book

Learning Android Forensics

by Rohit Tamma, Donnie Tindall

April 2015

Beginner to intermediate

322 pages

7h 11m

English

Packt Publishing

Read now

Unlock full access

Support files, eBooks, discount offers, and moreWhy subscribe?Free access for Packt account holders
What this book covers

ErrataPiracyQuestions
Mobile forensics
Investigation PreparationSeizure and IsolationAcquisitionExamination and AnalysisReporting
The Linux kernelLibrariesDalvik virtual machineThe application frameworkThe applications layer
Security at OS level through Linux kernelPermission modelApplication sandboxingSELinux in AndroidApplication SigningSecure interprocess communicationAndroid hardware componentsCore componentsCentral processing unitBaseband processorMemorySD CardDisplayBatteryAndroid boot processBoot ROM code executionThe boot loaderThe Linux kernelThe init processZygote and DalvikSystem serverSummary
The Android forensic setup
Installing the Android SDKAndroid Virtual Device
Identifying the device cableInstalling device driversAccessing the device
Using adb to access the deviceDetecting a connected deviceDirecting commands to a specific deviceIssuing shell commandsBasic Linux commandsInstalling an applicationPulling data from the devicePushing data to the deviceRestarting the adb serverViewing log data
What is rooting?Why root?Recovery and fastbootRecovery modeAccessing the recovery modeCustom recoveryFastboot modeLocked and unlocked boot loadersHow to rootRooting an unlocked boot loaderRooting a locked boot loader
Android partition layoutCommon partitions in Androidboot loaderbootrecoveryuserdatasystemcacheradioIdentifying partition layout
An overview of directoriesacctcacheddatadalvik-cachedatadevinitmntprocrootsbinmiscsdcardsystembuild.propappframeworkueventd.goldfish.rc and ueventd.rc
Shared preferencesInternal storageExternal storageSQLite databaseNetwork
Viewing filesystems on an Android deviceCommon Android filesystemsFlash memory filesystemsMedia-based filesystemsPseudo filesystems
Logical extraction overviewWhat data can be recovered logically?Root access
USB debuggingUsing ADB shell to determine if a device is rootedADB pullRecovery modeFastboot modeDetermining bootloader statusBooting to a custom recovery image
Extracting a backup over ADBParsing ADB backupsData locations within ADB backups
Dumpsys batterystatsDumpsys procstatsDumpsys userDumpsys App OpsDumpsys Wi-FiDumpsys notificationDumpsys conclusions
Lock screen typesNone/Slide lock screensPattern lock screensPassword/PIN lock screensSmart LocksTrusted FaceTrusted LocationTrusted DeviceGeneral bypass information
Cracking an Android PIN/Password
Acquiring SIM card dataSIM securitySIM cloning
Physical extraction overviewWhat data can be acquired physically?Root access
Determining what to imageWriting to an SD cardWriting directly to an examiner's computer with netcatInstalling netcat on the deviceUsing netcat
Verifying a full physical image
AutopsyIssues with analyzing physical dumps
What can be found in RAM?Imaging RAM with LiMEImaging RAM with memOutput from mem
What can be found on an SD card?SD card security
JTAGChip-offBypassing Android full-disk encryption
An overview of data recoveryHow can deleted files be recovered?
Recovering deleted data by parsing SQLite filesRecovering deleted data through file carving techniques
Application analysisWhy do app analysis?The layout of this chapter
Understanding Linux epoch time
Decoding the WebKit time format
Converting a Julian date
Recovering video messages from Skype
Decoding Tango messages
Decrypting WhatsApp backups
Decrypting the WeChat EnMicroMsg.db database
Obtaining the application's APK fileDisassembling an APK fileDetermining an application's permissionsViewing the application's code
ViaExtractBackup extraction with ViaExtractLogical extraction with ViaExtractExamining data in ViaExtractOther tools within ViaExtract
Creating a case in AutopsyAnalyzing data in Autopsy
Setting up the emulator in ViaLabInstalling an application on the emulatorAnalyzing data with ViaLab

Content preview from Learning Android Forensics

Rooting Android

"Rooting" is a word that is very often heard with respect to Android devices. As a forensic examiner, it is essential to understand this in detail. This will help you gain the knowledge that is required to understand the internals of the device. It will also help you gain expertise on several issues that are encountered during an investigation. Rooting Android phones has become a common phenomenon and rooted phones are very often encountered during investigations. Also, depending on the situation and data to be extracted, the examiner himself has to root the device in order to extract certain data. The following sections talk about rooting an Android device and other related concepts.