Many apps are not what they claim to be. Never trust what you read about the apps, as Quality Assurance testing across these apps is not consistent, and we have determined several vulnerabilities and security flaws over the years that provide us with methods of piecing application data back together. In addition, application updates will change the way we need to look at the data. Understanding each smartphone and how it stores application data is the first step in successfully examining applications on smartphones. Knowing that updates may change data locations, encoding, and encryption, and how your tool functions, is one of the hardest concepts for examiners to grasp. It is your job to learn the capabilities of the application to uncover the most data from the mobile device.

Understanding how an application works is hard enough, and then we have to consider how to extract the artifacts. As you have read in this book, there are so many ways to parse data from smartphones. One tool...