The world of mobile forensics is one that’s always shifting and adjusting. It takes a dedicated expert to be able to find the latest sources of evidence from mobile devices, and at Magnet Forensics, Chris Vance is the one taking that challenge head on.
Over the years, Chris has contributed a great amount of mobile forensics research into his role at Magnet Forensics. He’s brought all of that knowledge into a highly successful webinar series, called Mobile Unpacked. Fresh off the latest episode, focusing on iOS 18, we caught up with Chris about some of the latest trends he’s been seeing in the field.
FF: Tell us a little bit about your experience in the field and what you bring to your mobile research?
I’ve been doing mobile forensics since around 2007 while working with the West Virginia State Police’s digital forensics unit. Back then, it was about recovering a few calls or messages off a device and maybe one or two “potato-quality photos” as I liked to call them. As the devices evolved, so did the crimes we investigated. Suddenly we were brought smartphones which brought a whole new library of applications that there wasn’t anything to support.
For me, it was always these little things that drove me. The one-offs and questions that weren’t in any books or blogs. I knew that if I needed these answers, eventually someone else would too, so maybe I could start sharing them with the community to help that next person down the line.
FF: What’s been a particularly new trend that’s caught your eye?
While I’m usually primarily focused on messaging changes as my first priority, one thing I’ve noticed is that we just keep seeing exponentially larger forensic images being returned from these mobile devices. It’s not uncommon to see a 256-512 GB mobile device now, or even larger. While we always want to capture every piece of data we can, sometimes we have to prioritize what we’re going to collect, when we’re going to collect it, and how quickly we can get to the key points that matter to determine if it’s even worth the full analysis. If I had a dollar for every case I performed a full extraction and analysis on where a quick collection and scan of the data would have proven it wasn’t needed, well, let’s just say I could probably buy a new iPhone 16 for testing.
FF: What Magnet Forensics solutions are there to help?
What I love about our company is that we’re trying to tackle this a bunch of different ways. For example, we have Magnet Graykey Fastrak, which allows us to decouple the extraction process from Magnet Graykey and allows you to get your image from the phone to your forensics computer much faster (especially when a device has USB-C).
We also offer content-based extractions on both our Graykey and Magnet Verakey products that allow for examiners to select just specific types of information and/or a specific time window to extract from the device.
Additionally, we’ve been working on several different ways to speed up processing once you bring the data over into Magnet Axiom, with more of them coming in each new release. Of course, that’s just the stuff I CAN talk about. There’s lots more still to come!
FF: What kind of training/resources do you think people should seek out to improve their mobile investigations?
I’m going to be a little biased as a former trainer and curriculum manager for Magnet Forensics. Our mobile courses like Core Mobile Acquisition & Analysis (AX150), Magnet Graykey Examinations (GK200)/Magnet Verakey Examinations (VK200), and Axiom Advanced Mobile Forensics (AX300) can provide people—regardless of experience level—an entry point to learning more about iOS and Android forensics.
Capture The Flag competitions are another amazing way to learn in a fun, interactive environment. Even if you’re not joining a CTF live, you can usually find the images and questions, work your own solutions, and there’s always great write-ups in the community that you can compare your own work with!
FF: What’s next for Magnet Forensics in the mobile space?
We’re always trying to push ourselves to access the latest devices, OSes, and parse the latest artifacts. With Mobile View out now, we have a few other features we’re working on to help examiners AND investigators locate data quickly and easily. Beyond that, there’s some great new features coming to our products that’s going to streamline your imaging and processing even further! Keep an eye out for more information!
And be sure to keep up with our Mobile Unpacked webinar series. We’re up to #22 in the series, with each episode focusing on a specific area of study in mobile forensics that can definitely help you in your investigations. Our latest episode, “Eyes on eighteen”, focuses on the newly released iOS 18, and you can find a recording here.
