Forensic methods used to extract third-party application data

Almost all commercial tools will attempt to support the extraction of third-party applications. We recommend that you test your tools thoroughly and often, if you rely on tool output for your investigative results. This is because the apps are updated so frequently that it is nearly impossible for the tools not to miss something. You must learn about the applications, how they work, and how the devices store data for each app. We strongly recommend that you use your tool to triage the case and then dive into the data to manually extract anything that the tools miss. Make sure that you only include factual data in your forensic report and not everything that the tools parse, as the tools cannot decipher the difference between device and human creation. Only a trained examiner can do this with confidence.

Commercial tools

As you have seen in this book, there are many tools that can handle the job of smartphone forensics. However,...