Practical Mobile Forensics - Third Edition

Capability-based model

Capabilities are defined as the resources on the phone (camera, location information, microphone, and more) associated with security, privacy, and cost. The LPC has a minimal set of access rights by default. However, this can be expanded by requesting more capabilities during the installation. Capabilities are granted during the app installation and cannot be modified or elevated during runtime. For this reason, it is difficult to side-load applications or force custom bootcode to the device to gain forensic access, as it is normally rejected prior to bootup.

To install an app on a Windows Phone, you need to sign in to Marketplace with a Windows Live ID. During installation, apps are required to ask the user for permission ...