Book Image

Practical Mobile Forensics - Second Edition

By : Heather Mahalik, Rohit Tamma, Satish Bommisetty
Book Image

Practical Mobile Forensics - Second Edition

By: Heather Mahalik, Rohit Tamma, Satish Bommisetty

Overview of this book

Mobile phone forensics is the science of retrieving data from a mobile phone under forensically sound conditions. This book is an update to Practical Mobile Forensics and it delves into the concepts of mobile forensics and its importance in today's world. We will deep dive into mobile forensics techniques in iOS 8 - 9.2, Android 4.4 - 6, and Windows Phone devices. We will demonstrate the latest open source and commercial mobile forensics tools, enabling you to analyze and retrieve data effectively. You will learn how to introspect and retrieve data from cloud, and document and prepare reports for your investigations. By the end of this book, you will have mastered the current operating systems and techniques so you can recover data from mobile devices by leveraging open source solutions.
Table of Contents (19 chapters)
Practical Mobile Forensics - Second Edition
Credits
About the Authors
About the Reviewer
www.PacktPub.com
Preface

Logical acquisition


A logical acquisition captures what is accessible to the user. In simple terms, it often ignores the underlying and system files. Deleted data may be reported during a logical acquisition simply because the files are marked as deleted but they exist in the free space of the SQLite databases saved on that device. We will discuss recovering SQLite data and deleted artifacts in Chapter 6, iOS Data Analysis and Recovery.

A logical acquisition is the simplest to ascertain if the device is unlocked, as it simply captures the active user data on the device. Most tools and methods that support logical acquisition of iOS devices will fail if the device is locked. Some think that if a physical image is captured, there is little to no need for a logical acquisition. However, not all data is parsed in a physical image, which is why having access to logical image, resulting in readable data will assist in digging deep in the physical image for artifacts to support your forensic investigation...