Intro to the Mobile Forensic Process

The course (CBS411) covers the mobile forensic investigation process, acquisition and handling, data sources and file organisation, Android forensic setup and extraction, Android security architecture, reverse engineering of an application, and mobile app pen testing. Reference material: Learning Android Forensics, Practical Mobile Forensics, Learning Pentesting for Android Devices, the Magnet course Core Mobile Acquisition and Analysis (AX150), the Android Architecture Security whitepaper and the Android Security documentation.

This deck has three objectives:

• Recap the digital investigation process.
• Introduce investigations that involve mobile devices.
• Learn how to handle a mobile device recovered at a crime scene.

Need for Mobile ForensicsSearch on YouTubeBookmarkSaved

• People use phones to store personal information and to do their online activity.
• Phones are used in many crimes.
• Phones are portable data carriers. They keep track of all our movements.
• There are two sides: traditional crimes where a phone holds evidence, and cybercrimes that involve mobile applications.

Mobile Device ForensicsSearch on YouTubeBookmarkSaved

Mobile device forensics is the branch of digital forensics that deals with extracting, recovering and analysing digital evidence from a mobile device under forensically sound conditions.

• Data on a device includes SMS, contacts, call records, photos, videos, documents, application files and browsing history. It also includes data deleted from the device, which the examiner tries to recover.
• Forensically sound means the process keeps the integrity of the evidence, so the evidence can be admitted in a court of law.

Phases in Mobile ForensicsSearch on YouTubeBookmarkSaved

The slide shows the phases as a top-down flow.

1. Investigation Preparation (and Identification)
2. Seizure and Isolation
3. Acquisition
4. Examination and Analysis
5. Reporting

Investigation Preparation and Identification PhaseSearch on YouTubeBookmarkSaved

• Begins when a request for examination is received.
• The examiner prepares all paperwork and forms. These document the chain of custody, ownership information, the device model, its purpose, and the information the requestor is seeking.
• The chain of custody is the chronological documentation (paper trail) showing the seizure, custody, control, transfer, analysis and disposition of physical or electronic evidence.
• From the requestor's details, the examiner must clearly understand the objective (goals) of each examination.
• The examiner also identifies other sources of potential evidence, such as removable and external data storage.

Seizure and IsolationSearch on YouTubeBookmarkSaved

The key question is: what steps and considerations apply when handling the device?

• Evidence is usually transported in anti-static bags. These protect electronic components from damage by static electricity.
• Once the device is seized, the examiner must make sure their actions do not modify data on the device.
• At the same time, the examiner must not miss any opportunity that can help the investigation (for example, a phone that is still unlocked).
• Disable the network to prevent further communication.

The "Acquisition of Mobile Phones" slide summarises the first-responder actions in four columns:

The slide also notes that acquisition differs between a phone and a PC (covered below).

Points to Consider While Handling a DeviceSearch on YouTubeBookmarkSaved

• If there is a chance, disable the passcode.
• If the device is unlocked, change settings to allow greater access to the device.
• Enable USB debugging. This gives greater access through an Android Debug Bridge (adb) connection and helps the data extraction process.
• USB debugging is usually under Settings | Developer options.
• From Android 4.2 onward, Developer options are hidden by default. To show them, go to Settings | About Phone and tap Build number 7 times.
• Enable Stay awake. The screen then stays on while charging, so the phone does not lock again.

Protecting the Seized DeviceSearch on YouTubeBookmarkSaved

• The device must be prevented from interacting with wireless radio networks.
• There is a high chance that an attacker can issue remote wipe commands. These delete all data, including emails, applications, photos, contacts and other files.
• The Android Device Manager (ADM) and several third-party apps allow the phone to be remotely wiped or locked. The attacker only needs to sign in to the Google account configured on the device.
• An attacker can also locate the device, which may be a security risk.
• For all these reasons, isolating the device from all communication sources is very important.

Can a remote wipe happen without internet access? Yes. Mobile Device Management (MDM) software can trigger a remote wipe by sending an SMS. So isolating the device from all communication options is crucial, not only from the internet.

Isolation MethodsSearch on YouTubeBookmarkSaved

AcquisitionSearch on YouTubeBookmarkSaved

• The acquisition phase is the extraction of data from the device.
• Mobile devices have inherent security features, so extraction is not always straightforward.
• The extraction method depends on the operating system, make and model of the device.

There are four software-based acquisition types: manual, logical, file system and physical. Hardware-based methods are JTAG and Chip-off.

The slide's diagram shows what each level reaches. Each level includes everything from the level before it:

Manual AcquisitionSearch on YouTubeBookmarkSaved

• The examiner visually inspects the device and records what the screen shows (screenshots or photographs of messages).
• Phone state: unlocked and fully operational.
• Data obtained: visible contacts, messages, call logs, photos in the gallery, app data visible through the UI.
• Data extracted by other methods can be verified with a manual acquisition.
• Not forensically sound. Deleted data is missing.

Logical AcquisitionSearch on YouTubeBookmarkSaved

• Extracts data through the OS using standard APIs, for example backup services, Android Debug Bridge (ADB), or Apple iTunes backups.
• Phone state: unlocked, with USB debugging or backup access enabled.
• Data obtained: contacts, SMS/MMS, call logs, photos and videos, app data (depending on OS permissions), calendar, notes, browser history.
• Limitations: no deleted data, no access to the file system structure or hidden/system files, limited app data.

File System AcquisitionSearch on YouTubeBookmarkSaved

• Extracts the file system structure, including databases and internal app files. More detailed than logical.
• Phone state: unlocked, ideally in AFU (After First Unlock) state.
• Data obtained: everything from logical acquisition, plus SQLite databases, app directories and system logs.
• May not get deleted data or unallocated space.
• May need root or jailbreak for full access on some platforms.

Physical AcquisitionSearch on YouTubeBookmarkSaved

• A bit-by-bit image of the entire storage, including unallocated space.
• Phone state: often needs an unlocked bootloader, or a rooted or jailbroken device. In rare cases it works in BFU (Before First Unlock) state, for example on some Android devices.
• Data obtained: everything from file system acquisition, plus deleted files and system partitions, hidden, encrypted or unallocated space, and malware or spyware not visible in the OS.
• Limitations: hard to perform on modern devices because of encryption. Not always possible without exploits.

ReportingSearch on YouTubeBookmarkSaved

Document the examination throughout the process, noting what was done in each phase. An examiner may record:

• Date and time the examination started
• Physical condition of the phone
• Status of the phone when received (ON/OFF)
• Make, model and operating system of the phone
• Pictures of the phone and its individual components
• Tools used during the investigation and examination
• Data documented during the examination

Present the extracted data clearly to the recipient, so it can be imported into other software for further analysis. In civil or criminal cases, collect pictures of the data as it existed on the phone where possible. These can be visually compelling to a jury.

PC Forensics vs Mobile ForensicsSearch on YouTubeBookmarkSaved

Why are write blockers not effective on phones? In mobile forensics the examiner must interact with the device to pull data. This needs a communication vector or an agent (for example ADB commands, or an agent app installed on the phone). A write blocker would make the link read-only, so the acquisition could not run.

• Even after all precautions (disconnecting, Faraday bags), some automatic functions such as alarms can trigger. If this happens, document it.
• In traditional disk forensics you image a powered-off drive and get a bit-for-bit identical copy. Mobile forensics deals with active, live systems that:
  • cannot always be powered off (because of encryption),
  • constantly write logs and other data,
  • run background app sync,
  • have clock-based changes.

Hash the extracted image or files, not the live device. For example, if you extract the WhatsApp database with AXIOM or UFED, the tool hashes the msgstore.db file. That hash can be independently verified and used in court, even if log files on the device later changed.

Challenges in Mobile ForensicsSearch on YouTubeBookmarkSaved

1. Preventing data alteration on the deviceSearch on YouTubeBookmarkSaved

• Not fully practical on phones. Switching a device ON can change some state variables.
• Background processes always run. A sudden change from one state to another can lose or modify data (for example, an alarm). The analyst may alter data intentionally or unintentionally.
• An attacker can remotely change or delete content (remote wipe through ADM, or an MDM wipe by SMS).
• So mobile forensics needs more than isolating the device from the network.

2. Wide range of operating systems and device modelsSearch on YouTubeBookmarkSaved

• For each OS there are millions of devices that differ in OS version, hardware and other features.
• Android has around 15 versions, and each manufacturer customises each version. The acquisition approach changes with the manufacturer.
• Even within one OS, data storage options and file structures can change.
• No single tool works on all mobile operating systems.

3. Inherent security featuresSearch on YouTubeBookmarkSaved

• Privacy is gaining importance, so manufacturers add strong security controls. These make access harder.
• Examples: passcode protection, full disk encryption, and file-based encryption on the latest devices. These block law enforcement and analysts from the data.
• Apple's iPhone encrypts all data by default using hardware keys built into the device. Brute-forcing these is very difficult. (Further reading: the FBI vs Apple case.)

4. Legal issuesSearch on YouTubeBookmarkSaved

• Crimes involving phones can span the globe and cross geographical boundaries.
• To handle these multi-jurisdictional issues, the examiner must know the nature of the crime and the regional law.

5 to 8. Other challengesSearch on YouTubeBookmarkSaved

5. Anti-forensic techniques: data hiding, secure wiping.
6. Passcode recovery.
7. Lack of resources and availability of tools.
8. Malicious programs on the device.

Hardware-based Forensic MethodsSearch on YouTubeBookmarkSaved

• JTAG forensics: connect to the test access points on the logic board to read memory.
• Chip-off forensics: remove the memory chip and read it directly.
• Bootloader exploitation.

These come up again in L02 with encryption, which limits them on modern phones.

Quick self-testSearch on YouTubeBookmarkSaved

Define mobile device forensics. What does "forensically sound" mean?

It is the branch of digital forensics that extracts, recovers and analyses digital evidence from a mobile device under forensically sound conditions. Forensically sound means the process keeps the integrity of the evidence, so a court can admit it.

List the five phases of mobile forensics in order.

Investigation preparation (and identification), seizure and isolation, acquisition, examination and analysis, reporting.

What is chain of custody?

The chronological documentation (paper trail) showing the seizure, custody, control, transfer, analysis and disposition of physical or electronic evidence.

A seized Android phone is unlocked. Which settings should the first responder change, and why?

Disable the passcode if possible. Enable USB debugging (Settings, About phone, tap Build number 7 times, then Developer options) so ADB can extract data. Enable Stay awake so the phone does not lock while charging. Then isolate it from networks and connect a portable battery.

Can a phone be wiped remotely without internet access? How do you prevent it?

Yes. MDM software can trigger a remote wipe by SMS. Isolate the device from all communication: Airplane Mode, or a Faraday bag or RF isolation box if Airplane Mode is not possible or Wi-Fi stays on.

Why are Faraday tents and rooms used?

Faraday bags and RF boxes block signals but you cannot see through them to use the touch screen or keypad. A Faraday tent or room lets the examiner work on the phone while it stays isolated.

Which acquisition type can recover deleted files and unallocated space, and why is it rare today?

Physical acquisition (bit-by-bit image). It usually needs an unlocked bootloader or root/jailbreak, and modern encryption makes the image hard to use without exploits.

Why is manual acquisition not forensically sound?

The examiner operates the phone and records only what the UI shows. It changes device state, and deleted data is missing. It is mainly used to verify data from other methods.

Why can't a write blocker be used on a phone, and where is hashing applied instead?

Acquisition needs two-way communication with the live device (ADB commands or an agent app). A write blocker would make it read-only and stop the acquisition. The live device keeps changing, so hash the extracted image or files (for example msgstore.db) after acquisition.

List four challenges in mobile forensics.

Any four of: preventing data alteration, wide range of OS and device models, inherent security features (encryption, passcodes), legal (multi-jurisdiction) issues, anti-forensic techniques, passcode recovery, lack of resources and tools, malicious programs.