Episode 4: Carved From Unallocated – The Value of Using Your Own Solid Test Data to Aid Investigations
Special guest: Sarah Edwards – Senior Digital Forensic Researcher at BlackBag Technologies, a Cellebrite company
Sarah Edwards is an instructor for SANS and co-created the course, FOR518 Mac and iOS Forensic Analysis and Incident Response. She is well-known in the DFIR community as one of the foremost experts on Mac and iOS analysis.
In this episode, Sarah joins us to talk about the importance of using test data to aid investigations and why you can’t always rely on “the experts” to provide that data.
The three main areas in which test data delivers value are research, testing, and training.
We will discuss what test data is, why examiners need it, and when they may need it. We’ll also discuss some steps and provide suggestions to make that data useful and worth your time to develop.
Test data is something examiners need for validation and to clarify the appropriate mindset to approach a digital intelligence challenge. If you are ever in a situation where you are hesitant to report something or you are not sure what the data means, that’s exactly when you need solid test data.
Watch episode to find out more.