Final Week to Get an iPad mini, Surface Go 2, or Take $300 Off with OnDemand Training!


To attend this webcast, login to your SANS Account or create your Account.

This webcast has been archived. To view the webcast login into your SANS Portal Account or create an account by clicking the "Get Registered" button on the right. Once you register, you can download the presentation slides below.

iOS 11 isn't all fun and games. What we know so far and ways to handle unsupported data sets

  • Wednesday, November 08, 2017 at 10:30 AM EST (2017-11-08 15:30:00 UTC)
  • Domenica Crognale, Heather Mahalik

You can now attend the webcast using your mobile device!



This webcast will cover the latest SANS DFIR blog post "Time is NOT on our side when it comes to messages in iOS 11". SANS instructors Heather Mahalik and Domenica "Lee" Crognale will discuss iOS 11 messages and the differences they have seen compared to older iOS versions. They will walk you through their methods for testing and creating data sets for examination, as well as provide attendees with tips on how to better understand iOS 11 messages. Additionally, they will discuss procedures used for developing the query and how your mobile forensics tools might be blurring the lines on what the data represents.

Smartphones are constantly changing and the FOR585 course is forced to evolve. The course material has been updated to include 7 new labs, new sections and bonus material for students interested in smartphones that aren't common to all parts of the world, but really matter to some investigations. A glimpse of the new sections in FOR585 will be also provided in this webcast including, SQLite forensics, advanced third-party application parsing, recovering artifacts from deleted chat applications, Android Nougat, iOS 11 and more!

Speaker Bios

Heather Mahalik

Heather is the Senior Director of Digital Intelligence at Cellebrite.  At the SANS Institute, Heather is a senior instructor, author and the course lead for FOR585: Smartphone Forensic Analysis In-Depth. As if that isn't a full enough schedule, Heather also maintains, where she blogs and hosts work from the digital forensics community. She is the co-author of Practical Mobile Forensics (1st and 2nd editions), currently a best seller from Pack't Publishing, and the technical editor for Learning Android Forensics from Pack't Publishing.

Domenica Crognale

Domenica is one of the course co-authors of SANS FOR585: Advanced Smartphone Forensics. She has been working in digital forensics for more than 10 years and specializing in mobile devices since 2009. In previous jobs she has provided training to military and government agencies, worked on high-profile cases, tested and validated various mobile forensics utilities, and provided security assessments for many mobile applications. In her day job, she spends time dissecting third-party mobile applications, where there is no shortage of interesting data left behind. She maintains multiple certifications including the GASF, EnCE, CCE, and CISSP. @domenicacrognal

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.