Book Image

Practical Mobile Forensics - Second Edition

By : Heather Mahalik, Rohit Tamma, Satish Bommisetty
Book Image

Practical Mobile Forensics - Second Edition

By: Heather Mahalik, Rohit Tamma, Satish Bommisetty

Overview of this book

Mobile phone forensics is the science of retrieving data from a mobile phone under forensically sound conditions. This book is an update to Practical Mobile Forensics and it delves into the concepts of mobile forensics and its importance in today's world. We will deep dive into mobile forensics techniques in iOS 8 - 9.2, Android 4.4 - 6, and Windows Phone devices. We will demonstrate the latest open source and commercial mobile forensics tools, enabling you to analyze and retrieve data effectively. You will learn how to introspect and retrieve data from cloud, and document and prepare reports for your investigations. By the end of this book, you will have mastered the current operating systems and techniques so you can recover data from mobile devices by leveraging open source solutions.
Table of Contents (19 chapters)
Practical Mobile Forensics - Second Edition
Credits
About the Authors
About the Reviewer
www.PacktPub.com
Preface

Timestamps


Before examining the data, it is important to understand the different timestamps that are used on iOS devices. Timestamps found on iOS devices are presented either in the UNIX timestamp or Mac absolute time format. The examiner must ensure that the tools properly convert the timestamps for the files. Access to the raw SQLite files will allow the examiner to verify these timestamps manually. Further information on iOS timestamps can be found at http://www.zdziarski.com/blog/wp-content/uploads/2013/05/iOS-Forensic-Investigative-Methods.pdf.

UNIX timestamps

A UNIX timestamp is the number of seconds that offsets the UNIX epoch time, which starts on January 1, 1970. A UNIX timestamp can be converted easily using the date command on a Mac workstation or using an online UNIX epoch converter on a Windows workstation. The date command is as follows:

$date -r 1455070351
Tues Feb 9 21:12:31 EST 2016

Mac absolute time

iOS devices adopted the use of Mac absolute time with iOS 5 for most of the...