O'Reilly Master Class: Zdziarski on iPhone Forensics May 26, 2009

---

Recovering Evidence, Personal Data, and Corporate Assets

This highly specialized two-day forensics workshop teaches you how to recover, process, and remove sensitive data stored on the iPhone, iPhone 3G, and iPod Touch.
Led by author and data forensics expert Jonathan Zdziarski,
this workshop helps you:

Determine
what kind of evidence is stored on the device
Prepare
an environment for iPhone forensics
Break
v1.x and v2.x passcode-protected iPhones to gain access to the device
Build
a custom recovery toolkit for the iPhone
Interrupt
iPhone 3G's secure wipe process
Conduct
data recovery of a v1.x and v2.x iPhone user disk partition, and preserve and
recover the entire raw user disk partition
Recover
deleted voicemail, images, email, and other personal data using data carving
techniques
Recover
geotagged metadata from camera photos
Discover
Google map lookups, typing cache, and other data stored on the live file system
Extract
contact information and other data from the iPhone's database
Collect desktop trace and establish trusted relationships to owners' desktops
Use
different recovery strategies based on case needs

Using the tools and know-how provided in this workshop, you'll work hands-on to recover stored and deleted information from the iPhone including:

Keyboard caches containing usernames, passwords, search terms, and historical fragments of typed communication
Screenshots preserved from the last state of an application, taken whenever the home button is pressed or an application is exited
Deleted images from the suspect's photo library, camera roll, and browsing cache
Deleted address book entries, contacts, calendar events, and other personal data
Exhaustive call history, beyond that displayed
Map tile images from the iPhone's Google Maps application, lookups and longitude/latitude coordinates of previous map searches, and coordinates of the last GPS fix
Browser cache and deleted browser objects, which identify the websites a user has visited
Cached and deleted email messages, SMS messages, and other communication with corresponding time stamps
Deleted voicemail recordings stored on the device
Pairing records establishing trusted relationships between the device and one or more desktop computers

Jonathan Zdziarski developed
this workshop based on the contents of his new book, iPhone Forensics (OReilly Media, September 2008). As a
part of your enrollment, youll receive a copy of the book to help you follow
the workshop presentations. Youll also receive a USB drive containing the
forensics toolkit Zdziarski uses.Be sure to bring a Mac or Windows laptop (Mac preferred) and an iPhone if you would like to follow along. Do not bring live evidence.



Organized by O'Reilly Media
O'Reilly Media spreads the knowledge of innovators through its books, online services, magazines, and conferences. Since 1978, O'Reilly has been a chronicler and catalyst of leading-edge development, homing in on the technology trends that really matter and spurring their adoption by amplifying "faint signals" from the alpha geeks who are creating the future. An active participant in the technology community, the company has a long history of advocacy, meme-making, and evangelism.

---

Ticket Info:  

• General Enrollment, $3,500.00
• Vetted law enforcement professionals and government employees, $2,500.00

Official Website: http://oreillyiphoneforensics-upcoming.eventbrite.com