3 ms·
A point of contention as someone who uses write blockers and forensic tools... write blockers protect the connection of dumb storage to a computer but a phone i
by WrtCdEvrydy 5y ago
A point of contention as someone who uses write blockers and forensic tools... write blockers protect the connection of dumb storage to a computer but a phone is not a dumb storage device (it's not a SATA drive), it's actually a full device which manages it's own storage.
For mobile forensics, it's actually done through the built-in backup systems included in each of the major OS providers (Android/iOS).
This is a back and forth that has been ongoing since we began moving away from Hard Disks, as SSDs tend to manage their own internal state so an image of "an SSD" can change even if the underlying media hasn't changed as the SSD cell balancing can actually shift around deleted data or delay to clear certain cells.
- ycomnews2021 5y agoThese are great points. Thanks!
- WrtCdEvrydy 5y agoWell, I'm a forensics researcher, so thank you. If you'd like to know about the current issues around mobile device acquisition, you can check this out (https://ieeexplore.ieee.org/document/9116458 https://ieeexplore.ieee.org/document/9116458) which contains the last paper I wrote on the latest issues on iOS and Android acquisitions. Although I'd love to blame the big bad Cellebrite and the big bad police departments for junk science, computer forensics is quick to dismiss scientifically unsound items so I would expect a response from Cellebrite soon.