Book Image

Mastering Mobile Forensics

By : Soufiane Tahiri
Book Image

Mastering Mobile Forensics

By: Soufiane Tahiri

Overview of this book

Mobile forensics presents a real challenge to the forensic community due to the fast and unstoppable changes in technology. This book aims to provide the forensic community an in-depth insight into mobile forensic techniques when it comes to deal with recent smartphones operating systems Starting with a brief overview of forensic strategies and investigation procedures, you will understand the concepts of file carving, GPS analysis, and string analyzing. You will also see the difference between encryption, encoding, and hashing methods and get to grips with the fundamentals of reverse code engineering. Next, the book will walk you through the iOS, Android and Windows Phone architectures and filesystem, followed by showing you various forensic approaches and data gathering techniques. You will also explore advanced forensic techniques and find out how to deal with third-applications using case studies. The book will help you master data acquisition on Windows Phone 8. By the end of this book, you will be acquainted with best practices and the different models used in mobile forensics.
Table of Contents (14 chapters)
Mastering Mobile Forensics
Credits
About the Author
About the Reviewer
www.PacktPub.com
Preface
Preparing a Mobile Forensic Workstation
Index

Third-party applications and a real case study


In today's mobile forensic world, a very big part of valuable evidence can be found by examining social media and messaging applications. The following will be a walkthrough forensic analysis of Facebook Messenger.

Facebook Messenger is the official Facebook app that lets users have text conversations with all of their connections (friends) on Facebook. Facebook Messenger offers the possibility to send and receive text messages in conversations, send and receive voice notes, make VOIP calls, share location and photos, and so on. It becomes mandatory for examiners to be prepared to investigate crimes related to online dating and social networks.

For the following investigation, a Samsung Galaxy J1 Ace running Android L 5.1.1 was the user. Facebook Messenger version 56.0.0.27.64 was installed and logically acquired from the rooted device using the adb pull command:

All Facebook Messenger data can be found under /data/data/com.facebook.orca. The directory...