Installed third party applications could contain communication or location data, but could also include photos, videos, or even tracking software, called spyware. Application data may record location data even when it is disabled on the device by the user. This data will not be found in service provider records. This type of data could be critical and this type of digital evidence should be considered in every investigation, emphasizing the need for a comprehensive assessment. As a practice, one of the first things forensic examiners should be directed to is to identify if third party apps are installed. Because of the huge number of third party applications, not all apps are decoded by forensic software. However, depending on the popularity of the application, access to previously unsupported apps can change overnight. Determining which apps can be accessed begins with knowing what apps are present and what version they are using. With that baseline information the forensic examiners will be able to quickly find out what data can be recovered. Additional information: IRIS LLC Digital Evidence Toolbox
