Book Image

Practical Mobile Forensics - Fourth Edition

By : Rohit Tamma, Oleg Skulkin, Heather Mahalik, Satish Bommisetty
5 (1)
Book Image

Practical Mobile Forensics - Fourth Edition

5 (1)
By: Rohit Tamma, Oleg Skulkin, Heather Mahalik, Satish Bommisetty

Overview of this book

Mobile phone forensics is the science of retrieving data from a mobile phone under forensically sound conditions. This updated fourth edition of Practical Mobile Forensics delves into the concepts of mobile forensics and its importance in today's world. The book focuses on teaching you the latest forensic techniques to investigate mobile devices across various mobile platforms. You will learn forensic techniques for multiple OS versions, including iOS 11 to iOS 13, Android 8 to Android 10, and Windows 10. The book then takes you through the latest open source and commercial mobile forensic tools, enabling you to analyze and retrieve data effectively. From inspecting the device and retrieving data from the cloud, through to successfully documenting reports of your investigations, you'll explore new techniques while building on your practical knowledge. Toward the end, you will understand the reverse engineering of applications and ways to identify malware. Finally, the book guides you through parsing popular third-party applications, including Facebook and WhatsApp. By the end of this book, you will be proficient in various mobile forensic techniques to analyze and extract data from mobile devices with the help of open source solutions.

Related Content you might be interested in

Current Title:

Small book image
Practical Mobile Forensics - Fourth Edition
Rohit Tamma | Oleg Skulkin | Heather Mahalik | Satish Bommisetty
Apr, 2020 | 400 pages
Small book image
Business Intelligence Career Master Plan
Danny Moncada | Eduardo Chavez
Aug, 2023 | 284 pages
Small book image
Mastering NLP from Foundations to LLMs
Meysam Ghaffari | Lior Gazit
Apr, 2024 | 340 pages
Small book image
Principles of Data Science
Sinan Ozdemir
Jan, 2024 | 326 pages
Table of Contents (18 chapters)
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
Disclaimer
Get in touch
1
Introduction to Mobile Forensics
Introduction to Mobile Forensics
The need for mobile forensics
Understanding mobile forensics
Challenges in mobile forensics
The mobile phone evidence extraction process
Practical mobile forensic approaches
Potential evidence stored on mobile phones
Examination and analysis
Rules of evidence
Good forensic practices
Summary
Free Chapter
2
Section 1: iOS Forensics
Section 1: iOS Forensics
3
Understanding the Internals of iOS Devices
Understanding the Internals of iOS Devices
iPhone models and hardware
iPad models and hardware
The HFS Plus and APFS filesystems
The iPhone OS
Summary
4
Data Acquisition from iOS Devices
Data Acquisition from iOS Devices
Operating modes of iOS devices
Password protection and potential bypasses
Logical acquisition
Filesystem acquisition
Summary
5
Data Acquisition from iOS Backups
Data Acquisition from iOS Backups
Working with iTunes backups
Creating and analyzing backups with iTunes
Extracting unencrypted backups
Handling encrypted backup files
Working with iCloud backups
Summary
6
iOS Data Analysis and Recovery
iOS Data Analysis and Recovery
Interpreting iOS timestamps
Working with SQLite databases
Key artifacts – important iOS database files
Property lists
Other important files
Recovering deleted SQLite records
Summary
7
iOS Forensic Tools
iOS Forensic Tools
Working with Cellebrite UFED Physical Analyzer
Working with Magnet AXIOM
Working with Belkasoft Evidence Center
Working with Elcomsoft Phone Viewer
Summary
8
Section 2: Android Forensics
Section 2: Android Forensics
9
Understanding Android
Understanding Android
The evolution of Android
The Android architecture
Android security
The Android file hierarchy
The Android filesystem
Summary
10
Android Forensic Setup and Pre-Data Extraction Techniques
Android Forensic Setup and Pre-Data Extraction Techniques
Setting up a forensic environment for Android
Connecting an Android device to a workstation
Screen lock bypassing techniques
Gaining root access
Summary
11
Android Data Extraction Techniques
Android Data Extraction Techniques
Understanding data extraction techniques
Manual data extraction
Logical data extraction
Physical data extraction
Summary
12
Android Data Analysis and Recovery
Android Data Analysis and Recovery
Analyzing and extracting data from Android image files using the Autopsy tool
Understanding techniques to recover deleted files from the SD card and the internal memory
Summary
13
Android App Analysis, Malware, and Reverse Engineering
Android App Analysis, Malware, and Reverse Engineering
Analyzing widely used Android apps to retrieve valuable data
Techniques to reverse engineer an Android application
Android malware
Summary
14
Section 3: Windows Forensics and Third-Party Apps
Section 3: Windows Forensics and Third-Party Apps
15
Windows Phone Forensics
Windows Phone Forensics
Windows Phone OS
Windows 10 Mobile security model
Windows Phone filesystem
Data acquisition
Commercial forensic tool acquisition methods
Extracting data without the use of commercial tools
Key artifacts for examination
Summary
16
Parsing Third-Party Application Files
Parsing Third-Party Application Files
Introduction to third-party applications
iOS, Android, and Windows Phone application data storage
Forensic methods used to extract third-party application data
Summary
17
Other Books You May Enjoy
Other Books You May Enjoy
Leave a review - let other readers know what you think

Understanding the Internals of iOS Devices

According to Apple, there were 1.4 billion active Apple devices in 2019, 900 million of which were running on iOS. While iOS is the leading operating system (OS) for tablets worldwide, Android continues to be the leading OS for smartphones. Regardless of the statistics, if you are a forensic examiner, the chances are that you will need to conduct an examination of an iOS device.

In order to perform a forensic examination of an iOS device, you as the examiner must understand the internal components and inner workings of that device. Developing an understanding of the underlying components of a mobile device will help you understand the criticalities involved in the forensic process, including what data can be acquired, where the data is stored, and what methods can be used to access the data from that device. So, before we delve into the...

Previous Section
End of Section 1
Next Section