iPhone Forensics WorkshopSeptember 16-17
Burlington Marriott, Burlington, MA
8:30am - 4:30pm EST
We would like to obtain a discounted rate for all attendees of the iPhone Forensics Workshop, so if you would kindly send us an email indicating you would like to stay at the workshop Hotel, we will negotiate a lower rate for each of you. Click on hotel_reg [ipf_reg@oreilly.com] to send us an email and let us know if you intend to stay at the Burlington Marriott. There is public transportation available from Logan Airport to Anderson RTC and the Marriott has a shuttle from Anderson RTC to their site. Verified Law Enforement Officers, please use the discount code of LawEnforcement [no spaces] to receive your discounted rate. Please bring verification to the Workshop.

The Workshop

Recovering Evidence, Personal Data, and Corporate Assets

Attendees will receive a copy of iPhone Forensics and a USB drive containing the toolkit that they can use to follow along with the hands-on tutorial, learning:

• What kind of evidence is stored on the device
• How to prepare an environment for iPhone forensics
• Breaking v1.x and v2.x passcode-protected iPhones to gain access to the device
• Building a custom recovery toolkit for the iPhone
• Interrupting the iPhone 3G's "secure wipe" process
• Data recovery of a v1.x and v2.x iPhone user disk partition, preserving and recovering the entire raw user disk partition
• Recovering deleted voicemail, images, email, and other personal data using data carving techniques
• Recovering geotagged metadata from camera photos
• Electronic discovery of Google map lookups, typing cache, and other data stored on the live file system
• Extracting contact information and other data from the iPhone's database
• Collecting desktop trace and establishing trusted relationships to owners' desktops
• Different recovery strategies based on case needs

Using the tools and know-how provided in this workshop, you'll work hands-on to recover stored and deleted information from the iPhone including:

• Keyboard caches containing usernames, passwords, search terms, and historical fragments of typed communication
• Screenshots preserved from the last state of an application, taken whenever the home button is pressed or an application is exited
• Deleted images from the suspect's photo library, camera roll, and browsing cache
• Deleted address book entries, contacts, calendar events, and other personal data
• Exhaustive call history, beyond that displayed
• Map tile images from the iPhone's Google Maps application, lookups and longitude/latitude coordinates of previous map searches, and coordinates of the last GPS fix
• Browser cache and deleted browser objects, which identify the websites a user has visited
• Cached and deleted email messages, SMS messages, and other communication with corresponding time stamps
• Deleted voicemail recordings stored on the device
• Pairing records establishing trusted relationships between the device and one or more desktop computers

In addition, Jonathan will walk you through many common corporate and crime scene scenarios and describe the kind of data that will prove most useful in your investigation. A Q/A session will conclude the conference as time permits. Classroom assistants will be available to help during all classes.

Coffee and a light lunch fare will be served. Be sure to bring a Mac or Windows laptop (Mac preferred) and an iPhone if you would like to follow along. Do not bring live evidence.