YOU. HAVE. TO. KNOW. HOW. YOUR. TOOLS. WORK.
Whoever you are. Whatever you do. You have to know how your tools work.
For example, I've been trying to reduce my phone time, so I got an app for that. After a mad dash run to the airport to swap rental car (flat tire 😡 😭 ), I got a pop-up for using my phone for two hours straight. What the heck? I took a look at the app (my tool in this case), and even though my phone screen was off, it was still measuring the time the apps were running; I had the GPS and an Audiobook going at the same time. I checked the stats, and sure enough, there it was. I learned my tool tracks time even if the screen is OFF. Do I get a new tool or just account for that? If I'm constantly using the GPS and listing to books it's not the best tool for me.
I'm saying all of this to demonstrate to you how not knowing how your tool works can easily give you the wrong answer.
That's why push button forensics will never cut it. NEVER. Yes, leverage automation to filter through the data. But we still have to know the HOW and the WHY that piece of data was presented by the tool. Then, we must be prepared to stand up in court and state the how, the why, and the significance.
It's not a sprint. It's a marathon.
#DigitalForensics #Forensicator #MobileForensics #DFIR