Episode 1: I Beg to DFIR – Carving for Locations in Cellebrite Physical Analyzer
Ronen Engler – Senior Manager, Technology and Innovation at Cellebrite
Heather Mahalik – Senior Director of Digital Intelligence at Cellebrite
Paul Lorentz – Senior Solutions Engineer at Cellebrite
This is the first episode of “Nothing to See Here? I Beg to DFIR” (Digital Forensics and Incidents Response).
In this series, we want to cover topics that aren’t discussed nearly enough. Our focus will be on things such as what we have seen on listservs, items that the three of us have issues with, and topics relating to digital intelligence that can be confusing.
This isn’t going to be a sales pitch to you. This is going to be a “lessons-learned” content series. Some of these lessons we’ve learned the hard way and we’ll show you how not to make the same mistakes, we’re also hoping that there may be things that you can teach us during this exchange.
Our first topic is a big one that a lot of people rely upon, which is “Carving for Locations in Cellebrite Physical Analyzer.” The four main questions we plan to answer with supporting data in this discussion are:
- What does “carving” mean?
- Why is carving necessary?
- How should you carve for locations? (There are many ways to accomplish this in Cellebrite Physical Analyzer and we will discuss the reasons for different approaches.)
- Why carving can confuse digital forensics examiners? And what to do about it.
Register for the next iBeg to DFIR episode here.