I’m just confused as to why mobile vendors, specifically, refuse to adopt a well used format. Cellebrite even reverted to Dar for a while, right? Why not use E01s or AFF4? It’s so frustrating.

It is transparent, but data integrity is still a thing. E01s confer integrated data validity measures which of course raw bins do not provide as well as compression. Also the speed of acquisition between DD and E01 is minimal, according to this paper from 2022: www.diva-portal.org/smash/record...

More than one timestamp would be nice 😌

And then if a vendor supports a physical extraction, what do we get? A raw bin. As if an existing, well understood forensic data container doesn’t exist. It’s only in the mobile space this happens and I have no idea why.

I get your point here, but man the prevalence of zip in mobile formats is frustrating. We have had methods of perfectly preserving and representing full file system metadata since the advent of EWF but it’s never been adopted by mobile vendors and so we have to deal with partial information.

Are those your “Digital Forensic Lairs” it’s showing on the map? Are they each in an extinct volcano?