Week 3 - Mobile Forensics Flashcards
Extraction Methods
In forensics, the best extraction choice is often the type of acquisition that provides the examiner with the greatest amount of evidence
Technologies usually support several types of acquisitions that you can use to extract the greatest amount of evidence for an examination.
Examiners can recover more information with file system and physical extractions than with a logical extraction.
These extraction types provide additional information about a handset. such as the file system and possibly hidden or deleted information.
Android SDK
Primary tool used to build, test, and debug Android applications.
Android Debugging Bridge
A built-in protocol within the Android operating system.
Enables developers to connect to an Android- based device and perform low-level commands used for development.
Forensics utilities can also use this protocol to extract data from Android devices.
When USB Debugging is enabled on devices, there is high likelihood that a physical or file system extraction will be successful on almost any Android device.
USB Debugging
Used to enable communication between the Android device and a workstation on which the Android SDK is installed.
Forensics utilities can also use this protocol to extract data from Android devices.
If enabled, this option will trigger the device to run the adb daemon.
adb daemon (adbd)
Run in the background to continuously
look for a USB connection.
The daemon will usually run under a non-privileged shell user account.
On rooted phones, however, it will run under root.
adb client
Once started, it first checks if the daemon is already running.
Communicates with local adbd over port 5037.
Forensic Recovery Partition
Physical extraction method while the device is in recovery mode.
UFED replaces the device’s original recovery partition with a custom forensic recovery partition.
The original recovery partition on the Android device can be considered as an alternative boot partition that may also change the user data, while Cellebrite’s recovery partition should not affect any of the user data.
This extraction method bypasses the user lock from a number of Samsung Android devices and is forensically sound.
Android Backup
Extraction method that communicates with a connected Android device and enables you to extract data from that device.
The data that is extracted is dependent on the device’s specific characteristics. The UFED ______ supports Android version 4.1 and later.
May provide less data than other methods, therefore, you should use this feature when other file system methods (e.g.: ADB) are not successful, or when other file system methods are not available for the device (e.g.: if the android version is not supported).
Android Backup APK Downgrade
Method extracts application data using Android backup.
During the process, the selected application version (*.apk file) is temporarily downgraded to an earlier version, so that data can be extracted.
The current version is then restored at the end of the extraction process.
Risk relating to downgrading, only use as a last resort.
Partial File System
Performs a partial file system extraction.
It bypasses any user lock and is forensically sound.
If the device is already unlocked, you should use other extraction methods.
In some cases, this method can extract data from memory, however the recommended method here would be to read the memory card with an external memory card reader.
Boot Loader
Used during the phone’s power-up stage.
Used to boot the device with a custom piece of code that directly accesses the internal flash memory.
When the device boots, the boot loader code is run on the device and the device boots into a controlled environment.
With UFED, the examiner may see a Cellebrite logo on the device, ensuring the examiner that the boot loader has successfully loaded into RAM on the device.
ADB (Rooted)
Used for Android devices that have been rooted.
Can be used when the physical extraction method is not supported.
Note: Although rooted devices are supported, it is not recommended to root a device for extraction.
Physical Extraction
Gives the user the ability to capture a bit-by-bit copy of the entire flash memory.
When using UFED, the file extension will be a binary (.bin) file.
When performing , UFED creates a single Hex extraction file for each flash memory chip, or address range utilised by the mobile device.
If several flash memory chips are installed in the mobile device, the extraction will usually create a binary file for each flash chip.
In some cases, multiple binary files will be created based upon the address ranges extracted.
Physical Extraction: Data
Captures the following
information from a mobile device:
* User data
* File system data
* Deleted data (unallocated space)
* Location data
* Hidden system data
With a physical image, examiners can use additional features in UFED Physical Analyzer to locate (carve) information from unallocated space.
Physical Extraction: Boot Loader
A common method used to physically extract binary files from mobile phones is through the ‘rescue’ or ‘download’ mode.
Operating in this mode, mobile phones are designed to allow the insertion of a small piece of code, called a _______, into the RAM during start-up in order to allow flashing of firmware.
They are often not ‘read-only’ devices, except for the UFED.
UFED will not continue its regular booting procedure into the OS, then executing forensically sound ‘read only’ actions,.
