Android Investigations Flashcards
What kind of networks does Android support?
GSM- Global System for Mobile Communications
DEN- Integrated Digital Enhanced Network
CDMA- Code Division Multiple Access
What is the Android system normally referred to as?
The stack, which is the system layout for the Android platform
What are the layers in The Stack?
- Linux Kernel
- Native Libraries
- Application Framework
- Applications/APKs
Why was Linux chosen as the base for the Android stack?
- Portability
- Security
- Features
What are some Native Libraries in the Stack?
- Web kit-Fast web rendering engine
- Sqlite- full featured sql database
- Apache Harmony-Open source implementation of Java
- OpenGL- 3D graphics libraries
- OpenSSL- Secure socket layer
What is Dalvik VM?
A purpose built virtual machine designed for Android
What services would you find in the Application Framework Layer?
- Location sensors
- Wifi
- Telephony
What are the three main components of an APK file?
- Dalvik Executable - Compiled Java Source code
- Resources- images/audio/xml files describing layout etc.
- Native Libraries- Optionally, an app may contain some native code
What file systems are supported by Android?
- YAFFS
- YAFFS2
- EXT3
- EXT4
- RFS
- FAT32
- VFAT
What methods can developers choose to store data to an Android device?
- Shared preferences
- Internal Storage
- External Storage
- SQlite
- Network
What kind of evidence can be found on an SD csrd?
- App data
- Large Files (Videos/Images)
What is NAND?
A type of non - volatile, high density flash memory.
What is eMMC
Embedded MultiMedia Card
What is a SIM card?
Subscriber Identity Module card. Used to authenticate users on a carriers network.
What is EEPROM?
Electronically Erasable, Programmable, Read Only Memory. A SIM card has this.
It contains the file system.
What is EF_ADN?
Elementary file.
Abbreviated Dialling Numbers, it’s the contact list
What is EF_FPLMN?
Elementary file.
Forbidden Public Land Mobile Network.
Stores when a user tries to connect to a forbidden network. Eg. Eir customer trying to connect to Vodafone
What is EF_LND?
Elementary file.
Last numbers dialled.
Logs for both incoming and outgoing files.
What is EF_LOCI?
Elementary file.
Contains location information on where the user last powered down the phone.
What is EF_SMS?
Elementary file.
Contains sms info like numbers sent to, possibly texts themselves.
What is rooting an Android?
The act of bypassing/removing security to gain access to the file system settings so they can be changed
What is Android SDK?
Android Software Developer Kit, used to develop Android Apps.
What can be found in the Android SDK?
- Software Libraries
- APIs
- Reference material
- An emulator
What is DDMS and where is it found?
Dalvik Debug Monitor Service, found in /tools folder of the SDK.
What are the five functional areas of DDMS?
- Task management - emulators and connected handsets are listed
- File Management - Can browse/copy files on a device/emulator
- Emulator Interaction - DDMS can send simulated events eg. Calls/sms
- Logging - logcat utility is integrated into DDMS
- Screen Capture
What are some risks of rooting and Android device?
- Bricking a phone
- Change System Files
What two cache files deal with location information?
- .cache.wifi - contains a database of WiFi routers with MAC address and gps
- .cache.cell - database of mobile communication cells and their gps
What is an FCC ID?
A unique identifier for a specific device model.
FCC= Federal Communications Commission
What is Android Debug Bridge
ADB is a programming tool that allows an Android device to be communicated with, and controlled over USB or TCP.
What does ADB “devices” command do?
Lists connected devices
What does ADB command “$adb shell” do?
Allows you to open a shell on the Android device and begin interaction with the system. Can use common Linux commands.
What command allows you to copy a file from your forensic workstation to an emulator?
Adb push (local) (remote)
How do you copy a file from an emulator to your workstation?
Adb pull (remote) (local)
What is JTAG?
Joint Test Action Group.
Is the standard for test, maintenence and support of assumbled circuit boards
What is a PCB?
Printed Circuit Board
What is a TAP ?
Test Access Port
What six popular signals does a JTAG expose?
- TDI- Test Data In
- TDO- Test Data Out
- TCK- Test Clock
- TMS- Test Mode Select
- TRST- Test Reset
- RTCK- Return Test Clock
What is a flasher box?
A mobile phone service device used by service providers and shops. Mainly used to recover user data from dead phones.
