On today’s modern smartphones, evidence of absence doesn’t always mean a complete absence of evidence. Even though users may delete third-party applications from their iOS and Android devices, there may still be lot of trace evidence points left behind to show that artifacts existed on the device at one time.
This talk will discuss ways to track applications that may have been installed previously, and how and when they were used. Artifacts including Google Play searches, installation logs, network connection logs, and usage statistics will be used to timeline the events of applications, even if they are no longer on the device. For both modern versions of iOS and Android operating systems, we’ll detail ways to track application usage on a device even when the application has been removed. Insights into how this information can provide unexpected leads into your cases will also be discussed.
Alexis Brignoni (@AlexisBrignoni), Researcher, Magnet Forensics
Christopher Vance (@cscottvance), Manager, Magnet Forensics
