Book Image

Mobile Forensics Cookbook

By : Igor Mikhaylov
Book Image

Mobile Forensics Cookbook

By: Igor Mikhaylov

Overview of this book

Considering the emerging use of mobile phones, there is a growing need for mobile forensics. Mobile forensics focuses specifically on performing forensic examinations of mobile devices, which involves extracting, recovering and analyzing data for the purposes of information security, criminal and civil investigations, and internal investigations. Mobile Forensics Cookbook starts by explaining SIM cards acquisition and analysis using modern forensics tools. You will discover the different software solutions that enable digital forensic examiners to quickly and easily acquire forensic images. You will also learn about forensics analysis and acquisition on Android, iOS, Windows Mobile, and BlackBerry devices. Next, you will understand the importance of cloud computing in the world of mobile forensics and understand different techniques available to extract data from the cloud. Going through the fundamentals of SQLite and Plists Forensics, you will learn how to extract forensic artifacts from these sources with appropriate tools. By the end of this book, you will be well versed with the advanced mobile forensics techniques that will help you perform the complete forensic acquisition and analysis of user data stored in different devices.
Table of Contents (18 chapters)
Title Page
Credits
About the Author
About the Reviewer
www.PacktPub.com
Customer Feedback
Preface

Parsing plist with plist Editor Pro


Plist Editor Pro is a tool for plist-files analysis that was recommended by Heather Mahalik and Rohit Tamma, the authors of the book Practical Mobile Forensics, Second Edition. Using this tool, plist-files with XML format and binary files can be analyzed.

Getting ready

Download the tool to your computer and install it, following the instructions from the installer.

 

 

The plist Editor Pro web page can be found at http://www.icopybot.com/plist-editor.htm.

How to do it…

  1. Start the program by double-clicking on the icon:

Plist Editor Pro icon

  1. When the program starts, select View and then Read only mode in the menu. It will protect the examined file contents from accidental changes:

The Read only mode flag in the View menu

  1. In order to open the plist-file, in the drop-down File menu, select Open:

XML View mode

In the opened window, select the file and click Open. The opened file can be viewed in two modes, XML View andList View:

List View mode