"Challenges of securing mobile devices, getting the data phone do not want to share" Martin Westman (MicroSystemation)

As the title implies, that we face harder and harder challenges of getting the data out of phones. The cat and mouse game we currently have in mobile forensics with using exploits and features in ways that apple, google and Microsoft have not intended for our use. As soon as a feature or exploit goes public, it gets patched or tweaked by the manufacturer and we have to find new ways. This is a constant forensics struggle and gets harder and harder.
The whatsapp part we will do a live demo and explain why we don't get any data out of android devices on a logical extraction anymore, but how you still can trick whatsapp to share chat data with us. After blown up in media, whatsapp have gone from no (or very little) efforts to obfuscate the personal chat data, to now be one of the most safest one among the widespread chat apps. So this will be a case study of the steps whatsapp have taken to protect its users personal data.
The "Lock features in android and how to bypass some of them" we will take a look on how to use different tools to access locked devices and see what can be done, and where we today have no suitable solutions. So using JTAG, ADB command and recovery images.
The last part "using python to visualize data from apps not supported by forensics tools" we will briefly look into the BIG challenges that lays ahead, supporting local popular apps that are not supported by the standard forensics tool. New apps pops up every day, and there is not possible for the forensics tools to keep up with app support on local level. Using python scripts to assist in supporting unsupported apps are crucial for solving the forensics challenges today and tomorrows on the app field.

"Excerpt from SANS FOR508.2 - Memory Forensics in Incident Response with Volatility" Mathias Fuchs (SANS)

Now a critical component of many incident response teams that detect advanced threats in their organization, memory forensics has come a long way in just a few years. It can be extraordinarily effective at finding evidence of worms, rootkits, and advanced malware used by an APT group of attackers.
Memory analysis traditionally was solely the domain of Windows internals experts, but the recent development of new tools makes it accessible today to anyone especially incident responders. Better interfaces, documentation, and built-in detection heuristics have greatly leveled the playing field.
This section will introduce volatility one of the best free tools available and give you a solid foundation in adding core and advanced memory forensic skills to your incident response and forensics capabilities.
Topics include:

Advanced Memory Analysis with Volatility

Code Injection, Malware, and Rootkit Hunting in Memory

Perform In-memory Windows Registry Examinations

Extract Typed Adversary Command Lines

Investigate Windows Services

Find and Dump Cached Files from RAM

Dumping Hashes and Credentials from Memory

Attention!: Additional material is required which will be provided to the participants ahead of the course.