SANS Digital Forensics and Incident Response Blog

Digital Forensics Case Leads: A decision regarding the 5th Amendment, Cellebrite and Forensic Focus update and EXIF data and Bing Maps

In this week's edition of Case Leads we see Cellebrite and Forensic Focus getting updates, Dave Hull's blog post on EXIF data & Bing Maps, as well as a major court decision regarding the U.S. 5th Amendment and more.

If you have an item you'd like to contribute toDigital Forensics Case Leads, please send it to



  • Cellebrite UFED version has been released. It now Supports the extraction of iMessages from iOS devices running i0S5.x from a logical extraction, 10 newly supported BlackBerry devices for physical extraction & decoding and 38 new Android devices supported for physical extraction & 85 supported for file system extraction. Read the release notes here.
  • Harlan Carvey recently helped a friend to parse Facebook Chats to CSV format by putting together a Perl script,
  • ViaForensics released a bunch of Android YAFFS2 images with details on what data was populated as well as deleted. Here is an overview and links to the 10 images


Good Reads:



  • Andreas Schuster has set up a publication for DFIR news.
  • Mike Wilkinson has posted the recordings from the February 16, 2012 DFIR Online meetup featuring Jon Rajewski, Peter Coons & John Clingerman over on his site.



  • Federal appeals court decides that forced decryption goes against the 5th Amendment right protecting self-incrimination. Here is a copy of the decision from EFF's site




Coming Events:

Call For Papers:>

Joe Garcia is a Law Enforcement Officer with over 18 years of experience, the last 5+ of which he has been assigned to conduct computer crime investigations and digital forensic examinations. He holds the GIAC GSEC Gold, GCIH & GCFA Silver and AccessData ACE certifications. You can follow Joe on Twitter at @jgarcia62