Table Of ContentMastering Mobile Forensics
Develop the capacity to dig deeper into mobile device
data acquisition
Soufiane Tahiri
BIRMINGHAM - MUMBAI
[ FM-1 ]
Mastering Mobile Forensics
Copyright © 2016 Packt Publishing
All rights reserved. No part of this book may be reproduced, stored in a retrieval
system, or transmitted in any form or by any means, without the prior written
permission of the publisher, except in the case of brief quotations embedded in
critical articles or reviews.
Every effort has been made in the preparation of this book to ensure the accuracy
of the information presented. However, the information contained in this book is
sold without warranty, either express or implied. Neither the author, nor Packt
Publishing, and its dealers and distributors will be held liable for any damages
caused or alleged to be caused directly or indirectly by this book.
Packt Publishing has endeavored to provide trademark information about all of the
companies and products mentioned in this book by the appropriate use of capitals.
However, Packt Publishing cannot guarantee the accuracy of this information.
First published: May 2016
Production reference: 1250516
Published by Packt Publishing Ltd.
Livery Place
35 Livery Street
Birmingham B3 2PB, UK.
ISBN 978-1-78528-781-7
www.packtpub.com
[ FM-2 ]
Credits
Author Project Coordinator
Soufiane Tahiri Shweta H Birwatkar
Reviewer Proofreader
Michael Yasumoto Safis Editing
Commissioning Editor Indexer
Julian Ursell Hemangini Bari
Acquisition Editor Graphics
Rahul Nair Kirk D'Penha
Disha Haria
Content Development Editor Jason Monteiro
Trusha Shriyan
Production Coordinator
Technical Editor Aparna Bhagat
Taabish Khan
Cover Work
Copy Editors Aparna Bhagat
Sonia Mathur
Sneha Singh
[ FM-3 ]
About the Author
Soufiane Tahiri is an independent computer security researcher and science
enthusiast from Morocco, who specializes in .NET reverse code engineering and
software security. He has an interest in low-level techniques and in recent years
he has developed an interest in computer and smartphone forensics. He has been
involved in IT security for more than 10 years and has dozen of publications and a
lot of research in different computer security fields under his name.
I owe my deepest gratitude to a lot of people, including my family
and my friends.
This book is for my dad, Abdelkebir; I know how proud you are of
me but I want you to know how proud I am of you; you've always
been an engine for me, I love you. My mom, Halima; thank you
for your unconditional love and support, I love you, and this book
is for you. My sisters Soundous, Kaoutar, and Souad for always
supporting and telling me that they are proud of me, I love you.
I would also like to thank all my friends, especially Mounir, who
does not miss a chance to encourage me and to tell me that I can
achieve this and who bought me candies so I'd have sufficient
energy while I was writing this book, thank you brother, you are the
best. Also a big thank you to Youssef for his daily encouragement
and for giving me all the support I needed, you are my big bro. I
also want to thank Simohamed Ghannam, Ayoub Faouzi, Kamal,
Abdelouahed, and all the others whom I have not have listed here.
I want to tell all of you that I feel proud of this achievement because
of your help, support, and love. Thank you all.
[ FM-4 ]
About the Reviewer
Michael Yasumoto is the CEO at Deadbolt Forensics, a digital forensics consulting
company located in Portland, Oregon. He is a digital forensics examiner for attorneys
and private companies and has testified as an expert witness in court. He is also
an instructor for AccessData, teaching mobile forensics to law enforcement, both
domestically and abroad.
Michael holds a bachelor's degree in chemistry from the University of Washington
and a master's degree in computer science from the George Washington University.
Some of his forensic credentials include Certified Computer Examiner (CCE),
X-Ways Professional in Evidence Recovery Techniques (X-PERT), EnCase Certified
Examiner (EnCE), AccessData Certified Examiner (ACE), Cellebrite Certified Mobile
Examiner (CCME), and AccessData Mobile Examiner (AME).
[ FM-5 ]
www.PacktPub.com
eBooks, discount offers, and more
Did you know that Packt offers eBook versions of every book published, with PDF
and ePub files available? You can upgrade to the eBook version at www.PacktPub.
com and as a print book customer, you are entitled to a discount on the eBook copy.
Get in touch with us at [email protected] for more details.
At www.PacktPub.com, you can also read a collection of free technical articles, sign
up for a range of free newsletters and receive exclusive discounts and offers on Packt
books and eBooks.
TM
https://www2.packtpub.com/books/subscription/packtlib
Do you need instant solutions to your IT questions? PacktLib is Packt's online digital
book library. Here, you can search, access, and read Packt's entire library of books.
Why subscribe?
• Fully searchable across every book published by Packt
• Copy and paste, print, and bookmark content
• On demand and accessible via a web browser
[ FM-6 ]
Table of Contents
Preface v
Chapter 1: Mobile Forensics and the Investigation Process Model 1
Why mobile forensics? 2
Smartphone forensics models 4
Computer Forensic Investigation Process 5
Digital Forensic Research Workshop 6
Abstract Digital Forensics Model 7
Integrated Digital Investigation Process 7
End-to-end digital investigation process 11
Systemic Digital Forensic Investigation 12
Smartphone forensics challenges 14
Operating systems' variety and changeability 15
Important hardware variations 15
Different filesystems 16
Built-in security 16
Encrypted data wiping 16
Data volatility 17
The cloud 17
Summary 17
Chapter 2: Do It Yourself – Low-Level Techniques 19
Getting acquainted with file carving 20
Carving the JPEG format 20
Carving the ZIP format 24
Extracting metadata – GPS analysis 27
String dump and analysis 39
[ i ]
Table of Contents
Encryption versus encoding versus hashing 44
Encryption 45
Symmetric key encryption 45
Public key encryption 48
Encoding 51
ASCII and UNICODE/UTF-8 52
URL encoding 54
Hashing 55
Decompiling and disassembling 57
Summary 62
Chapter 3: iDevices from a Forensic Point of View 63
The iOS architecture 64
The iOS filesystem 66
iOS platform and hardware security 67
Identifying stored data 70
iOS acquisition and forensic approaches 76
iOS boot process and operating modes 76
Unique device identifier 77
Lockdown certificate 78
iOS acquisition 80
Normal/direct acquisition 83
Logical acquisition 84
Physical acquisition 90
iOS artifacts recovery – evidence gathering and data recovery 98
Artifact recovery using iPhone Analyzer 105
Artifact recovery using MOBILedit! Forensic 110
It's going biometric! 116
Third-party applications 117
Summary 123
Chapter 4: Android Forensics 125
Android OS – all you need to know 126
Android security model 129
Full disk encryption 131
KeyChain and KeyStore 133
Application security 133
Application sandboxing and permissions 133
Security Enhanced Linux – SELinux 136
Application signing 136
[ ii ]
Table of Contents
Bypassing security 137
Bootloader/recovery mode 139
Rooting an Android device 143
Cracking a lock pattern 146
Cracking a PIN/password 149
Android logical data acquisition 156
Logical data acquisition using ADB 156
Logical data acquisition using AFLogical OSE 165
Android physical data acquisition 168
Analyzing the acquired image using Autopsy 173
JTAG and chip-off forensic examinations 177
Third-party applications and a real case study 181
Summary 192
Chapter 5: Windows Phone 8 Forensics 193
Windows Phone 7 versus Windows Phone 8 193
Windows Phone 8 internals 194
Partitions and the filesystem 199
MainOS volume 200
User Data volume 202
Removable User Data 205
Application data storage 206
Windows phone 8 security models 207
Windows Phone 8 Secure Boot 207
Windows Phone 8 application security 209
Windows Phone data protection 211
Device access and security policies 212
BitLocker and hardware encryption 213
Windows Phone logical acquisition 215
Windows Phone logical acquisition using MOBILedit! Forensic 8.2 216
Windows Phone logical acquisition using Oxygen Forensic Suite 2014 220
Sideloading contacts and appointments acquisition agent 225
WP Logical implementation 233
Windows Phone cloud acquisition 235
Cloud acquisition using Elcomsoft Phone Breaker 236
Cloud acquisition using Passware Password Recovery Kit Forensic 238
JTAG and physical acquisition 241
Artifact location and user PIN study 247
Summary 255
[ iii ]
