Nytro Posted June 14, 2014 Report Posted June 14, 2014 Blackberry Forensics1.0. UNLOCKED BLACKBERRY DEVICESUnlocked BlackBerry device with no passwordSituation•BB contains memory card and SIM.•Which type of data extraction should be performed and in what order?•Physical, File System, then Logical?Examiner Considerations:•There are a variety of tools available to the examiner.•Start Physical, if supported,then move to File System and Logical.•Wear Leveling•A data structure at the logical level, in the form of a logical backup/acquisition is different than the same record at the physical level.•** In rare cases performing a physical with UFED may cause device to reset itself to factory default.•This referred by Cellebrite as “cache memory reset”.Download: https://digital-forensics.sans.org/summit-archives/dfir14/BlackBerry_Forensic_Nuggets_Shafik_Punja_and_Cindy_Murphy.pdf Quote
