11. Android App Analysis and Overview of Forensic Tools | Practical Mobile Forensics

Sign In Start Free Trial

Book Overview & Buying
Table Of Contents

Practical Mobile Forensics

4.4 (11)

Practical Mobile Forensics

4.4 (11)

Overview of this book

The book is an easy-to-follow guide with clear instructions on various mobile forensic techniques. The chapters and the topics within are structured for a smooth learning curve, which will swiftly empower you to master mobile forensics. If you are a budding forensic analyst, consultant, engineer, or a forensic professional wanting to expand your skillset, this is the book for you. The book will also be beneficial to those with an interest in mobile forensics or wanting to find data lost on mobile devices. It will be helpful to be familiar with forensics in general but no prior experience is required to follow this book.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. Introduction to Mobile Forensics

1. Introduction to Mobile Forensics

Mobile forensics

Mobile phone evidence extraction process

Practical mobile forensic approaches

Potential evidence stored on mobile phones

Rules of evidence

Good forensic practices

Summary

2. Understanding the Internals of iOS Devices

2. Understanding the Internals of iOS Devices

iPhone models

iPhone hardware

iPad models

iPad hardware

File system

The HFS Plus file system

Disk layout

iPhone operating system

Summary

3. Data Acquisition from iOS Devices

3. Data Acquisition from iOS Devices

Operating modes of iOS devices

Physical acquisition

Acquisition via a custom ramdisk

Acquisition via jailbreaking

Summary

4. Data Acquisition from iOS Backups

4. Data Acquisition from iOS Backups

iTunes backup

iCloud backup

Summary

5. iOS Data Analysis and Recovery

5. iOS Data Analysis and Recovery

Timestamps

SQLite databases

Property lists

Other important files

Recovering deleted SQLite records

Summary

6. iOS Forensic Tools

6. iOS Forensic Tools

Elcomsoft iOS Forensic Toolkit

Oxygen Forensic Suite 2014

Cellebrite UFED Physical Analyzer

Paraben iRecovery Stick

Open source or free methods

Summary

7. Understanding Android

7. Understanding Android

The Android model

Android security

Android file hierarchy

Android file system

Summary

8. Android Forensic Setup and Pre Data Extraction Techniques

8. Android Forensic Setup and Pre Data Extraction Techniques

A forensic environment setup

Screen lock bypassing techniques

Gaining root access

Summary

9. Android Data Extraction Techniques

9. Android Data Extraction Techniques

Imaging an Android Phone

Data extraction techniques

Summary

10. Android Data Recovery Techniques

10. Android Data Recovery Techniques

Data recovery

Summary

11. Android App Analysis and Overview of Forensic Tools

11. Android App Analysis and Overview of Forensic Tools

Android app analysis

Reverse engineering Android apps

Forensic tools overview

Cellebrite – UFED

MOBILedit

Autopsy

Summary

12. Windows Phone Forensics

12. Windows Phone Forensics

Windows Phone OS

Windows Phone file system

Data acquisition

Summary

13. BlackBerry Forensics

13. BlackBerry Forensics

BlackBerry OS

Data acquisition

BlackBerry analysis

Summary

Index

Index

MOBILedit

As per the vendor, the MOBILedit forensic tool can be used to view, search, or retrieve data from a phone, including call history, phonebook, text messages, multimedia messages, files, calendars, notes, reminders, and application data such as Skype, Dropbox, Evernote, and more. It will also retrieve phone information such as IMEI, operating systems, firmware including SIM details (IMSI), ICCID, and location area information. Depending on the circumstances, MOBILedit is also able to retrieve deleted data from phones and bypass the passcode, PIN, and phone backup encryption. The setup file can be downloaded from www.mobiledit.com and can be installed easily. Once installed, perform the following steps to extract information from an Android phone using the MOBILedit software:

Ensure that USB debugging is enabled on the device and connect the Android device to the forensic workstation using a USB cable. MOBILedit attempts to detect the device, and to install the Connector app on the...

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Practical Mobile Forensics

Search

Your notes and bookmarks