Sign In Start Free Trial

Book Overview & Buying
Table Of Contents
Feedback & Rating

Learning Android Forensics

4.2 (6)

Learning Android Forensics

4.2 (6)

Overview of this book

If you are a forensic analyst or an information security professional wanting to develop your knowledge of Android forensics, then this is the book for you. Some basic knowledge of the Android mobile platform is expected.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. Introducing Android Forensics

1. Introducing Android Forensics

Mobile forensics

The mobile forensics approach

Challenges in mobile forensics

The Android architecture

Android security

2. Setting Up an Android Forensic Environment

2. Setting Up an Android Forensic Environment

The Android forensic setup

The Android SDK

Connecting and accessing an Android device from the workstation

Android Debug Bridge

Rooting Android

ADB on a rooted device

Summary

3. Understanding Data Storage on Android Devices

3. Understanding Data Storage on Android Devices

Android partition layout

Android file hierarchy

Application data storage on the device

Android filesystem overview

Summary

4. Extracting Data Logically from Android Devices

4. Extracting Data Logically from Android Devices

Logical extraction overview

Manual ADB data extraction

ADB backup extractions

ADB Dumpsys

Bypassing Android lock screens

Cracking an Android pattern lock

Android SIM card extractions

Issues and opportunities with Android Lollipop

Summary

5. Extracting Data Physically from Android Devices

5. Extracting Data Physically from Android Devices

Physical extraction overview

Extracting data physically with dd

Extracting data physically with nanddump

Analyzing a full physical image

Imaging and analyzing Android RAM

Acquiring Android SD cards

Advanced forensic methods

Summary

6. Recovering Deleted Data from an Android Device

6. Recovering Deleted Data from an Android Device

An overview of data recovery

Recovering data deleted from an SD card

Recovering data deleted from internal memory

Analyzing backups

Summary

7. Forensic Analysis of Android Applications

7. Forensic Analysis of Android Applications

Application analysis

Determining what apps are installed

Wi-Fi analysis

Contacts/call analysis

SMS/MMS analysis

User dictionary analysis

Gmail analysis

Google Chrome analysis

Google Maps analysis

Google Hangouts analysis

Google Keep analysis

Google Plus analysis

Facebook analysis

Facebook Messenger analysis

Skype analysis

Snapchat analysis

Viber analysis

Tango analysis

WhatsApp analysis

Kik analysis

WeChat analysis

Application reverse engineering

Summary

8. Android Forensic Tools Overview

8. Android Forensic Tools Overview

ViaExtract

Autopsy

ViaLab Community Edition

Summary

Conclusion

Index

Index

Customer Reviews

4.2 (6)

5 star

50%

4 star

16.7%

3 star

33.3%

2 star

0

1 star

0

Acquiring Android SD cards

As discussed above and in previous chapters, the SD card can refer to a physical, external SD card or a partition within the flash memory. A removable external SD card can be imaged separately from the device through a write-blocker with typical computer forensics tools, or using the dd/nanddump techniques shown in the previous section, although the former is usually faster as it does not need to write data over netcat.

Physically imaging an SD card is very similar to the physical imaging discussed above; in fact, if the SD card is symbolically linked to the /data partition, it would be acquired as part of the /data partition as seen in the Autopsy screenshots. The only difference in the process is that if the SD card is being imaged, the output file cannot be written to the SD card! This means using the netcat methods covered previously is the best option for physically imaging an internal SD card.

What can be found on an SD card?

By default, the SD card is typically...

Search

Your notes and bookmarks