Pieces0310
取证须让证物说话,莫妄以自我心证来给案情下定论.切忌画靶射箭,为找而找. 取证的根基仰赖经验与判断,在IT各领域的经验愈丰富,愈能看出端倪. 取证须善用工具,但不过度依赖工具.工具只能帮你缩小可能范围,但无法告诉你答案,仍需靠人进行分析判断.

导航

 

Have you guys heard about a pretty good feature called "Second Space"?  Manufacturers like Xiaomi,Huawei... offer "Second Space" feature which allows users to own a private space on the same phone. When "Second Space" is activated, it will create a new and fresh space on your phone. To switch from one to another is easy and convenient as below. 

    

 

Keep in mind that "Second Space" and "Dual Apps" are two different features. Don't mix them up. Of course you have to unlock it first as below so that you could switch to Second Space. In this private space you could set a different wallpaper,install new apps... as you wish. So it could let you maintain your privacy very well.

     

 

Now you got two profiles on the same phone. One is "First Space" and the other is "Second Space". You could import data from First Space by using built-option easily.

Some IMs such as WhatsApp, WeChat, Naver LINE... are very popular. Let's take LINE for example. Imagine that the suspect installed LINE in First Space for normal socail life, and also installed LINE in Second Space for communication with his/her partners in crime. Could mobile forensic tools extracted LINE in Second Space as well?

No doubt that the path of LINE in Second Space is different from the one in First Space. Let's take a look where the path of LINE in Second Space is as below. The path is "/data/user/10/..." !~~

 

 

Let me remind you that the path of Apps in Second Space may differ from brand to brand. Even mobile forensic tools know where it is but still it's not easy to extract data in Second Space from a smartphone running Android 7 or above.  

 

posted on 2020-05-07 14:02  Pieces0310  阅读(497)  评论(0编辑  收藏  举报