Kevin Mansell was invited to address over a hundred phone examiners from the law enforcement community at the Mobile Telephone Examiner’s Conference in February 2009. Kevin delivered a presentation titled ‘How Big Is Your Iceberg?’ which is now frequently referred to simply as ‘The Iceberg’ presentation.
Kevin suggested that the forensic examinations of electronic devices such as mobile phones are akin to icebergs. What you can see “above the water line” may only really be a fraction of the potential evidence which can be recovered, and which may be relevant, to an investigation.
In his presentaion, Kevin explored what lies “under the water” and how the use of physical acquisitions (“hex dumps”) to retrieve deleted data, free software tools and knowledge of how mobile devices store data internally can radically enhance an investigator’s ability to retrieve key evidence.