Practical Mobile Forensics - Fourth Edition

Identifying Android malware

From a forensic perspective, it's important to identify the presence of any malware on the device prior to performing any analysis. This is because malware can alter the state of the device or contents on the device, thereby making the analysis or the results inconsistent. There are tools available on the market that can analyze the physical extraction to identify malware. For example, Cellebrite UFED Physical Analyzer has BitDefender's anti-malware technology, which scans for malware. As shown in the following screenshot, once the physical image has been loaded into the tool, the file can be scanned for malware:

Scanning for malware in UFED Physical Analyzer

Once the scan starts, the BitDefender software tries ...