The exponential growth of mobile devices has revolutionized many aspects of our lives. In what is called the Post-PC era, smartphones are engulfing desktop computers with their enhanced functionality and improved storage capacity. This rapid transformation has led to increased usage of mobile handsets across all sectors.
Despite their small size, smartphones are capable of performing many tasks—sending private messages and confidential e-mails, taking photos and videos, making online purchases, viewing salary slips, completing banking transactions, accessing social networking sites, managing business tasks, and more. Hence, a mobile device is now a huge repository of sensitive data, which could provide a wealth of information about its owner. This has in turn led to the evolution of mobile device forensics, a branch of digital forensics that deals with retrieving data from a mobile device. Today, there is a huge demand for specialized forensic experts, especially given the fact that the data retrieved from a mobile device is admissible in court.
Mobile forensics is all about utilizing scientific methodologies to recover data stored within a mobile phone for legal purposes. Unlike traditional computer forensics, mobile forensics has limitations when obtaining evidence due to rapid changes in the technology and the fast-paced evolution of mobile software. With different operating systems and a wide range of models being released into the market, mobile forensics has expanded over the last 3-4 years. Specialized forensic techniques and skills are required in order to extract data under different conditions.
This book takes you through the challenges involved in mobile forensics and practically explains detailed methods on how to collect evidence from different mobile devices with the iOS, Android, BlackBerry, and Windows mobile operating systems.
The book is organized in a manner that allows you to focus independently on chapters that are specific to your required platform.
Chapter 1, Introduction to Mobile Forensics, introduces you to the concept of mobile forensics, core values, and its limitations. The chapter also provides an overview of practical approaches and best practices involved in performing mobile forensics.
Chapter 2, Understanding the Internals of iOS Devices, provides an overview of the popular Apple iOS devices, including an outline of different models and their hardware. The book explains iOS security features and device security and its impact on the iOS forensics approach. The chapter also gives an overview of the iOS file system and outlines the sensitive files that are useful for forensic examinations.
Chapter 3, Data Acquisition from iOS Devices, covers various types of forensic acquisition methods that can be performed on iOS devices and guides you through preparing your desktop machine for forensic work. The chapter also discusses passcode bypass techniques, the physical extraction of devices, and different ways that the device can be imaged.
Chapter 4, Data Acquisition from iOS Backups, provides a detailed explanation of different types of iOS backups and details what types of files are stored during the backup. The chapter also covers logical acquisition techniques to recover data from backups.
Chapter 5, iOS Data Analysis and Recovery, discusses the type of data that is stored on iOS devices and the general location of this data storage. Common file types used in iOS devices, such as plist and SQLite, are discussed in detail so you understand how data is stored on the device, which will help forensic examiners to efficiently recover data from these files.
Chapter 6, iOS Forensic Tools, provides an overview of the existing open source and commercial iOS forensics tools. These tools differ in the range of mobile phones they support and the amount of data that they can recover. The chapter describes the advantages and limitations of these tools.
Chapter 7, Understanding Android, introduces you to the Android model, file system, and its security features. It provides an explanation of how data is stored in any android device, which will be useful while carrying out forensic investigations.
Chapter 8, Android Forensic Setup and Pre Data Extraction Techniques, guides you through the Android forensic setup and other techniques to follow before extracting any information. Screen lock bypass techniques and gaining root access are also discussed in this chapter.
Chapter 9, Android Data Extraction Techniques, provides an explanation of physical, file system, and logical acquisition techniques to extract information from an Android device.
Chapter 10, Android Data Recovery Techniques, explains the possibilities and limitations for data recovery on Android devices. This chapter also covers the process to reverse engineer Android applications to unearth crucial information.
Chapter 11, Android App Analysis and Overview of Forensic Tools, covers various available open source and commercial tools, which are helpful during forensic examination of Android devices.
Chapter 12, Windows Phone Forensics, provides a basic overview of forensic approaches when dealing with Windows Phone devices.
Chapter 13, BlackBerry Forensics, provides forensic approaches to include acquisition and analysis techniques when dealing with BlackBerry devices. BlackBerry encryption and data protection is also addressed.
The book provides practical forensic approaches and explains the techniques in a simple manner. The content is organized in a manner that allows even a user with basic computer skills to examine a device and extract the required data. A Macintosh, Windows, or Linux computer will be helpful to successfully perform the methods defined in this book. Wherever possible, methods for all computer platforms are provided.
This book is intended for forensic examiners with little or basic experience in mobile forensics or open source solutions for mobile forensics. The book will also be useful to computer security professionals, researchers, and anyone seeking a deeper understanding of mobile internals. The book will also come in handy for those who are trying to recover accidentally deleted data (photos, contacts, SMS, and more).
In this book, you will find a number of styles of text that distinguish between different kinds of information. Here are some examples of these styles and an explanation of their meaning.
Code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles are shown as follows: "To view the raw disk images on the iPhone, connect a jailbroken iPhone to a workstation over SSH and run the ls -lh rdisk* command."
Any command-line input or output is written as follows:
iPhone4:/dev root# ls -lh rdisk* crw-r----- 1 root operator 14, 0 Oct 10 04:28 rdisk0 crw-r----- 1 root operator 14, 1 Oct 10 04:28 rdisk0s1 crw-r----- 1 root operator 14, 2 Oct 10 04:28 rdisk0s1s1 crw-r----- 1 root operator 14, 3 Oct 10 04:28 rdisk0s1s2
New terms and important words are shown in bold. Words that you see on the screen, in menus or dialog boxes for example, appear in the text like this: "iOS provides an option Erase All Content and Settings to wipe the data on the iPhone."
Feedback from our readers is always welcome. Let us know what you think about this book—what you liked or may have disliked. Reader feedback is important for us to develop titles that you really get the most out of.
To send us general feedback, simply send an e-mail to <[email protected]>, and mention the book title through the subject of your message.
If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, see our author guide on www.packtpub.com/authors.
Now that you are the proud owner of a Packt book, we have a number of things to help you to get the most from your purchase.
You can download the example code files for all Packt books you have purchased from your account at http://www.packtpub.com. If you purchased this book elsewhere, you can visit http://www.packtpub.com/support and register to have the files e-mailed directly to you.
We also provide you a PDF file that has color images of the screenshots/diagrams used in this book. The color images will help you better understand the changes in the output. You can download this file from: https://www.packtpub.com/sites/default/files/downloads/8311OS_ColoredImages.pdf
Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you find a mistake in one of our books—maybe a mistake in the text or the code—we would be grateful if you would report this to us. By doing so, you can save other readers from frustration and help us improve subsequent versions of this book. If you find any errata, please report them by visiting http://www.packtpub.com/support, selecting your book, clicking on the errata submission form link, and entering the details of your errata. Once your errata are verified, your submission will be accepted and the errata will be uploaded to our website, or added to any list of existing errata, under the Errata section of that title.
Piracy of copyright material on the Internet is an ongoing problem across all media. At Packt, we take the protection of our copyright and licenses very seriously. If you come across any illegal copies of our works, in any form, on the Internet, please provide us with the location address or website name immediately so that we can pursue a remedy.
Please contact us at <[email protected]> with a link to the suspected pirated material.
We appreciate your help in protecting our authors, and our ability to bring you valuable content.
You can contact us at <[email protected]> if you are having a problem with any aspect of the book, and we will do our best to address it.