorkshopSeptember 16-17
Burlington Marriott, Burlington, MA
8:30am - 4:30pm EST
We would like to obtain a discounted rate for all attendees of the iPhone Forensics Workshop, so if you would kindly send us an email indicating you would like to stay at the workshop Hotel, we will negotiate a lower rate for each of you. Click on hotel_reg [ipf_reg@oreilly.com] to send us an email and let us know if you intend to stay at the Burlington Marriott. There is public transportation available from Logan Airport to Anderson RTC and the Marriott has a shuttle from Anderson RTC to their site. Verified Law Enforement Officers, please use the discount code of LawEnforcement [no spaces] to receive your discounted rate. Please bring verification to the Workshop.

The Workshop

Recovering Evidence, Personal Data, and Corporate Assets

Attendees will receive a copy of iPhone Forensics and a USB drive containing the toolkit that they can use to follow along with the hands-on tutorial, learning:

• What kind of evidence is stored on the device
• How to prepare an environment for iPhone forensics
• Breaking v1.x and v2.x passcode-protected iPhones to gain access to the device
• Building a custom recovery toolkit for the iPhone
• Interrupting the iPhone 3G's "secure wipe" process
• Data recovery of a v1.x and v2.x iPhone user disk partition, preserving and recovering the entire raw user disk partition
• Recovering deleted voicemail, images, email, and other personal data using data carving techniques
• Recovering geotagged metadata from camera photos
• Electronic discovery of Google map lookups, typing cache, and other data stored on the live file system
• Extracting contact information and other data from the iPhone's database
• Collecting desktop trace and establishing trusted relationships to owners' desktops
• Different recovery strategies based on case needs

Using the tools and know-how provided in this workshop, you'll work hands-on to recover stored and deleted information from the iPhone including:

• Keyboard caches containing usernames, passwords, search terms, and historical fragments of typed communication
• Screenshots preserved from the last state of an application, taken whenever the home button is pressed or an application is exited
• Deleted images from the suspect's photo library, camera roll, and browsing cache
• Deleted address book entries, contacts, calendar events, and other personal data
• Exhaustive call history, beyond that displayed
• Map tile images from the iPhone's Google Maps application, lookups and longitude/latitude coordinates of previous map searches, and coordinates of the last GPS fix
• Browser cache and deleted browser objects, which identify the websites a user has visited
• Cached and deleted email messages, SMS messages, and other communication with corresponding time stamps
• Deleted voicemail recordings stored on the device
• Pairing records establishing trusted relationships between the device and one or more desktop computers

In addition, Jonathan will walk you through many common corporate and crime scene scenarios and describe the kind of data that will prove most useful in your investigation. A Q/A session will conclude the conference as time permits. Classroom assistants will be available to help during all classes.

Coffee and a light lunch fare will be served. Be sure to bring a Mac or Windows laptop (Mac preferred) and an iPhone if you would like to follow along. Do not bring live evidence.

 

Tuesday, September 16, 2008 at 9:00 AM
- to -
Wednesday, September 17, 2008 at 5:00 PM (ET)

Add to my calendar

Boston MA
Burlington Mariott, Burlington MA
One Burlington Mall Road
Burlington, MA 01803

Other Maps:

Yahoo | Mapquest | Microsoft

O'Reilly Media and Microsoft

About O'Reilly
O'Reilly Media spreads the knowledge of innovators through its books, online services, magazines, and conferences. Since 1978, O'Reilly has been a chronicler and catalyst of leading-edge development, homing in on the technology trends that really matter and spurring their adoption by amplifying "faint signals" from the alpha geeks who are creating the future. An active participant in the technology community, the company has a long history of advocacy, meme-making, and evangelism.

About Microsoft
Founded in 1975, Microsoft (Nasdaq "MSFT") is the worldwide leader in software, services and solutions that help people and businesses realize their full potential.

 

	View other O'Reilly Media and Microsoft events
	Contact the Host
	Subscribe to receive notifications of future events by this host View XML Feed Subscribe to RSS Feed Subscribe to Atom Feed Add to Google Add to My Yahoo! Add to My AOL Add to My MSN