elusive data

From recovering deleted iPhone SMS in a murder case to building tools that make SQLite and WAL analysis intuitive, James Eichbaum shares why examiners must understand—not just extract—application data.