Book Image

Practical Mobile Forensics - Fourth Edition

By : Rohit Tamma, Oleg Skulkin, Heather Mahalik, Satish Bommisetty
5 (1)
Book Image

Practical Mobile Forensics - Fourth Edition

5 (1)
By: Rohit Tamma, Oleg Skulkin, Heather Mahalik, Satish Bommisetty

Overview of this book

Mobile phone forensics is the science of retrieving data from a mobile phone under forensically sound conditions. This updated fourth edition of Practical Mobile Forensics delves into the concepts of mobile forensics and its importance in today's world. The book focuses on teaching you the latest forensic techniques to investigate mobile devices across various mobile platforms. You will learn forensic techniques for multiple OS versions, including iOS 11 to iOS 13, Android 8 to Android 10, and Windows 10. The book then takes you through the latest open source and commercial mobile forensic tools, enabling you to analyze and retrieve data effectively. From inspecting the device and retrieving data from the cloud, through to successfully documenting reports of your investigations, you'll explore new techniques while building on your practical knowledge. Toward the end, you will understand the reverse engineering of applications and ways to identify malware. Finally, the book guides you through parsing popular third-party applications, including Facebook and WhatsApp. By the end of this book, you will be proficient in various mobile forensic techniques to analyze and extract data from mobile devices with the help of open source solutions.

Related Content you might be interested in

Current Title:

Small book image
Practical Mobile Forensics - Fourth Edition
Rohit Tamma | Oleg Skulkin | Heather Mahalik | Satish Bommisetty
Apr, 2020 | 400 pages
Small book image
Learning Android Forensics
Rohit Tamma | Donnie Tindall | Oleg Skulkin
Dec, 2018 | 328 pages
Small book image
iOS Forensics for Investigators
Gianluca Tiepolo
May, 2022 | 316 pages
Small book image
Mobile Forensics Cookbook
Igor Mikhaylov
Dec, 2017 | 302 pages
Table of Contents (18 chapters)
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
Disclaimer
Get in touch
1
Introduction to Mobile Forensics
Introduction to Mobile Forensics
The need for mobile forensics
Understanding mobile forensics
Challenges in mobile forensics
The mobile phone evidence extraction process
Practical mobile forensic approaches
Potential evidence stored on mobile phones
Examination and analysis
Rules of evidence
Good forensic practices
Summary
Free Chapter
2
Section 1: iOS Forensics
Section 1: iOS Forensics
3
Understanding the Internals of iOS Devices
Understanding the Internals of iOS Devices
iPhone models and hardware
iPad models and hardware
The HFS Plus and APFS filesystems
The iPhone OS
Summary
4
Data Acquisition from iOS Devices
Data Acquisition from iOS Devices
Operating modes of iOS devices
Password protection and potential bypasses
Logical acquisition
Filesystem acquisition
Summary
5
Data Acquisition from iOS Backups
Data Acquisition from iOS Backups
Working with iTunes backups
Creating and analyzing backups with iTunes
Extracting unencrypted backups
Handling encrypted backup files
Working with iCloud backups
Summary
6
iOS Data Analysis and Recovery
iOS Data Analysis and Recovery
Interpreting iOS timestamps
Working with SQLite databases
Key artifacts – important iOS database files
Property lists
Other important files
Recovering deleted SQLite records
Summary
7
iOS Forensic Tools
iOS Forensic Tools
Working with Cellebrite UFED Physical Analyzer
Working with Magnet AXIOM
Working with Belkasoft Evidence Center
Working with Elcomsoft Phone Viewer
Summary
8
Section 2: Android Forensics
Section 2: Android Forensics
9
Understanding Android
Understanding Android
The evolution of Android
The Android architecture
Android security
The Android file hierarchy
The Android filesystem
Summary
10
Android Forensic Setup and Pre-Data Extraction Techniques
Android Forensic Setup and Pre-Data Extraction Techniques
Setting up a forensic environment for Android
Connecting an Android device to a workstation
Screen lock bypassing techniques
Gaining root access
Summary
11
Android Data Extraction Techniques
Android Data Extraction Techniques
Understanding data extraction techniques
Manual data extraction
Logical data extraction
Physical data extraction
Summary
12
Android Data Analysis and Recovery
Android Data Analysis and Recovery
Analyzing and extracting data from Android image files using the Autopsy tool
Understanding techniques to recover deleted files from the SD card and the internal memory
Summary
13
Android App Analysis, Malware, and Reverse Engineering
Android App Analysis, Malware, and Reverse Engineering
Analyzing widely used Android apps to retrieve valuable data
Techniques to reverse engineer an Android application
Android malware
Summary
14
Section 3: Windows Forensics and Third-Party Apps
Section 3: Windows Forensics and Third-Party Apps
15
Windows Phone Forensics
Windows Phone Forensics
Windows Phone OS
Windows 10 Mobile security model
Windows Phone filesystem
Data acquisition
Commercial forensic tool acquisition methods
Extracting data without the use of commercial tools
Key artifacts for examination
Summary
16
Parsing Third-Party Application Files
Parsing Third-Party Application Files
Introduction to third-party applications
iOS, Android, and Windows Phone application data storage
Forensic methods used to extract third-party application data
Summary
17
Other Books You May Enjoy
Other Books You May Enjoy
Leave a review - let other readers know what you think

Interpreting iOS timestamps

Before examining the data, it is important to understand different timestamp formats that are used on iOS devices. Timestamps found on iOS devices are presented either in the Unix timestamp or Mac absolute time format. You, as the examiner, must ensure that the tools properly convert the timestamps. Access to the raw SQLite files will allow you to verify these timestamps manually. You'll learn how to decode each timestamp format in the next few sections.

Unix timestamps

A Unix timestamp is the number of seconds that have elapsed since Unix epoch time, which started at midnight on January 1, 1970. A Unix timestamp can be converted easily, using the date command on a Mac workstation or using...

Previous Section
End of Section 2
Next Section