Special Guest: Paul Lorentz- Solutions Engineer at Cellebrite

Many data collection efforts, specifically on Android devices, involve an SD card as part of the device data storage, but this can potentially cause the collection procedure to be much more confusing. In this episode, we are joined by Paul Lorentz, Solutions Engineer at Cellebrite, who will explain how SD card data impacts digital investigations.

Oftentimes advanced logical extractions, SD cards, or other collected data files are received in a zip file format. Since most Android devices already come with a small amount of device storage, the SD card has become a part of the total system offering.

However, even though the SD card is part of the file path, it is not part of the file system. This can lead to many questions about whether the media was collected directly from the SD card or from one of the actual device folders.

Questions like these have sparked extended research in digital investigations to dig deeper into the realm of SD cards and provide more clarity. For this episode, Paul rooted one of his devices in order to obtain easier access and did some tests to reveal where the data was actually stored.

Listen to the full episode to learn tips and tricks for finding files. You will also find out where these files are located, and how SD card data can impact your digital investigations.

Stay tuned for a blog post on this topic that Paul is planning to write in the near future.

Share this post