home.social

#mobileforensics — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #mobileforensics, aggregated by home.social.

  1. Can examiners talk about cases after trial? Ethical guidance
    Watch or listen to the full conversation in the latest Digital Forensics Now podcast.
    Watch here: youtube.com/live/4BcvznP_yEY
    Listen on any and all podcasting platforms.

    #DigitalForensics #MobileForensics #DFIR

  2. Can examiners talk about cases after trial? Ethical guidance
    Watch or listen to the full conversation in the latest Digital Forensics Now podcast.
    Watch here: youtube.com/live/4BcvznP_yEY
    Listen on any and all podcasting platforms.

    #DigitalForensics #MobileForensics #DFIR

  3. Can examiners talk about cases after trial? Ethical guidance
    Watch or listen to the full conversation in the latest Digital Forensics Now podcast.
    Watch here: youtube.com/live/4BcvznP_yEY
    Listen on any and all podcasting platforms.

    #DigitalForensics #MobileForensics #DFIR

  4. Can examiners talk about cases after trial? Ethical guidance
    Watch or listen to the full conversation in the latest Digital Forensics Now podcast.
    Watch here: youtube.com/live/4BcvznP_yEY
    Listen on any and all podcasting platforms.

    #DigitalForensics #MobileForensics #DFIR

  5. Can examiners talk about cases after trial? Ethical guidance
    Watch or listen to the full conversation in the latest Digital Forensics Now podcast.
    Watch here: youtube.com/live/4BcvznP_yEY
    Listen on any and all podcasting platforms.

    #DigitalForensics #MobileForensics #DFIR

  6. Signal vs Wire — binary analysis of both APKs (apktool, strings, ELF inspection).

    The gap is larger than most people think:

    Signal: Rust core (libsignal_jni.so), Kyber-1024 post-quantum hybrid ratchet, SQLCipher for at-rest encryption, SVR with Intel SGX attestation, IME_FLAG_NO_PERSONALIZED_LEARNING (keyboard can't index your messages), zero third-party trackers.

    Wire: Kotlin/Ktor, no hardened native core (more accessible to Frida), no SQLCipher (messages extractable in plaintext on rooted devices), no post-quantum, Segment SDK for behavioural telemetry.

    But the finding that surprised me most:

    Wire APKs from unofficial stores (Uptodown et al.) contain additional tracking workers and ACCESS_SUPERUSER permission requests not present in the official build. Supply chain integrity is not a footnote — it's the threat model.

    Conclusion: Signal is the only one of the two suitable for threat models involving physical or administrative device compromise.

    soon the full paper

    #infosec #AndroidSecurity #Signal #Wire #ReverseEngineering #mobileforensics #supplychain #MASA

  7. Hey, all. This one is to help a friend. An abuser in her life opened a number of Google and other accounts in her name. We're already getting law enforcement involved. We want to take a forensic copy of the phone before we factory reset it. Any software recommendations?

    #mobileforensics #devicesecurity #forensics