Teams should spend at least 10 minutes discussing the Unicorn pitches from other teams and to identify at least THREE opportunities for using application data in the context of forensics.
Teams should also spend at least 10 minutes discussing the common criteria put forward by teams to identify at least THREE challenges for using application data in the context of forensics.
Teams should produce a ONE slide presentation that covers THREE opportunities for application data in forensics and THREE obstacles or challenges in using application data.
Teams should use the following concepts as starting points in the consideration of different emerging themes:
User Action Evidence. Why are applications a good resource for user engagement and insight? Are there any other sources of such data?
Analytical effort. What is the analytical effort in using application data? Do investigators need to consider if the codebase is public or private? Do investigators need to concern themselves with specific protocols?
Scale. Do investigators have concerns around the scale of the data generated by applications? Could it be a distraction from other elements of an investigation?