Book Image

Learning Android Forensics

Book Image

Learning Android Forensics

Overview of this book

Related Content you might be interested in

Current Title:

Small book image
Learning Android Forensics
Apr, 2015 | 322 pages
No titles found
Table of Contents (15 chapters)
Learning Android Forensics
Learning Android Forensics
Credits
Credits
About the Authors
About the Authors
About the Reviewers
About the Reviewers
www.PacktPub.com
www.PacktPub.com
Preface
Preface
Free Chapter
1
Introducing Android Forensics
Introducing Android Forensics
Mobile forensics
The mobile forensics approach
Challenges in mobile forensics
The Android architecture
Android security
2
Setting Up an Android Forensic Environment
Setting Up an Android Forensic Environment
The Android forensic setup
The Android SDK
Connecting and accessing an Android device from the workstation
Android Debug Bridge
Rooting Android
ADB on a rooted device
Summary
3
Understanding Data Storage on Android Devices
Understanding Data Storage on Android Devices
Android partition layout
Android file hierarchy
Application data storage on the device
Android filesystem overview
Summary
4
Extracting Data Logically from Android Devices
Extracting Data Logically from Android Devices
Logical extraction overview
Manual ADB data extraction
ADB backup extractions
ADB Dumpsys
Bypassing Android lock screens
Cracking an Android pattern lock
Android SIM card extractions
Issues and opportunities with Android Lollipop
Summary
5
Extracting Data Physically from Android Devices
Extracting Data Physically from Android Devices
Physical extraction overview
Extracting data physically with dd
Extracting data physically with nanddump
Analyzing a full physical image
Imaging and analyzing Android RAM
Acquiring Android SD cards
Advanced forensic methods
Summary
6
Recovering Deleted Data from an Android Device
Recovering Deleted Data from an Android Device
An overview of data recovery
Recovering data deleted from an SD card
Recovering data deleted from internal memory
Analyzing backups
Summary
7
Forensic Analysis of Android Applications
Forensic Analysis of Android Applications
Application analysis
Determining what apps are installed
Wi-Fi analysis
Contacts/call analysis
SMS/MMS analysis
User dictionary analysis
Gmail analysis
Google Chrome analysis
Google Maps analysis
Google Hangouts analysis
Google Keep analysis
Google Plus analysis
Facebook analysis
Facebook Messenger analysis
Skype analysis
Snapchat analysis
Viber analysis
Tango analysis
WhatsApp analysis
Kik analysis
WeChat analysis
Application reverse engineering
Summary
8
Android Forensic Tools Overview
Android Forensic Tools Overview
ViaExtract
Autopsy
ViaLab Community Edition
Summary
Conclusion
Index
Index

Viber analysis

Viber is a messaging and voice-/video-calling app with over 100,000,000 downloads.

Package name: com.viber.voip

Version: 5.2.1

Files of interest:

  • /files/preferences/

    • activated_sim_serial

    • display_name

    • reg_viber_phone_num

  • /sdcard/viber/media/

    • /User Photos/

    • /Viber Images/

    • /Viber Videos/

  • /databases/

    • viber_data

    • viber_messages

The files in /files/preferences contain the SIM card's Integrated Circuit Card ID (ICCID), the name the user displays in the app, and the phone number used to register with the app.

The files in the /sdcard/viber/media path are the profile photos of people in the user's contact list who use Viber (regardless of whether they have been added as friends in the app) and all images and video sent through the app.

The viber_data file is a database, even though it does not have the .db file extension. It contains information about the user's contacts:

Table

Description

calls

This table did not populate, even though we made calls from within the app.

...
Previous Section
End of Section 18
Next Section