Where the Blockchain Trail Goes Cold | Webinar

Where the Blockchain Trail Goes Cold | Webinar

Oct 26, 2026 | Cryptocurrency, Cyber Forensics, Featured, Webinars

Upcoming ONLINE Event

Where the Blockchain Trail Goes Cold

Most crypto investigations hit the same wall. Funds are traced to a wallet with no history, through a mixer or across a bridge, and the case stalls.

In this 45-minute session, Dan Embury from Addressable Investigations walks through what investigators can do at that point: how off-chain attribution connects on-chain activity to real-world entities, and how that turns a dead end into new leads and digital evidence.

Live Q&A at the end.

Please note: this event is for law enforcement, military and government agencies ONLY. If possible, please list your organization and register from an agency email. Free mail type email addresses may not be granted access to this event.

Dan Embury is Director, Solutions Engineering at Addressable Investigations, where he works with law enforcement and investigation teams on crypto cases that stall at the wallet. A well-known digital forensics expert, Dan brings more than 22 years at Cellebrite and the RCMP combined, tackling all sorts of mobile and computer forensics challenges.

Join Us! November 10, 2026 | 9am PT / 11am EST
Duration: 45 min – 1 hour

Reserve Your Spot!

    Turning OSINT Into Operational Intelligence | Webinar

    Turning OSINT Into Operational Intelligence | Webinar

    Oct 6, 2026 | Cyber Forensics, Featured, Upcoming Events

    Upcoming ONLINE Event

    Join Us! October 22 | 9am PST / 12pm EST

    Duration: 30-45 minutes

    From OSINT Data to Operational Intelligence — A 3-step Framework with Voyager.

    Discover how to transform vast amounts of open source data into actionable intelligence. In the webinar, we walk through Voyager’s 3-step approach (data collection, advanced analysis, and continuous monitoring) to enhance situational awareness and support decision making in government and threat intelligence operations.

    Please note: this event is for law enforcement, military and government agencies ONLY. If possible, please list your organization and register from an agency email. Free mail type email addresses may not be granted access to this event.

    Register For This Event!

    About the Presenter

    with Presenter: Stijn Brouwer
    Web-IQ Business Development

      Addressable Investigations partners with Teel Technologies Canada

      Addressable Investigations partners with Teel Technologies Canada

      Sep 16, 2026 | Featured

      Addressable Investigations Partners with Teel Technologies Canada to Bring Off-Chain Attribution to Canadian Investigators

      Investigators across Canada now have access to off-chain attribution, delivered locally by Teel Technologies Canada with training and support.

      Today we are announcing a partnership with Teel Technologies Canada, one of Canada’s leading providers of digital forensics tools and training. Since 2013, Teel has equipped and trained federal, provincial and municipal law enforcement, military, and private forensic teams across the country, with instructors drawn from serving and former law enforcement.

      Through this partnership, Teel Technologies Canada will deliver Spectra, our off-chain attribution platform, to investigators across Canada, backed by Teel’s training and local support.

      What the Partnership Covers

      Teel Technologies Canada will deliver Spectra as a complete investigative capability across the Canadian market. That includes:

      • The Spectra SaaS platform
      • API integration for teams running mature investigative stacks
      • Training programmes jointly developed by both teams
      • Onboarding and local support
      Learn more about Spectra

      Why Off-Chain Attribution Matters for Investigators

      Most crypto investigations stop at the wallet. The funds are traced. The wallet is identified. The entity behind it stays unknown.

      Fresh wallets, mixers, cross-chain bridges, privacy chains, smart contracts. The on-chain trail goes quiet, and the question becomes who, not where.

      Spectra works above the on-chain forensics stack. It connects a wallet to the entity that controls it and produces leads and digital evidence that hold up in legal proceedings. It works alongside existing blockchain analytics tools without forcing teams to change their workflow.

      What Changes for Investigators in Canada

      Three things shift for crypto-investigators across the country:

      • Leads when the on-chain trail goes cold.
        Spectra surfaces investigative starting points that on-chain tools cannot produce on their own.
      • Digital evidence that survives legal scrutiny.
        Time-stamped, structured records built for court.
      • Region-level attribution.
        Narrows jurisdiction and routes cases to the right agency, even when actors use commercial VPN infrastructure or other masking techniques.

      The teams this supports include federal, provincial and municipal law enforcement, digital forensics units, and token recovery firms.

      What Leeor Ben-Peretz, CSO at Addressable Investigations, Says

      “This partnership brings our off-chain attribution layer to one of North America’s most established digital forensics communities. Investigators in Canada get leads and digital evidence that were not available to them before, delivered with the training and support Teel is known for.”

      Leeor Ben-Peretz

      Chief Strategy Officer, Addressable Investigations

      What Teel Technologies Canada Says

      “We are thrilled to partner with Addressable Investigations to bridge the gap between complex web3 data and actionable digital evidence. By integrating their advanced off-chain attribution layer into our ecosystem, we are equipping Canadian law enforcement, military and government forensic examiners/investigators with critical tools to solve modern cases. At Teel Tech Canada, our mission has always been to provide the best tools alongside world-class training, and this partnership ensures our community stays ahead of evolving digital threats.”

      Bob Elder

      CEO, Teel Technologies Canada

        Understanding Mobile Device Lock States in Forensic Extractions

        Understanding Mobile Device Lock States in Forensic Extractions

        Apr 17, 2025 | Featured, Resources

        Understanding the lock state of a mobile device—BFU or AFU—is key to maximizing the amount of recoverable data in any forensic investigation. With encryption becoming more sophisticated, the window of opportunity to access certain types of data is narrowing. By recognizing these states and acting accordingly, investigators can ensure that valuable digital evidence is preserved and extracted effectively.

        When a mobile device is collected as digital evidence, one of the most critical factors to consider is its lock state. Whether the phone is running iOS or Android, its lock state plays a major role in how much data can be extracted. Devices may be in one of two primary states: Before First Unlock (BFU) or After First Unlock (AFU). These states determine how much information is accessible during forensic analysis, due to the implementation of file-based encryption (FBE) in modern mobile operating systems.

        Why Lock States Matter

        Modern mobile operating systems—starting from Android 7.0 and required from Android 10 onward, and all supported iOS versions—use file-based encryption. This security model ensures that different files on a device are encrypted with unique keys that are only accessible after the user enters their passcode at least once after a reboot.

        Because of this, if a device is in the BFU state, much of the user-generated data remains encrypted and unavailable, even with forensic tools. On the other hand, if the device is in AFU state, more data becomes accessible. Recognizing and preserving a device’s lock state is essential in maximizing evidence collection.

        BFU vs. AFU Extractions: What’s the Difference?

        Attribute BFU Extraction AFU Extraction
        Lock State Before passcode is entered after reboot After passcode is entered post-reboot
        User Data Access Very limited Substantial (~95% of filesystem)
        Type of Data System logs, metadata, cached content Chats, photos, browsing history, app data
        Key Limitation No access to encrypted file keys Keys are in memory, files are accessible

        Best Practices for Digital Evidence Collection

        Preserve the Lock State

        If the device is in AFU, do everything possible to keep it powered on. AFU iPhones need to be preserved within 72 hours of seizure to ensure the device’s data is obtainable. The Teel Tech Canada services team has these capabilities.

        Avoid Reboots

        A reboot can reset the state to BFU and lock away critical data.

        Isolate the Device

        Use Faraday bags to prevent remote wipes or data syncing. Airplane mode on newer model phones no longer keeps the device off the network.

        Document Everything

        Note the lock state, battery level, and any interaction with the device.

        Consult Experts

        If you’re unsure about the lock state or extraction potential, contact our office to learn more.

        Enquire About Our Services

        BFU: Before First Unlock

        A mobile device is in the BFU (Before First Unlock) state when it has been restarted or powered off and has not yet had its screen lock passcode entered. In this state, the encryption keys necessary to unlock the majority of the file system remain inaccessible.

        iOS Behavior in BFU:

        • Notification Center, Control Center, and widgets are disabled.
        • Face ID/Touch ID won’t work until the passcode is entered.
        • Attempting to unlock prompts the message: “Your passcode is required when iPhone restarts.”

        Android Behavior in BFU:

        • Access to Quick Settings, camera, and phone features is restricted.
        • The lock screen typically displays a “Phone restarted” notification and the message: “Use PIN after restart.”

        In this state, forensic tools can only extract a small subset of data—mainly limited to system logs, cached images, and some application-level metadata. While this information may be limited, it can still offer valuable leads depending on the context of the investigation.

        Photo courtedy of Dakota University DigForCE Lab

        AFU: After First Unlock

        Once a user unlocks the device after a reboot, it enters the AFU (After First Unlock) state. In this state, the encryption keys are loaded into memory, allowing forensic tools to access significantly more data than in BFU.

        Indicators of AFU State:

        • Full access to iOS features like the Control Center, widgets, Face ID, and app notifications.
        • On Android, Quick Settings, notifications, and app data become available.

        An AFU extraction can yield approximately 95% of the data accessible via a Full Filesystem extraction. This includes:

        • Text messages
        • Call logs
        • Photos and videos
        • App data (e.g., WhatsApp, Signal)
        • Web browsing history
        • Social media interactions

        However, some sensitive data like Apple Mail, Apple Health records, and granular location data remain inaccessible without the passcode and are only available through a Full Filesystem extraction.

        Forensic investigators should make every effort to keep a device powered on if it is in the AFU state. Powering off the device will revert it back to BFU, potentially locking away large amounts of user data.

        Photo courtedy of Dakota University DigForCE Lab

        Full Filesystem Extractions: The Ideal Scenario

        The most complete form of mobile device data collection is a Full Filesystem extraction. This type of extraction is possible only when the passcode is known or can be brute-forced using validated forensic methods and tools.

        A Full Filesystem extraction provides access to:

        • All user-generated data
        • Secure databases (Apple Mail, Health, Keychain)
        • Complete location history
        • Encrypted and protected app data

        While AFU extractions offer a significant amount of evidence, Full Filesystem extractions are often the gold standard in digital forensics, especially in high-stakes cases where every data point counts.

        How Teel Tech Canada Can Help!

        Understanding the lock state of a mobile device—BFU or AFU—is key to maximizing the amount of recoverable data in any forensic investigation. With encryption becoming more sophisticated, the window of opportunity to access certain types of data is narrowing. By recognizing these states and acting accordingly, investigators can ensure that valuable digital evidence is preserved and extracted effectively.

        At Teel Technologies, our forensic experts specialize in advanced mobile extractions, helping Law Enforcement, Military, and Government agencies access the crucial data needed for their case. Whether you’re facing a locked phone or need to perform a Full Filesystem extraction, our team is ready to assist.

        Contact our services team to learn more!

          Vehicle Forensics: Overcoming Challenges with Advanced Acquisition Techniques

          Vehicle Forensics: Overcoming Challenges with Advanced Acquisition Techniques

          Oct 4, 2023 | Featured

          Webinar Overview

          In this hour long session we will discover more about the advanced acquisition and decoding techniques used to recover data from vehicle infotainment systems, navigation systems, and other electronic control units.

          We will explore advanced data extraction methods used by examiners when the major tools either don’t provide support, or the hardware is not in adequate condition to use standard acquisition techniques.

          In this session you will discover how to deal with data from 3 different chip types: eMMC, NAND, and NOR; receive an overview of ISP/ Direct eMMC as an advanced non-destructive data extraction method; and as a last resort, the Chip-Off process, which is considered the most destructive.

          This webinar will feature topics that are covered in the Teel Technologies Canada 5-Day Advanced Acquisition Vehicle Forensics Training.

          Learn More About Vehicle Forensics Training

          About the Presenter – Frank Corkery

          Sales & Forensic Services Teel Tech Canada/Europe

          Frank is a digital forensics examiner and technical sales representative for Teel Technologies Canada based in Ottawa, Ontario.  He has been with Teel since 2018. His focus is on  conducting and managing digital forensic investigations following industry standard methodology for a wide range of private, public and government organizations.  Frank also works with clients to support their needs for forensics hardware, software, and services.

            Investigating Mobile Phones, Smartwatches and Cloud with MOBILedit Forensic

            Investigating Mobile Phones, Smartwatches and Cloud with MOBILedit Forensic

            Jul 13, 2023 | Featured, Upcoming Events

            Webinar Overview

            Join us as we explore the latest developments in the forensic investigation of mobile phones, smartwatches and clouds with MOBILedit Forensic. Focusing on smartwatch analyzation, this webinar will go over how smartwatches can be examined to gain additional evidence and what that can mean for your investigations.

             

            Due to the information contained in this presentation, it is not publicly available. Please contact us at events@teeltechcanada for a viewing link.

            Request a Free 30 Day Trial or Learn More About MOBILedit

            About the Presenter – Anthony Wright

            Anthony currently works throughout Europe, North America, and Oceania supporting law enforcement agencies and digital investigators with their efforts in retrieving evidence from phones, smartwatches, and clouds. Before entering the field of digital forensics, Anthony was a foreign language teacher after earning a Bachelor of Arts in Germanic Studies and Criminal Justice at Colorado State University.