BlackBerry analysis

BlackBerry devices are still used by employees of major corporations due to the great security features. eDiscovery cases often require the examiner to be well versed in extracting and analyzing data from computers, servers, and smartphones such as BlackBerry devices. Commercial tools are available for the analysis of BlackBerry devices. The method of acquisition will determine the amount of analysis possible by the examiner. For example, a physical acquisition may have been obtained, but the forensic tool does not automatically parse the data in the image file. This requires the examiner to manually carve and reconstruct the data. BlackBerry devices are one of the most complicated smartphones to understand and consistently reconstruct by manual examination. The previous section provided some steps to successfully extracting data from BlackBerry devices. The acquisition steps should be followed to ensure that data is not missed. Multiple acquisitions may be required...