Digital Forensics and Incident Response
On this page3
Forensics and incident-response teams use Garbo to reproduce the conditions of a mobile incident on a virtual device configured like the one involved, rehearse their procedures and prepare responders before they face a live case. Work is carried out by authorized teams within their legal mandate.
How teams use Garbo
- Prepare a virtual device configured like the one involved in an incident to test hypotheses about what happened.
- Rehearse acquisition and analysis procedures on realistic iOS environments.
- Validate forensic tools and methods against a known, documented device state.
- Train responders on realistic cases without exposing real evidence or real users' data.
Typical workflow
- Prepare — set up a virtual device configured like the one relevant to the case.
- Rehearse — run the acquisition and analysis steps the team would follow on a real device.
- Compare — check the results against the known state to confirm the method is sound.
- Reset — restore the device for the next exercise or the next hypothesis.
Why it matters
Procedures that have been rehearsed on realistic devices hold up better under pressure, and validating methods against a known state strengthens the findings that come out of a real investigation.