That's one reason he was the first to notice that Apple had begun storing its location data in the new, more easily accessible way. But all that time spent rummaging around under the iPhone's hood also led him to develop an actual philosophy about the difference between mobile and computer forensics. In mobile, he said, no one directly interacts with the file system. You don't pull up documents and save and delete them the way we do with computer.
"How are those new interactions producing evidence that would be relevant to what I'm doing?" Levinson asked rhetorically.
For him, that means knowing every single thing a phone can output for him.
"Take a basic phone, maybe a Razr," he said. "I would map out every single data point within the phone. We've got text messages. We've got pictures. We've also got picture messaging, which could be a subset. We've got call logs. We might have baseband logs." Then, he'd start to correlate one thing with another. If there are timestamps and locations, every message or photo can be fixed in space and time.
"You're beginning to create a forensic model of the human use of the device," he said. "The software's goal is to recreate a rich forensic time line of how this device was used so the analyst can put their shoes in place of the user and see what happened with this device."
Indeed, using Lantern, it's remarkably easy to reconstruct what happened to me on, say, April 13, my birthday, and the next day, when I celebrated the release of my book at an Atlantic party.
I missed a call from my best friend at 12:30 a.m. wishing me a happy birthday. I got up at 7:04 a.m., which I know because I sent him back a text message. I got several more birthday greetings and phone calls. Then I had a meeting with Richard Florida and some other Atlantic people during which I Googled several things related to the meeting. Then I went on a radio show in Colorado, which I know both because my calendar shows it, but also because I searched the radio station. Then I took a cab to Union Station (I texted, "On my way to Union Station") and snapped a picture of a tour bus that we passed which claimed to be "American-Owned & Operated." I got to New York around 7:45 p.m., when I Googled my hotel's address. The next morning, I went to WNYC at 160 Varick Street to be interviewed by Brian Lehrer, all of which is obvious from my Internet history, text messages and photos. Then I met with a prospective job candidate at Le Pain Quotidien according to my calendar and spent an hour researching RandTXT.com. Then I went to my book party at a private home, and took some photos, which Lantern pinpointed perfectly.
You could export most of this sequence to a Google Earth layer and look at it plotted with a time slider. Without trying to, I'd left a trail spelling out exactly what I did for 48 hours. Mobile forensics and mobile privacy don't have to sit in opposition, but what you can find with the former should inform our views about the latter. And you can suddenly find a ton with relatively simple tools.