Chapter 7: Analyzing Connectivity Data
In the previous chapter, we introduced location-related artifacts and learned how an investigation can leverage such data to obtain a general geographical location of where the device may have been. In this chapter, we will focus on connectivity data.
The modern mobile phone has evolved from being a simple handheld device that's used to communicate via voice into a mobile computing device that communicates with the internet. Almost every interaction between a device and the external world is logged by the operating system, so it shouldn't come as a surprise that connectivity data has become the single most important source of evidence in virtually every type of investigation: artifacts such as call logs and internet navigation history are invaluable for the modern investigator.
We'll start this chapter by looking at cellular-related artifacts, contacts, and phone calls, including FaceTime videocalls. Then, we'll learn...
