Sign In Start Free Trial

Book Overview & Buying
Table Of Contents

Practical Mobile Forensics

4.4 (11)

Practical Mobile Forensics

4.4 (11)

Overview of this book

The book is an easy-to-follow guide with clear instructions on various mobile forensic techniques. The chapters and the topics within are structured for a smooth learning curve, which will swiftly empower you to master mobile forensics. If you are a budding forensic analyst, consultant, engineer, or a forensic professional wanting to expand your skillset, this is the book for you. The book will also be beneficial to those with an interest in mobile forensics or wanting to find data lost on mobile devices. It will be helpful to be familiar with forensics in general but no prior experience is required to follow this book.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. Introduction to Mobile Forensics

1. Introduction to Mobile Forensics

Mobile forensics

Mobile phone evidence extraction process

Practical mobile forensic approaches

Potential evidence stored on mobile phones

Rules of evidence

Good forensic practices

Summary

2. Understanding the Internals of iOS Devices

2. Understanding the Internals of iOS Devices

iPhone models

iPhone hardware

iPad models

iPad hardware

File system

The HFS Plus file system

Disk layout

iPhone operating system

Summary

3. Data Acquisition from iOS Devices

3. Data Acquisition from iOS Devices

Operating modes of iOS devices

Physical acquisition

Acquisition via a custom ramdisk

Acquisition via jailbreaking

Summary

4. Data Acquisition from iOS Backups

4. Data Acquisition from iOS Backups

iTunes backup

iCloud backup

Summary

5. iOS Data Analysis and Recovery

5. iOS Data Analysis and Recovery

Timestamps

SQLite databases

Property lists

Other important files

Recovering deleted SQLite records

Summary

6. iOS Forensic Tools

6. iOS Forensic Tools

Elcomsoft iOS Forensic Toolkit

Oxygen Forensic Suite 2014

Cellebrite UFED Physical Analyzer

Paraben iRecovery Stick

Open source or free methods

Summary

7. Understanding Android

7. Understanding Android

The Android model

Android security

Android file hierarchy

Android file system

Summary

8. Android Forensic Setup and Pre Data Extraction Techniques

8. Android Forensic Setup and Pre Data Extraction Techniques

A forensic environment setup

Screen lock bypassing techniques

Gaining root access

Summary

9. Android Data Extraction Techniques

9. Android Data Extraction Techniques

Imaging an Android Phone

Data extraction techniques

Summary

10. Android Data Recovery Techniques

10. Android Data Recovery Techniques

Data recovery

Summary

11. Android App Analysis and Overview of Forensic Tools

11. Android App Analysis and Overview of Forensic Tools

Android app analysis

Reverse engineering Android apps

Forensic tools overview

Cellebrite – UFED

MOBILedit

Autopsy

Summary

12. Windows Phone Forensics

12. Windows Phone Forensics

Windows Phone OS

Windows Phone file system

Data acquisition

Summary

13. BlackBerry Forensics

13. BlackBerry Forensics

BlackBerry OS

Data acquisition

BlackBerry analysis

Summary

Index

Index

Conventions

In this book, you will find a number of styles of text that distinguish between different kinds of information. Here are some examples of these styles and an explanation of their meaning.

Code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles are shown as follows: "To view the raw disk images on the iPhone, connect a jailbroken iPhone to a workstation over SSH and run the ls -lh rdisk* command."

Any command-line input or output is written as follows:

iPhone4:/dev root# ls -lh rdisk*
crw-r----- 1 root operator 14, 0 Oct 10 04:28 rdisk0
crw-r----- 1 root operator 14, 1 Oct 10 04:28 rdisk0s1
crw-r----- 1 root operator 14, 2 Oct 10 04:28 rdisk0s1s1
crw-r----- 1 root operator 14, 3 Oct 10 04:28 rdisk0s1s2

New terms and important words are shown in bold. Words that you see on the screen, in menus or dialog boxes for example, appear in the text like this: "iOS provides an option Erase All Content and Settings to wipe the data on the iPhone."

Note

Warnings or important notes appear in a box like this.

Tip

Tips and tricks appear like this.

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Practical Mobile Forensics

Search

Your notes and bookmarks