Book Image

Practical Mobile Forensics - Third Edition

By : Rohit Tamma, Oleg Skulkin, Heather Mahalik, Satish Bommisetty
Book Image

Practical Mobile Forensics - Third Edition

By: Rohit Tamma, Oleg Skulkin, Heather Mahalik, Satish Bommisetty

Overview of this book

Covering up-to-date mobile platforms, this book will focuses on teaching you the most recent techniques for investigating mobile devices. We delve mobile forensics techniques in iOS 9-11, Android 7-8 devices, and Windows 10. We will demonstrate the latest open source and commercial mobile forensics tools, enabling you to analyze and retrieve data effectively. You will learn how to introspect and retrieve data from the cloud, and document and prepare reports of your investigations. By the end of this book, you will have mastered the current operating systems and the relevant techniques to recover data from mobile devices by leveraging open source solutions.
Table of Contents (19 chapters)
Title Page
Copyright and Credits
Packt Upsell
Contributors
Preface
5
iOS Data Analysis and Recovery

Encrypted backup


For encrypted backups, the backup files are encrypted using the AES256 algorithm in the CBC mode, with a unique key and a null initialization vector (IV). The unique file keys are protected with a set of class keys from the Backup keybag. The class keys in the Backup keybag are protected with a key derived from the password set in iTunes through 10,000 iterations of Password-Based Key Derivation Function 2 (PBKDF2). Both open source and commercial tools provide support for encrypted backup file parsing if the password is known. Some tools won't even prompt for a password, which makes them useless in a forensic investigation. Other tools will attempt to crack the password.

Elcomsoft Phone Breaker

Elcomsoft Phone Breaker is a GPU-accelerated commercial tool from Elcomsoft developed for the Windows platform. The tool can decrypt an encrypted backup file when the backup password is not available. The tool provides an option to launch a password brute-force attack on the encrypted...