Every Step You Take: Application and Network Usage in Android - SANS DFIR Summit 2018

Every step you take, every move you make, your device and the network are watching you! We will explore artifacts that demonstrate applications and network usage and how those data points can be used to track activity by a mobile device down to (at times) the millisecond. Our research and presentation will demonstrate and show practical ways to correlate data from the device with network data from a mobile device in order to tell the full story of what happens. The presentation will include case studies, and we’ll also debut scripts that can be used to help you utilize these skills on your cases. Jessica Hyde (@B1N2H3X) Director, Digital Forensics/Adjunct Professor, Magnet Forensics, George Mason University