WEBVTT

1
00:00:00.160 --> 00:00:05.280
<v Speaker 1>Welcome to our deep dive into the world of iOS forensics.

2
00:00:05.480 --> 00:00:11.640
<v Speaker 1>Wo We're going to be exploring how investigators uncovered digital

3
00:00:11.720 --> 00:00:17.280
<v Speaker 1>clues from iPhones. We're using academic excerpts, technical guides, and

4
00:00:17.399 --> 00:00:18.879
<v Speaker 1>real world case studies.

5
00:00:19.000 --> 00:00:19.440
<v Speaker 2>Sounds good.

6
00:00:19.559 --> 00:00:21.839
<v Speaker 1>We're going to skip all the jargon and jump straight

7
00:00:21.879 --> 00:00:25.320
<v Speaker 1>in the fascinating Stuck ever, wonder what secrets your iPhone

8
00:00:25.399 --> 00:00:25.960
<v Speaker 1>might be hiding?

9
00:00:26.280 --> 00:00:30.760
<v Speaker 2>Well, think of it like this. Your iPhone is a witness, okay,

10
00:00:31.000 --> 00:00:34.439
<v Speaker 2>silently observing your every move and interaction.

11
00:00:34.840 --> 00:00:35.280
<v Speaker 1>Gotcha.

12
00:00:35.799 --> 00:00:40.439
<v Speaker 2>We'll delve into how investigators extract those observations and piece

13
00:00:40.439 --> 00:00:43.240
<v Speaker 2>them together to paint a picture of what really happened.

14
00:00:43.280 --> 00:00:46.000
<v Speaker 1>You know, I use my iPhone for everything, but I

15
00:00:46.119 --> 00:00:49.000
<v Speaker 1>rarely think about that the trail of data I'm leaving behind.

16
00:00:49.560 --> 00:00:53.000
<v Speaker 1>So how does an investigator actually approach an iPhone? Well,

17
00:00:53.399 --> 00:00:55.600
<v Speaker 1>it's not as simple as plugging it in and downloading everything.

18
00:00:55.640 --> 00:00:59.039
<v Speaker 2>No, not quite. It's a methodical process, Okay, starting with

19
00:00:59.520 --> 00:01:04.120
<v Speaker 2>season and isolating the device to prevent tampering. Think of

20
00:01:04.159 --> 00:01:08.159
<v Speaker 2>it like securing a crime scene. Then comes the acquisition phase,

21
00:01:08.599 --> 00:01:11.840
<v Speaker 2>where investigators try to obtain a copy.

22
00:01:11.480 --> 00:01:14.400
<v Speaker 1>Of the data. Okay, let's unpack that. Sure, what are

23
00:01:14.439 --> 00:01:17.040
<v Speaker 1>the different ways to acquire data from an iPhone?

24
00:01:17.840 --> 00:01:22.159
<v Speaker 2>Imagine a house with multiple levels of access. A logical

25
00:01:22.200 --> 00:01:26.079
<v Speaker 2>acquisition is like entering through the front door. You get

26
00:01:26.120 --> 00:01:33.040
<v Speaker 2>access to files the user intended to be accessible, like contacts, messages, photos.

27
00:01:33.719 --> 00:01:36.920
<v Speaker 2>A file system acquisition is like getting a key to

28
00:01:37.000 --> 00:01:39.439
<v Speaker 2>the back door, allowing you to see more of the

29
00:01:39.519 --> 00:01:43.920
<v Speaker 2>underlying structure and data. And then there's physical acquisition. Yea,

30
00:01:44.159 --> 00:01:46.560
<v Speaker 2>the most comprehensive and also the most challenging.

31
00:01:46.599 --> 00:01:50.319
<v Speaker 1>Physical acquisition sounds intense. Yeah, is that even possible? With

32
00:01:50.359 --> 00:01:52.840
<v Speaker 1>all the security measures on iPhones.

33
00:01:52.359 --> 00:01:56.879
<v Speaker 2>It's becoming increasingly difficult, especially with newer models. Physical acquisition

34
00:01:57.000 --> 00:02:01.280
<v Speaker 2>is often limited to older devices with no vulnerabilities. But

35
00:02:01.480 --> 00:02:08.479
<v Speaker 2>even with logical or filesystem acquisition, maintaining data integrity is crucial, right,

36
00:02:09.120 --> 00:02:13.840
<v Speaker 2>every step is documented and validated, gotcha, to ensure nothing

37
00:02:13.879 --> 00:02:16.680
<v Speaker 2>is altered. Okay, preserving the evidence.

38
00:02:16.280 --> 00:02:18.840
<v Speaker 1>Re court, That makes sense. Yeah, you wouldn't want a

39
00:02:18.840 --> 00:02:21.599
<v Speaker 1>case thrown out because of a sloppy procedure, for sure.

40
00:02:22.039 --> 00:02:25.439
<v Speaker 1>So let's talk about the data itself. Okay, my iPhone

41
00:02:25.439 --> 00:02:28.759
<v Speaker 1>feels like apps and photos. Yeah, but I'm intrigued by

42
00:02:28.840 --> 00:02:33.439
<v Speaker 1>this KNOWLEDGEC dot dB thing. Right, what's hiding in that database?

43
00:02:33.599 --> 00:02:37.039
<v Speaker 2>Knowledgec dot dB is like your iPhone's secret diary.

44
00:02:37.240 --> 00:02:37.719
<v Speaker 1>Oh wow.

45
00:02:37.800 --> 00:02:41.360
<v Speaker 2>It logs a vast array of activities, from when you

46
00:02:41.479 --> 00:02:45.800
<v Speaker 2>use specific apps to how long you use them. Even

47
00:02:46.080 --> 00:02:51.159
<v Speaker 2>seemingly mundane details like your battery temperature battery, Yeah, what could.

48
00:02:51.039 --> 00:02:52.039
<v Speaker 1>That possibly reveal?

49
00:02:52.199 --> 00:02:56.199
<v Speaker 2>Believe it or not? Really, even seemingly insignificant details can

50
00:02:56.240 --> 00:03:00.840
<v Speaker 2>become crucial clues. For example, a sudden spy in battery

51
00:03:00.879 --> 00:03:04.840
<v Speaker 2>temperature I indicate the phone was being used intensively at

52
00:03:04.879 --> 00:03:09.080
<v Speaker 2>a specific time, perhaps to delete large amounts of data

53
00:03:09.240 --> 00:03:12.960
<v Speaker 2>or communicate rapidly. When combined with other evidence, this could

54
00:03:12.960 --> 00:03:13.919
<v Speaker 2>be quite revealing.

55
00:03:14.280 --> 00:03:18.719
<v Speaker 1>Wow, I'm starting to see how investigators connect these seemingly

56
00:03:18.800 --> 00:03:19.759
<v Speaker 1>unrelated dots.

57
00:03:19.919 --> 00:03:20.360
<v Speaker 2>Yeah.

58
00:03:20.400 --> 00:03:24.680
<v Speaker 1>Speaking of connections, location data must be a big one, right,

59
00:03:24.680 --> 00:03:27.439
<v Speaker 1>It's huge. My iPhone seems to know where I am.

60
00:03:27.599 --> 00:03:31.599
<v Speaker 2>Yes, even when GPS is off precisely. iPhones use a

61
00:03:31.639 --> 00:03:37.039
<v Speaker 2>combination of GPS, cell tower triangulation, and even Wi Fi

62
00:03:37.159 --> 00:03:41.479
<v Speaker 2>networks to determine your location. Okay, it's constantly gathering this information,

63
00:03:41.960 --> 00:03:44.919
<v Speaker 2>some of which is shared with Apple in the form

64
00:03:44.960 --> 00:03:46.479
<v Speaker 2>of harvested locations.

65
00:03:46.479 --> 00:03:50.000
<v Speaker 1>Harvested locations, Yes, that sounds a bit ominous. Is my

66
00:03:50.080 --> 00:03:51.840
<v Speaker 1>iPhone spying on me? For Apple?

67
00:03:52.039 --> 00:03:55.919
<v Speaker 2>Think of it as your iPhone contributing to Apple's crowdsource

68
00:03:56.199 --> 00:04:02.240
<v Speaker 2>location database. Okay, it helps improve location services for everyone. However,

69
00:04:03.080 --> 00:04:08.520
<v Speaker 2>that same data can become incredibly valuable for investigators. Imagine

70
00:04:08.520 --> 00:04:11.560
<v Speaker 2>a suspect claiming they were never near a crime scene,

71
00:04:11.879 --> 00:04:16.639
<v Speaker 2>but their iPhone's harvested location data places them right there.

72
00:04:17.040 --> 00:04:18.839
<v Speaker 2>Oh wow, at the time of the incident.

73
00:04:19.360 --> 00:04:22.439
<v Speaker 1>Okay, that's a bit unsettling, but also fascinating. Yeah, so

74
00:04:22.560 --> 00:04:25.959
<v Speaker 1>my iPhone knows where I go, and so does Apple

75
00:04:26.879 --> 00:04:28.160
<v Speaker 1>potentially potentially?

76
00:04:28.279 --> 00:04:28.519
<v Speaker 2>Yes?

77
00:04:28.800 --> 00:04:32.279
<v Speaker 1>Is there anything else that's tracking without my knowledge?

78
00:04:32.519 --> 00:04:37.120
<v Speaker 2>There's also the significant Locations feature, oh right, which automatically

79
00:04:37.160 --> 00:04:41.160
<v Speaker 2>remembers places you visit frequently, building a detailed map of

80
00:04:41.199 --> 00:04:41.839
<v Speaker 2>your routine.

81
00:04:42.079 --> 00:04:42.319
<v Speaker 1>Yeah.

82
00:04:42.399 --> 00:04:46.360
<v Speaker 2>This data can be incredibly revealing for investigators trying to

83
00:04:46.480 --> 00:04:51.040
<v Speaker 2>establish patterns of behavior or corroborate alibis. Do you remember

84
00:04:51.040 --> 00:04:54.199
<v Speaker 2>that coffee shop you mentioned earlier? Your iPhone remembers it too.

85
00:04:54.519 --> 00:04:56.680
<v Speaker 1>All right, I'm starting to feel like I should be

86
00:04:56.720 --> 00:04:59.560
<v Speaker 1>more mindful of my digital footprint. Yeah, for sure, But

87
00:05:00.120 --> 00:05:02.800
<v Speaker 1>let's be realistic. Of course, we all love our apps,

88
00:05:03.360 --> 00:05:06.759
<v Speaker 1>do investigators actually dive into those they do, they must

89
00:05:06.800 --> 00:05:08.160
<v Speaker 1>be a nightmare to analyze.

90
00:05:08.199 --> 00:05:12.319
<v Speaker 2>They can be, but app data is often crucial. Think

91
00:05:12.360 --> 00:05:18.120
<v Speaker 2>about it. Social media activity, messaging conversations, even productivity tools.

92
00:05:18.680 --> 00:05:22.279
<v Speaker 2>They all hold potential evidence. While some of this data

93
00:05:22.439 --> 00:05:27.439
<v Speaker 2>is readily accessible, other times it requires more advanced techniques.

94
00:05:27.040 --> 00:05:30.399
<v Speaker 1>Advance how like, are we talking hacking into the apps code?

95
00:05:30.600 --> 00:05:34.360
<v Speaker 2>Sometimes it involves techniques like reverse engineering, but there are

96
00:05:34.399 --> 00:05:39.920
<v Speaker 2>also tools designed specifically for forensic analysis. For example, Freshman

97
00:05:40.480 --> 00:05:45.160
<v Speaker 2>allows investigators to monitor every file and app accesses oh wow,

98
00:05:45.199 --> 00:05:50.920
<v Speaker 2>while proxy inter proxy intercepts the apps network traffic, showing

99
00:05:51.120 --> 00:05:53.199
<v Speaker 2>what data is being sent and received.

100
00:05:53.240 --> 00:05:56.279
<v Speaker 1>So even if an app tries to be sneaky with

101
00:05:56.399 --> 00:05:59.279
<v Speaker 1>its data, investigators have ways to catch.

102
00:05:59.120 --> 00:06:01.839
<v Speaker 2>It to a certain extent. Yes, okay, but it's a

103
00:06:01.920 --> 00:06:05.600
<v Speaker 2>constant cat and mouse game as app developers try to

104
00:06:05.639 --> 00:06:09.839
<v Speaker 2>protect user data and encryption methods are evolving rapidly.

105
00:06:10.160 --> 00:06:15.000
<v Speaker 1>Speaking of encryption, iPhones are known for being pretty locked down. Yeah,

106
00:06:16.000 --> 00:06:17.519
<v Speaker 1>how do investigators get past that?

107
00:06:17.759 --> 00:06:18.000
<v Speaker 2>Well?

108
00:06:18.120 --> 00:06:19.959
<v Speaker 1>Cracking the passcode or are there are other ways?

109
00:06:20.240 --> 00:06:24.279
<v Speaker 2>Brueforcing passcodes is an option, but it can be time consuming,

110
00:06:24.439 --> 00:06:28.439
<v Speaker 2>especially with strong passwords. There's also the possibility of exploiting

111
00:06:28.480 --> 00:06:32.920
<v Speaker 2>vulnerabilities like the check M eight exploit that affects certain

112
00:06:33.000 --> 00:06:33.759
<v Speaker 2>older iPhones.

113
00:06:33.759 --> 00:06:35.639
<v Speaker 1>Does that mean instant access to the phone?

114
00:06:35.680 --> 00:06:36.279
<v Speaker 2>Not exactly.

115
00:06:36.399 --> 00:06:36.680
<v Speaker 1>Okay.

116
00:06:37.000 --> 00:06:42.199
<v Speaker 2>CHECKMA allows for what's called before first unlock or BFU.

117
00:06:41.639 --> 00:06:43.480
<v Speaker 1>Acquisition BFU acquisition.

118
00:06:43.519 --> 00:06:46.439
<v Speaker 2>I think of it like grabbing the evidence before the

119
00:06:46.480 --> 00:06:48.720
<v Speaker 2>phone has a chance to lock itself down.

120
00:06:48.600 --> 00:06:52.240
<v Speaker 1>So you can potentially access data. Yes, even before the

121
00:06:52.279 --> 00:06:53.480
<v Speaker 1>phone has been unlocked.

122
00:06:53.160 --> 00:06:56.120
<v Speaker 2>That's right. Wow, it's a powerful technique. Yeah, but it

123
00:06:56.160 --> 00:06:57.959
<v Speaker 2>only works on specific devices.

124
00:06:58.040 --> 00:06:58.439
<v Speaker 1>Okay.

125
00:06:58.600 --> 00:07:03.720
<v Speaker 2>Newer iPhones require more advanced methods, often involving specialized labs

126
00:07:04.680 --> 00:07:05.800
<v Speaker 2>and expensive equipment.

127
00:07:05.920 --> 00:07:07.959
<v Speaker 1>Okay, so even with vulnerabilities, it's not a walk in

128
00:07:08.000 --> 00:07:08.279
<v Speaker 1>the park.

129
00:07:08.600 --> 00:07:09.120
<v Speaker 2>No, it's not.

130
00:07:09.560 --> 00:07:12.199
<v Speaker 1>What about jail breaking? Okay? I always thought that was

131
00:07:12.240 --> 00:07:15.480
<v Speaker 1>something techies did to customize their phones, Right, How does

132
00:07:15.519 --> 00:07:16.800
<v Speaker 1>that fit into forensics?

133
00:07:16.920 --> 00:07:21.000
<v Speaker 2>Jail breaking in a forensic context is similar, okay, but

134
00:07:21.160 --> 00:07:26.279
<v Speaker 2>the goal is different. It's about bypassing security restrictions, gotcha

135
00:07:26.319 --> 00:07:30.000
<v Speaker 2>to extract data okay that wouldn't be accessible otherwise.

136
00:07:30.399 --> 00:07:33.639
<v Speaker 1>So are investigators using tools like check grand one in, Yes,

137
00:07:33.720 --> 00:07:35.480
<v Speaker 1>the ones you see in online forums.

138
00:07:35.800 --> 00:07:39.480
<v Speaker 2>Tools like check grand one in can be used, but

139
00:07:39.639 --> 00:07:43.120
<v Speaker 2>it's important to emphasize that this is done within a

140
00:07:43.240 --> 00:07:48.639
<v Speaker 2>strict legal framework and with proper authorization. It's not the

141
00:07:48.680 --> 00:07:52.720
<v Speaker 2>same as someone jail breaking their phone to install pirated apps.

142
00:07:52.839 --> 00:07:56.079
<v Speaker 1>Big difference, huge difference. So let's say investigators have gotten

143
00:07:56.079 --> 00:07:58.439
<v Speaker 1>through all that, what happens to the data?

144
00:07:58.600 --> 00:07:58.759
<v Speaker 2>Wow?

145
00:07:59.279 --> 00:08:02.399
<v Speaker 1>It's not just about peaking at messages, is it? They

146
00:08:02.439 --> 00:08:03.839
<v Speaker 1>need to present this as evidence.

147
00:08:03.959 --> 00:08:06.759
<v Speaker 2>Absolutely. The final step is reporting.

148
00:08:07.000 --> 00:08:09.240
<v Speaker 1>Okay, and it's crucial gotcha.

149
00:08:09.480 --> 00:08:17.639
<v Speaker 2>Investigators meticulously document their findings, ensuring accuracy, impartiality, and technical clarity.

150
00:08:18.439 --> 00:08:23.000
<v Speaker 2>These reports can be used in court, internal investigations, or

151
00:08:23.040 --> 00:08:27.040
<v Speaker 2>even shared with victims to help them understand what happened.

152
00:08:27.319 --> 00:08:31.079
<v Speaker 1>I imagine those reports can get pretty expensive. They can, especially

153
00:08:31.120 --> 00:08:33.960
<v Speaker 1>with all the data we've been talking about. Definitely, are

154
00:08:33.960 --> 00:08:36.399
<v Speaker 1>there tools that help with this process?

155
00:08:36.759 --> 00:08:37.039
<v Speaker 2>Yes?

156
00:08:37.159 --> 00:08:38.480
<v Speaker 1>Or is it all manual typing?

157
00:08:38.679 --> 00:08:43.200
<v Speaker 2>There are tools like Celebrate Physical Analyzer, which can automate

158
00:08:43.279 --> 00:08:47.240
<v Speaker 2>certain aspects of report generation. It pulls in the extracted

159
00:08:47.320 --> 00:08:51.840
<v Speaker 2>data and helps create a structured report. However, the human

160
00:08:51.960 --> 00:08:55.519
<v Speaker 2>element remains essential for analysis and interpretation.

161
00:08:55.720 --> 00:08:58.039
<v Speaker 1>So it's not just about the tech, it's about the

162
00:08:58.039 --> 00:09:02.320
<v Speaker 1>investigator's expertise. In connecting the dots and understanding the context

163
00:09:02.360 --> 00:09:05.159
<v Speaker 1>of the evidence. And that's where timelines comeand.

164
00:09:05.360 --> 00:09:09.159
<v Speaker 2>They offer a powerful way to visualize the digital.

165
00:09:08.840 --> 00:09:14.360
<v Speaker 1>Story, presenting the evidence chronologically and revealing patterns that might

166
00:09:14.399 --> 00:09:15.360
<v Speaker 1>otherwise be missed.

167
00:09:15.480 --> 00:09:18.399
<v Speaker 2>Timelines like those charts detectives us in movies.

168
00:09:18.480 --> 00:09:23.039
<v Speaker 1>It's a similar concept, but digital tools like Magnet Axiom

169
00:09:23.200 --> 00:09:30.120
<v Speaker 1>can automatically build timelines from extracted data, showing when messages

170
00:09:30.159 --> 00:09:35.080
<v Speaker 1>were sent, photos taken, locations visited, all in chronological order.

171
00:09:35.200 --> 00:09:38.279
<v Speaker 2>That's amazing. So you can start to see a sequence

172
00:09:38.320 --> 00:09:44.120
<v Speaker 2>of events, yes, potentially linking actions to specific times and places. Right,

173
00:09:44.440 --> 00:09:47.159
<v Speaker 2>this is getting really interesting, it is, but we've covered

174
00:09:47.159 --> 00:09:49.720
<v Speaker 2>a lot of ground already, we have. My mind is

175
00:09:49.720 --> 00:09:53.320
<v Speaker 2>officially blown. Yeah, I need a moment to process all

176
00:09:53.360 --> 00:09:56.279
<v Speaker 2>of this. Okay, let's take a quick pause here. When

177
00:09:56.320 --> 00:10:01.399
<v Speaker 2>we come back, will delve deeper into the world iOS forensics.

178
00:10:01.559 --> 00:10:04.240
<v Speaker 2>Sounds good and uncover even more fascinating insight.

179
00:10:04.399 --> 00:10:06.879
<v Speaker 1>Looking forward to it. Welcome back to our deep dive

180
00:10:06.919 --> 00:10:10.519
<v Speaker 1>into iPhone forensics. Before the break, we were talking about

181
00:10:10.519 --> 00:10:14.840
<v Speaker 1>how investigators can piece together a timeline using data extracted

182
00:10:14.879 --> 00:10:17.480
<v Speaker 1>from an iPhone. Yeah, I have to admit the idea

183
00:10:17.480 --> 00:10:20.519
<v Speaker 1>that my iPhone is keeping such detailed records is a

184
00:10:20.559 --> 00:10:21.279
<v Speaker 1>bit unnerving.

185
00:10:21.519 --> 00:10:24.240
<v Speaker 2>It's definitely something to be aware of, but it's important

186
00:10:24.240 --> 00:10:28.080
<v Speaker 2>to remember that these forensic techniques are primarily used in

187
00:10:28.159 --> 00:10:32.120
<v Speaker 2>legal and investigative contexts. The average person doesn't need to

188
00:10:32.200 --> 00:10:35.879
<v Speaker 2>worry about someone snooping through their deleted messages or location history.

189
00:10:36.159 --> 00:10:39.720
<v Speaker 1>That's reassuring. Yeah, but let's say I am an investigator

190
00:10:40.039 --> 00:10:44.759
<v Speaker 1>facing a locked iPhone. What are my options? Realistically? Is

191
00:10:44.759 --> 00:10:47.039
<v Speaker 1>there a magic bullet to unlock any iPhone?

192
00:10:47.240 --> 00:10:50.919
<v Speaker 2>Unfortunately, there's no one size fits all solution, right. The

193
00:10:50.960 --> 00:10:55.039
<v Speaker 2>approach depends on several factors. Okay, starting with the iPhone

194
00:10:55.159 --> 00:10:59.200
<v Speaker 2>model and iOS version. If it's an older device vulnerable

195
00:10:59.240 --> 00:11:03.919
<v Speaker 2>to the check M eight exploit, a BFU acquisition might

196
00:11:03.960 --> 00:11:04.600
<v Speaker 2>be possible.

197
00:11:04.879 --> 00:11:08.080
<v Speaker 1>Right that, Before first unlock technique we talked about exactly,

198
00:11:08.279 --> 00:11:11.080
<v Speaker 1>what if it's a newer model, one that's not as

199
00:11:11.120 --> 00:11:12.120
<v Speaker 1>easily exploited.

200
00:11:12.600 --> 00:11:16.240
<v Speaker 2>Things get trickier with newer iPhones. Okay, Brute forcing the

201
00:11:16.320 --> 00:11:20.320
<v Speaker 2>passcode could take an impractical amount of time, especially with

202
00:11:20.399 --> 00:11:28.200
<v Speaker 2>complex passwords, and Apple, for security reasons, is extremely reluctant

203
00:11:28.399 --> 00:11:30.399
<v Speaker 2>to provide backdoors for law.

204
00:11:30.320 --> 00:11:33.399
<v Speaker 1>Enforcement, so it's a bit of a stalemate. It can

205
00:11:33.519 --> 00:11:36.000
<v Speaker 1>be investigators are stuck even with a warrant.

206
00:11:36.279 --> 00:11:41.600
<v Speaker 2>Not necessarily. There are specialized companies like Celebrate that offer

207
00:11:42.000 --> 00:11:46.960
<v Speaker 2>advanced forensic services. They have tools and techniques that can

208
00:11:47.000 --> 00:11:50.600
<v Speaker 2>bypass security on some newer models. Interesting, but it's expensive

209
00:11:50.679 --> 00:11:52.120
<v Speaker 2>and often time consuming.

210
00:11:52.279 --> 00:11:54.960
<v Speaker 1>I can imagine that it's a constant arms race between

211
00:11:55.519 --> 00:11:58.600
<v Speaker 1>the security measures and the forensic tools trying to circumvent

212
00:11:58.600 --> 00:12:01.519
<v Speaker 1>them exactly. But let's say we have gotten past that

213
00:12:01.600 --> 00:12:06.120
<v Speaker 1>initial hurdle okay, and acquire the data. What happens next?

214
00:12:06.399 --> 00:12:07.840
<v Speaker 1>It must be like trying to find a needle in

215
00:12:07.879 --> 00:12:08.440
<v Speaker 1>a haystack.

216
00:12:08.679 --> 00:12:12.519
<v Speaker 2>That's where those specialized forensic tools become indispensable.

217
00:12:12.720 --> 00:12:12.960
<v Speaker 1>Okay.

218
00:12:13.120 --> 00:12:19.759
<v Speaker 2>They help investigators sift through mountains of data, extract relevant

219
00:12:19.879 --> 00:12:23.639
<v Speaker 2>artifacts okay, and present them in a way that's understandable.

220
00:12:23.879 --> 00:12:27.240
<v Speaker 1>So these tools aren't just about grabbing the data, right,

221
00:12:27.279 --> 00:12:29.519
<v Speaker 1>They're also about making sense of it exactly.

222
00:12:29.679 --> 00:12:36.720
<v Speaker 2>They parse databases, decode files, extract metadataka, and often use

223
00:12:36.840 --> 00:12:41.799
<v Speaker 2>sophisticated heuristics. Heuristics to piece together fragments of information.

224
00:12:42.200 --> 00:12:42.679
<v Speaker 1>Interesting.

225
00:12:42.759 --> 00:12:46.159
<v Speaker 2>Think of it like having a digital detective assistant helping

226
00:12:46.159 --> 00:12:47.919
<v Speaker 2>you analyze the evidence.

227
00:12:47.519 --> 00:12:50.000
<v Speaker 1>Heuristics That sounds like educated guesswork in.

228
00:12:49.960 --> 00:12:53.120
<v Speaker 2>A way it is. It's about using patterns and known

229
00:12:53.200 --> 00:12:56.639
<v Speaker 2>behaviors okay, to make inferences about the data.

230
00:12:56.720 --> 00:12:57.080
<v Speaker 1>Gotcha.

231
00:12:57.159 --> 00:13:00.759
<v Speaker 2>For example, if a message was deleted, tool might use

232
00:13:00.799 --> 00:13:05.360
<v Speaker 2>surrounding data like timestamps and metadata to estimate when it

233
00:13:05.480 --> 00:13:07.600
<v Speaker 2>was sent and what it might have contained.

234
00:13:07.919 --> 00:13:13.080
<v Speaker 1>So even deleted data isn't necessarily gone forever. That's both

235
00:13:13.120 --> 00:13:16.759
<v Speaker 1>fascinating and a little scary. It is. But you mentioned

236
00:13:16.799 --> 00:13:20.759
<v Speaker 1>location data earlier. How do investigators use that information within

237
00:13:20.799 --> 00:13:21.639
<v Speaker 1>a practical sense?

238
00:13:21.679 --> 00:13:24.200
<v Speaker 2>Location data is incredibly valuable?

239
00:13:24.440 --> 00:13:24.720
<v Speaker 1>Okay?

240
00:13:24.919 --> 00:13:29.000
<v Speaker 2>It often provides the where to, the who, and when

241
00:13:29.679 --> 00:13:34.039
<v Speaker 2>of other evidence. Investigators can use it to corroborate alibis,

242
00:13:34.840 --> 00:13:39.639
<v Speaker 2>establish patterns of movement, or even place a suspect at

243
00:13:39.639 --> 00:13:40.919
<v Speaker 2>a crime scene.

244
00:13:40.960 --> 00:13:45.320
<v Speaker 1>So that significant locations feature the one that remembers my

245
00:13:45.360 --> 00:13:48.720
<v Speaker 1>favorite haunts exactly. Could actually be used against someone in

246
00:13:48.759 --> 00:13:50.240
<v Speaker 1>an investigation potentially.

247
00:13:50.320 --> 00:13:53.639
<v Speaker 2>Yes, wow, it's a powerful tool for building a timeline

248
00:13:53.639 --> 00:13:58.360
<v Speaker 2>of someone's activities. And remember, even if you disable location services,

249
00:13:58.720 --> 00:14:02.679
<v Speaker 2>your iPhone might still be collected location data through cell

250
00:14:02.720 --> 00:14:05.919
<v Speaker 2>tower triangulation or Wi Fi networks.

251
00:14:06.000 --> 00:14:08.039
<v Speaker 1>It seems like there's really no escaping in the digital

252
00:14:08.080 --> 00:14:09.039
<v Speaker 1>trail we leave behind.

253
00:14:09.159 --> 00:14:10.279
<v Speaker 2>It's getting harder and harder.

254
00:14:10.480 --> 00:14:12.840
<v Speaker 1>But it's not just about where we go. It's also

255
00:14:12.879 --> 00:14:16.080
<v Speaker 1>about what we do. Yes, the apps we use, the

256
00:14:16.080 --> 00:14:18.759
<v Speaker 1>websites we visit, the things we search for.

257
00:14:18.919 --> 00:14:22.200
<v Speaker 2>Absolutely, app data can be a gold mine for investigators.

258
00:14:22.679 --> 00:14:30.159
<v Speaker 2>Social media activity, messaging, conversations, calendar entries, notes, Okay, even

259
00:14:30.440 --> 00:14:36.639
<v Speaker 2>seemingly mundane things like browsing history can provide valuable insights.

260
00:14:36.679 --> 00:14:39.600
<v Speaker 1>I imagine analyzing all those different apps can get pretty complex.

261
00:14:39.840 --> 00:14:43.799
<v Speaker 1>It can, especially with so many platforms and constantly evolving features.

262
00:14:43.919 --> 00:14:47.399
<v Speaker 2>It can be some apps are more cooperative than others,

263
00:14:47.799 --> 00:14:52.279
<v Speaker 2>providing APIs that allow for easier data extraction, but others

264
00:14:52.320 --> 00:14:55.039
<v Speaker 2>require more creative approaches you create.

265
00:14:55.519 --> 00:14:59.120
<v Speaker 1>How are we talking about hacking into the app's code?

266
00:14:59.279 --> 00:15:05.960
<v Speaker 2>Sometimes techniques like reverse engineering the apps communication protocols, analyzing

267
00:15:06.080 --> 00:15:09.960
<v Speaker 2>its database structure, or running it in a controlled environment

268
00:15:10.039 --> 00:15:11.399
<v Speaker 2>to observe its behavior.

269
00:15:11.799 --> 00:15:14.720
<v Speaker 1>So it sounds like investigators need to be part detective,

270
00:15:15.759 --> 00:15:21.440
<v Speaker 1>part programmer, and part I'm not sure what else to

271
00:15:21.519 --> 00:15:22.080
<v Speaker 1>call it.

272
00:15:22.080 --> 00:15:23.840
<v Speaker 2>It's a very unique skill set.

273
00:15:23.759 --> 00:15:27.480
<v Speaker 1>It certainly is, and it's a field that's constantly evolving

274
00:15:28.120 --> 00:15:31.080
<v Speaker 1>as new technologies emerge and existing ones adapt.

275
00:15:31.399 --> 00:15:31.720
<v Speaker 2>Sure.

276
00:15:32.200 --> 00:15:35.960
<v Speaker 1>Okay, so we've talked about location data, app data. What

277
00:15:36.039 --> 00:15:42.480
<v Speaker 1>about communication data, emails, messages, phone calls. Ye, that's classic

278
00:15:42.519 --> 00:15:43.480
<v Speaker 1>detective work.

279
00:15:43.360 --> 00:15:48.120
<v Speaker 2>It is, and it's still a crucial part of iOS forensics.

280
00:15:49.120 --> 00:15:53.840
<v Speaker 2>But the way we communicate has changed dramatically with the

281
00:15:53.960 --> 00:15:58.120
<v Speaker 2>rise of messaging apps like Whatsappened Telegram?

282
00:15:58.320 --> 00:16:00.840
<v Speaker 1>Right, seems like everyone's on those plots forms these days.

283
00:16:00.879 --> 00:16:04.200
<v Speaker 1>They are are those harder to analyze the traditional SMS messages,

284
00:16:04.360 --> 00:16:05.039
<v Speaker 1>It depends.

285
00:16:05.279 --> 00:16:08.279
<v Speaker 2>Some messaging apps are fairly well documented, and there are

286
00:16:08.279 --> 00:16:13.360
<v Speaker 2>tools that can extract conversations in metadata relatively easily, but others.

287
00:16:13.159 --> 00:16:13.960
<v Speaker 1>Are more challenging.

288
00:16:14.000 --> 00:16:18.519
<v Speaker 2>I'm guessing yes, some apps prioritize privacy and use end

289
00:16:18.559 --> 00:16:22.000
<v Speaker 2>to end encryption, making it much more difficult to access

290
00:16:22.080 --> 00:16:26.759
<v Speaker 2>the content of messages. But even then, investigators can often

291
00:16:26.840 --> 00:16:33.159
<v Speaker 2>glean valuable information from metadata, such as who communicated with whom,

292
00:16:33.519 --> 00:16:34.679
<v Speaker 2>when and for how long.

293
00:16:35.519 --> 00:16:39.240
<v Speaker 1>So even if you can't read the messages, you can

294
00:16:39.279 --> 00:16:42.559
<v Speaker 1>still learn a lot about the communication patterns, exactly like

295
00:16:42.600 --> 00:16:45.679
<v Speaker 1>a digital fingerprint of their interactions. It is, and it

296
00:16:45.759 --> 00:16:50.200
<v Speaker 1>highlights the importance of taking a holistic approach to the investigation.

297
00:16:50.960 --> 00:16:53.679
<v Speaker 1>You need to look at all the available data, connect

298
00:16:53.679 --> 00:16:57.879
<v Speaker 1>the dots and build a comprehensive picture of the digital activity.

299
00:16:57.960 --> 00:17:01.080
<v Speaker 1>For sure, it's like putting together a I jigsaw puzzle.

300
00:17:01.200 --> 00:17:03.559
<v Speaker 1>It is, with each piece of data providing a clue.

301
00:17:03.639 --> 00:17:04.839
<v Speaker 2>That's a great analogy.

302
00:17:05.000 --> 00:17:07.599
<v Speaker 1>But speaking of puzzles, let's talk about something I've always

303
00:17:07.640 --> 00:17:11.000
<v Speaker 1>been curious about. Okay, deleted data. We hear all the

304
00:17:11.039 --> 00:17:15.680
<v Speaker 1>time that deleted doesn't really mean gone. Yeah, but how

305
00:17:15.759 --> 00:17:17.319
<v Speaker 1>much truth is there to that?

306
00:17:17.680 --> 00:17:21.119
<v Speaker 2>It depends on a few factors, but generally speaking, deleted

307
00:17:21.200 --> 00:17:24.519
<v Speaker 2>data can often be recovered, really, especially from iPhones.

308
00:17:25.279 --> 00:17:25.799
<v Speaker 1>Interesting.

309
00:17:25.920 --> 00:17:29.519
<v Speaker 2>It all comes down to how data is stored and

310
00:17:29.680 --> 00:17:32.160
<v Speaker 2>managed at the file system level.

311
00:17:32.279 --> 00:17:35.839
<v Speaker 1>Okay, I'm ready for a tech lesson. How does that work?

312
00:17:36.160 --> 00:17:38.440
<v Speaker 2>Think of it this way? Okay, when you delete a

313
00:17:38.480 --> 00:17:43.759
<v Speaker 2>file your iPhone doesn't actually erase the data immediately. It

314
00:17:43.880 --> 00:17:47.119
<v Speaker 2>simply marks the space where that data was stored as

315
00:17:47.160 --> 00:17:48.400
<v Speaker 2>available for reuse.

316
00:17:48.680 --> 00:17:51.000
<v Speaker 1>So it's like tossing a file into the recycle bin

317
00:17:51.160 --> 00:17:51.880
<v Speaker 1>on your computer.

318
00:17:52.279 --> 00:17:55.440
<v Speaker 2>Similar yes, okay, and as you create new files and

319
00:17:55.559 --> 00:17:59.200
<v Speaker 2>use your phone, that deleted data might eventually get overwritten,

320
00:18:00.079 --> 00:18:03.960
<v Speaker 2>could linger for a while, potentially accessible to forensic tools.

321
00:18:04.000 --> 00:18:07.519
<v Speaker 1>So those data recovery apps you see advertised, those could

322
00:18:07.519 --> 00:18:08.519
<v Speaker 1>actually work.

323
00:18:08.640 --> 00:18:11.599
<v Speaker 2>Some of them. Yes, wow, But it's important to use

324
00:18:11.720 --> 00:18:15.039
<v Speaker 2>reputable tools, especially in a forensic context.

325
00:18:15.119 --> 00:18:15.440
<v Speaker 1>Gotcha.

326
00:18:15.559 --> 00:18:18.880
<v Speaker 2>You don't want to risk corrupting the data or introducing

327
00:18:19.160 --> 00:18:22.160
<v Speaker 2>artifacts that could compromise the investigation.

328
00:18:22.440 --> 00:18:24.160
<v Speaker 1>Right, I can see how that would be a problem.

329
00:18:24.799 --> 00:18:28.119
<v Speaker 1>So deleted data can be recovered, but it's not guaranteed,

330
00:18:28.599 --> 00:18:31.279
<v Speaker 1>and it takes specialized knowledge and tools, it does, and

331
00:18:31.319 --> 00:18:34.079
<v Speaker 1>the longer you wait, the less likely it is that

332
00:18:34.079 --> 00:18:36.880
<v Speaker 1>the data will be recoverable exactly. So what a forensic

333
00:18:36.880 --> 00:18:40.119
<v Speaker 1>investigation time is often of the essence it is that

334
00:18:40.200 --> 00:18:42.279
<v Speaker 1>makes sense. Okay, all right, we've talked about a lot

335
00:18:42.279 --> 00:18:46.000
<v Speaker 1>of technical details we have, but let's not forget about

336
00:18:46.000 --> 00:18:50.400
<v Speaker 1>the human element. These investigations aren't just about bits and bytes.

337
00:18:50.640 --> 00:18:52.680
<v Speaker 1>They're about people, right, Absolutely.

338
00:18:53.119 --> 00:18:57.240
<v Speaker 2>It's important to remember that behind every device, every piece

339
00:18:57.279 --> 00:19:02.039
<v Speaker 2>of data, there's a human story, and investigators need to

340
00:19:02.079 --> 00:19:05.559
<v Speaker 2>be sensitive to that, especially when dealing with victims of

341
00:19:05.680 --> 00:19:08.640
<v Speaker 2>crime or sensitive personal matters.

342
00:19:08.680 --> 00:19:11.039
<v Speaker 1>It's about finding the truth, it is, but doing so

343
00:19:11.200 --> 00:19:14.599
<v Speaker 1>ethically and responsible exactly, And that's something we'll explore further

344
00:19:14.640 --> 00:19:16.880
<v Speaker 1>when we come back for the final part of our

345
00:19:16.960 --> 00:19:21.000
<v Speaker 1>deep dive into the world of iPhone forensics. Welcome back

346
00:19:21.000 --> 00:19:24.200
<v Speaker 1>to our deep dive into iPhone forensics. We've been talking

347
00:19:24.200 --> 00:19:28.319
<v Speaker 1>about the technical side of things, how investigators acquire and

348
00:19:28.400 --> 00:19:33.039
<v Speaker 1>analyze data, but I'm curious about the bigger picture. How

349
00:19:33.200 --> 00:19:36.759
<v Speaker 1>is this field evolving as technology changes?

350
00:19:37.119 --> 00:19:40.240
<v Speaker 2>That's a great question. Yeah, the tools and techniques of

351
00:19:40.319 --> 00:19:44.359
<v Speaker 2>digital forensics are constantly evolving, just like the technology they're

352
00:19:44.359 --> 00:19:48.720
<v Speaker 2>trying to unravel. We're seeing a shift towards cloud based data,

353
00:19:48.960 --> 00:19:54.799
<v Speaker 2>encrypted communications, and devices with increasingly sophisticated security features.

354
00:19:55.000 --> 00:19:56.960
<v Speaker 1>So the days of simply plugging in a phone and

355
00:19:57.000 --> 00:19:59.960
<v Speaker 1>downloading all the data are long gone large.

356
00:20:00.319 --> 00:20:04.599
<v Speaker 2>Yes, investigators need to be incredibly adaptable, constantly learning new

357
00:20:04.640 --> 00:20:10.240
<v Speaker 2>techniques and staying abreast of the latest vulnerabilities and exploits.

358
00:20:10.799 --> 00:20:14.799
<v Speaker 2>They're also relying more heavily on specialized software and hardware,

359
00:20:15.359 --> 00:20:19.680
<v Speaker 2>some of which can be quite expensive and require specialized training.

360
00:20:20.000 --> 00:20:22.359
<v Speaker 1>It sounds like a challenging field to be in. Is

361
00:20:22.680 --> 00:20:25.519
<v Speaker 1>always trying to stay one step ahead, definitely, But all

362
00:20:25.559 --> 00:20:29.680
<v Speaker 1>this talk about powerful tools and techniques raises an important

363
00:20:29.720 --> 00:20:33.440
<v Speaker 1>question for me. Okay, what about privacy? Where's the line

364
00:20:33.680 --> 00:20:37.079
<v Speaker 1>between legitimate investigation and overreach.

365
00:20:37.319 --> 00:20:41.000
<v Speaker 2>You've hit on a crucial point. Digital forensics is a

366
00:20:41.000 --> 00:20:45.519
<v Speaker 2>powerful tool, right, and like any tool, it can be misused.

367
00:20:45.640 --> 00:20:49.880
<v Speaker 2>That's why there are strict legal frameworks and ethical guidelines

368
00:20:49.920 --> 00:20:54.039
<v Speaker 2>in place. Search warrants are often required to access personal data,

369
00:20:54.200 --> 00:20:56.759
<v Speaker 2>and there are rules about what data can be collected

370
00:20:56.799 --> 00:20:57.839
<v Speaker 2>and how it can be used.

371
00:20:57.839 --> 00:20:59.880
<v Speaker 1>So it's not a free for all, No, it's not.

372
00:21:00.119 --> 00:21:02.680
<v Speaker 1>Investigators can't just go snooping through anyone's phone on a

373
00:21:02.680 --> 00:21:04.000
<v Speaker 1>whim exactly.

374
00:21:04.240 --> 00:21:08.119
<v Speaker 2>There needs to be a justifiable reason, and the scope

375
00:21:08.160 --> 00:21:11.759
<v Speaker 2>of the search should be proportionate to the alleged crime

376
00:21:11.920 --> 00:21:16.319
<v Speaker 2>or offense. It's a delicate balance between security and privacy,

377
00:21:16.920 --> 00:21:20.359
<v Speaker 2>one that's constantly being debated and refined.

378
00:21:20.759 --> 00:21:23.319
<v Speaker 1>It definitely sounds complex, it is, with a lot of

379
00:21:23.319 --> 00:21:25.799
<v Speaker 1>gray areas. Definitely, But let's switch gears for a moment

380
00:21:25.960 --> 00:21:29.000
<v Speaker 1>talk about something a bit more practical. If someone is

381
00:21:29.079 --> 00:21:32.960
<v Speaker 1>concerned about their digital privacy, what steps can they take

382
00:21:33.039 --> 00:21:34.599
<v Speaker 1>to protect their data?

383
00:21:36.119 --> 00:21:38.880
<v Speaker 2>The first line defense is always a strong pass code.

384
00:21:39.640 --> 00:21:43.640
<v Speaker 2>Use a complex combination of letters, numbers, and symbols and

385
00:21:43.720 --> 00:21:45.559
<v Speaker 2>make it at least six digits long.

386
00:21:45.759 --> 00:21:47.039
<v Speaker 1>Gotcha, and if.

387
00:21:46.880 --> 00:21:51.880
<v Speaker 2>Your device supports it, enable biometric authentication like face ID

388
00:21:52.160 --> 00:21:52.880
<v Speaker 2>or touch ID.

389
00:21:53.359 --> 00:21:56.599
<v Speaker 1>Okay, so strong passwords and biometrics. Yeah, that's good general

390
00:21:56.640 --> 00:21:59.920
<v Speaker 1>security advice, it is. But is there anything specific to

391
00:22:00.079 --> 00:22:01.079
<v Speaker 1>iPhone forensics?

392
00:22:01.160 --> 00:22:01.759
<v Speaker 2>Absolutely?

393
00:22:01.880 --> 00:22:02.200
<v Speaker 1>Okay.

394
00:22:02.440 --> 00:22:05.240
<v Speaker 2>Be mindful of the apps you allow to access your

395
00:22:05.279 --> 00:22:08.480
<v Speaker 2>location data Okay. You can control these permissions in your

396
00:22:08.480 --> 00:22:13.400
<v Speaker 2>device's settings, and if you're particularly concerned about privacy, consider

397
00:22:13.559 --> 00:22:18.160
<v Speaker 2>using a privacy focused browser or messaging app that employs

398
00:22:18.359 --> 00:22:19.400
<v Speaker 2>end to end encryption.

399
00:22:20.000 --> 00:22:22.799
<v Speaker 1>So being selected about apps and their permissions is key,

400
00:22:23.079 --> 00:22:25.200
<v Speaker 1>it is. What about data backups?

401
00:22:25.559 --> 00:22:26.000
<v Speaker 2>Okay?

402
00:22:26.240 --> 00:22:28.960
<v Speaker 1>Those are important for recovering data if your phone is

403
00:22:29.160 --> 00:22:32.240
<v Speaker 1>lost or damaged. That could they also be a vulnerability.

404
00:22:32.920 --> 00:22:36.920
<v Speaker 2>Backups are essential, but it's wise to encrypt them Okay.

405
00:22:37.200 --> 00:22:40.839
<v Speaker 2>Both iTunes and iCloud backups can be encrypted with the password,

406
00:22:41.359 --> 00:22:45.000
<v Speaker 2>making it much harder for unauthorized access. It adds an

407
00:22:45.039 --> 00:22:46.839
<v Speaker 2>extra layer of protection.

408
00:22:46.519 --> 00:22:49.240
<v Speaker 1>For your data. Encrypting backups. Yeah, that's a good tip

409
00:22:49.319 --> 00:22:52.319
<v Speaker 1>for sure. Any other advice for staying ahead of those

410
00:22:52.359 --> 00:22:53.880
<v Speaker 1>digital detectives.

411
00:22:53.880 --> 00:22:58.440
<v Speaker 2>This might sound obvious, okay, but be mindful of what

412
00:22:58.480 --> 00:23:03.640
<v Speaker 2>you share online through messaging appsh Remember that even deleted

413
00:23:03.759 --> 00:23:09.519
<v Speaker 2>data might be recoverable. Think twice before sending sensitive information

414
00:23:10.160 --> 00:23:13.759
<v Speaker 2>or engaging in activities that could be misconstrued. Okay, your

415
00:23:13.759 --> 00:23:16.759
<v Speaker 2>digital footprint can last a lot longer than you might think.

416
00:23:16.839 --> 00:23:20.200
<v Speaker 1>Right, think before you post message or anything, really exactly,

417
00:23:20.279 --> 00:23:22.720
<v Speaker 1>So it's not just about being innocent, it's also about

418
00:23:22.759 --> 00:23:26.119
<v Speaker 1>being aware of how our digital actions can be interpreted.

419
00:23:26.200 --> 00:23:29.480
<v Speaker 1>That's right. Well, I think we've cut a lot of

420
00:23:29.480 --> 00:23:32.960
<v Speaker 1>ground in this deep dive. We've gone from the basics

421
00:23:33.000 --> 00:23:38.319
<v Speaker 1>of iPhone data acquisition to the complexities of encryption and

422
00:23:38.359 --> 00:23:41.559
<v Speaker 1>the ethical considerations of digital forensics. For sure, it's been

423
00:23:41.559 --> 00:23:44.960
<v Speaker 1>a fascinating journey, it has, and we've only scratched the surface.

424
00:23:45.079 --> 00:23:49.880
<v Speaker 1>That's true of this rapidly evolving field. But hopefully this

425
00:23:50.480 --> 00:23:54.599
<v Speaker 1>deep dive has given you a better understanding of how

426
00:23:54.720 --> 00:23:59.920
<v Speaker 1>iPhones can become witnesses, how investigators uncover their secrets for sure,

427
00:24:00.200 --> 00:24:03.160
<v Speaker 1>and what you can do to protect your own digital privacy.

428
00:24:03.240 --> 00:24:05.960
<v Speaker 1>That's right. I know I've learned a lot. Yeah, and

429
00:24:06.000 --> 00:24:07.440
<v Speaker 1>I'm sure our listeners have too.

430
00:24:07.680 --> 00:24:08.039
<v Speaker 2>Me too.

431
00:24:08.200 --> 00:24:11.880
<v Speaker 1>If you're interested in exploring this topic further, there are

432
00:24:11.960 --> 00:24:16.079
<v Speaker 1>tons of resources available online. Definitely, who knows, maybe one

433
00:24:16.119 --> 00:24:18.839
<v Speaker 1>of you will become the next Sherlock Holmes, I love it.

434
00:24:18.880 --> 00:24:22.240
<v Speaker 2>Of the digital age, that would be fantastic. It's a

435
00:24:22.279 --> 00:24:26.640
<v Speaker 2>field ripe with possibilities, and as technology continues to advance,

436
00:24:27.119 --> 00:24:29.880
<v Speaker 2>who knows what secrets will be able to unlock in

437
00:24:29.920 --> 00:24:30.440
<v Speaker 2>the future.

438
00:24:31.000 --> 00:24:33.319
<v Speaker 1>That's a thought provoking note to end on it is.

439
00:24:33.599 --> 00:24:36.079
<v Speaker 1>Thanks for joining us on this deep dive, my pleasure

440
00:24:36.200 --> 00:24:39.839
<v Speaker 1>into the world of iPhone forensics. Until next time,