The exponential growth of mobile devices has revolutionized many aspects of our lives. In what is called as the post-PC era, smartphones are engulfing desktop computers with their enhanced functionality and improved storage capacity. This rapid transformation has led to increased usage of mobile handsets across all the sectors.
Despite their small size, smartphones are capable of performing many tasks: sending private messages and confidential e-mails, taking photos and videos, making online purchases, viewing our salary slips, completing banking transactions, accessing social networking sites, managing business tasks, and more. Hence, a mobile device is now a huge repository of sensitive data that can provide a wealth of information about its owner. This has in turn led to the evolution of Mobile Device Forensics, a branch of digital forensics that deals with retrieving data from a mobile device. Today, there is huge demand for specialized forensic experts, especially given the fact that the data retrieved from a mobile device is court admissible.
Mobile forensics is all about utilizing scientific methodologies to recover data stored within a mobile phone for legal purposes. Unlike traditional computer forensics, mobile forensics has limitations in obtaining evidence due to rapid changes in the technology and the fast-paced evolution of mobile software. With different operating systems and with a wide range of models being released into the market, mobile forensics has expanded over the last few years. Specialized forensic techniques and skills are required in order to extract data under different conditions.
This book takes you through the challenges involved in mobile forensics and practically explains detailed methods of collecting evidence from different mobile devices with iOS, Android, and Windows mobile operating systems.
This book is organized in a manner that allows you to focus independently on chapters that are specific to your required platform.
Chapter 1, Introduction to Mobile Forensics, introduces you to the concepts of mobile forensics, its core values, and its limitations. This chapter also provides an overview of practical approaches and best practices involved in performing mobile forensics.
Chapter 2, Understanding the Internals of iOS Devices, provides an overview of the popular Apple iOS devices, including an outline of different models and their hardware. Throughout this book, we explain iOS security features and device security and its impact on the iOS forensics approaches. This chapter also gives an overview of the iOS file system and outlines the sensitive files that are useful for forensic examination.
Chapter 3, iOS Forensic Tools, gives an overview of existing open source and commercial iOS forensics tools. These tools differ in the range of mobile phones they support and the amount of data that they can recover. This chapter describes the advantages and limitations of those tools
Chapter 4, Data Acquisition from iOS Devices, covers various types of forensic acquisition methods that can be performed on iOS devices and guides you through preparing your desktop machine for forensic work. This chapter also discusses passcode bypass techniques and physical extraction of the devices and explains different ways in which the device can be imaged.
Chapter 5, Data Acquisition from iOS Backups, provides detailed explanations of different types of iOS backup and details what types of file are stored in the backup. This chapter also covers logical acquisition techniques of recovering data from the backups.
Chapter 6, iOS Data Analysis and Recovery, discusses the types of data that is stored on iOS devices and the general location of this data storage. Common file types used in iOS devices such as plist and SQLite are discussed in detail to provide an understanding of how the data is being stored on the device, which will help the forensic examiners to efficiently recover data from these files.
Chapter 7, Understanding Android, introduces you to the Android model, file system, and its security features. It provides an explanation of how data is stored in any Android device, which will be useful while carrying out forensic investigation.
Chapter 8, Android Forensic Setup and Pre Data Extraction Techniques, guides you through the Android forensic setup and other techniques to follow before extracting any information. Screen lock bypass techniques and gaining root access are also discussed in this chapter.
Chapter 9, Android Data Extraction Techniques, provides an explanation of physical, file system, and logical acquisition techniques for extracting relevant information from an Android device.
Chapter 10, Android Data Analysis and Recovery, talks about extracting and analyzing data from Anroid image files. This chapter also covers possibilities and limitations for recovering deleted data from Android devices.
Chapter 11, Android App Analysis, Malware, and Reverse Engineering, covers the analysis of some of the widely used Android apps to retrieve valuable data. This chapter also covers Android malware and techniques to reverse engineer an Android app.
Chapter 12, Windows Phone Forensics, provides a basic overview of forensic approaches when dealing with Windows Phones.
Chapter 13, Parsing Third-Party Application Files, covers forensic approaches to include acquisition and analysis techniques when dealing with BlackBerry devices. BlackBerry encryption and data protection is also addressed.
This book provides practical forensic approaches and explains the techniques in a simple manner. The content is organized in a way that allows even a user with basic computer skills to examine the device and extract the required data. A Macintosh, Windows, or Linux computer will be helpful to successfully repeat the methods defined in this book. Where possible, methods for all computer platforms are provided.
This book is intended for forensic examiners with little or basic experience in mobile forensics or with open source solutions for mobile forensics. This book will also be useful to computer security professionals, researchers, and anyone seeking a deeper understanding of mobile internals. This book will also come in handy for those who are trying to recover accidentally deleted data (photos, contacts, SMS, and more.).
In this book, you will find a number of styles of text that distinguish between different kinds of information. Here are some examples of these styles, and an explanation of their meaning.
Code words in text are shown as follows: "The user data partition occupies most of the NAND memory and is mounted at /private/var on the device."
Any command-line input or output is written as follows:
$ git clone https://github.com/benvium/libimobiledevice-macosx.git ~/Desktop/libimobiledevice-macosx/
New terms and important words are shown in bold. Words that you see on the screen, in menus or dialog boxes for example, appear in the text like this: "Every time an application is suspended to the background by pressing the Home button".
Feedback from our readers is always welcome. Let us know what you think about this book—what you liked or disliked. Reader feedback is important for us as it helps us develop titles that you will really get the most out of.
To send us general feedback, simply e-mail [email protected], and mention the book's title in the subject of your message.
If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, see our author guide at www.packtpub.com/authors.
Now that you are the proud owner of a Packt book, we have a number of things to help you to get the most from your purchase.
Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you find a mistake in one of our books—maybe a mistake in the text or the code—we would be grateful if you could report this to us. By doing so, you can save other readers from frustration and help us improve subsequent versions of this book. If you find any errata, please report them by visiting http://www.packtpub.com/submit-errata, selecting your book, clicking on the Errata Submission Form link, and entering the details of your errata. Once your errata are verified, your submission will be accepted and the errata will be uploaded to our website or added to any list of existing errata under the Errata section of that title.
To view the previously submitted errata, go to https://www.packtpub.com/books/content/support and enter the name of the book in the search field. The required information will appear under the Errata section.
Piracy of copyrighted material on the Internet is an ongoing problem across all media. At Packt, we take the protection of our copyright and licenses very seriously. If you come across any illegal copies of our works in any form on the Internet, please provide us with the location address or website name immediately so that we can pursue a remedy.
Please contact us at [email protected] with a link to the suspected pirated material.
We appreciate your help in protecting our authors and our ability to bring you valuable content.
If you have a problem with any aspect of this book, you can contact us at [email protected], and we will do our best to address the problem.