7. Forensic Analysis of Android Applications | Learning Android Forensics

Sign In Start Free Trial

Book Overview & Buying
Table Of Contents
Feedback & Rating

Learning Android Forensics

4.2 (6)

Learning Android Forensics

4.2 (6)

Overview of this book

If you are a forensic analyst or an information security professional wanting to develop your knowledge of Android forensics, then this is the book for you. Some basic knowledge of the Android mobile platform is expected.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. Introducing Android Forensics

1. Introducing Android Forensics

Mobile forensics

The mobile forensics approach

Challenges in mobile forensics

The Android architecture

Android security

2. Setting Up an Android Forensic Environment

2. Setting Up an Android Forensic Environment

The Android forensic setup

The Android SDK

Connecting and accessing an Android device from the workstation

Android Debug Bridge

Rooting Android

ADB on a rooted device

Summary

3. Understanding Data Storage on Android Devices

3. Understanding Data Storage on Android Devices

Android partition layout

Android file hierarchy

Application data storage on the device

Android filesystem overview

Summary

4. Extracting Data Logically from Android Devices

4. Extracting Data Logically from Android Devices

Logical extraction overview

Manual ADB data extraction

ADB backup extractions

ADB Dumpsys

Bypassing Android lock screens

Cracking an Android pattern lock

Android SIM card extractions

Issues and opportunities with Android Lollipop

Summary

5. Extracting Data Physically from Android Devices

5. Extracting Data Physically from Android Devices

Physical extraction overview

Extracting data physically with dd

Extracting data physically with nanddump

Analyzing a full physical image

Imaging and analyzing Android RAM

Acquiring Android SD cards

Advanced forensic methods

Summary

6. Recovering Deleted Data from an Android Device

6. Recovering Deleted Data from an Android Device

An overview of data recovery

Recovering data deleted from an SD card

Recovering data deleted from internal memory

Analyzing backups

Summary

7. Forensic Analysis of Android Applications

7. Forensic Analysis of Android Applications

Application analysis

Determining what apps are installed

Wi-Fi analysis

Contacts/call analysis

SMS/MMS analysis

User dictionary analysis

Gmail analysis

Google Chrome analysis

Google Maps analysis

Google Hangouts analysis

Google Keep analysis

Google Plus analysis

Facebook analysis

Facebook Messenger analysis

Skype analysis

Snapchat analysis

Viber analysis

Tango analysis

WhatsApp analysis

Kik analysis

WeChat analysis

Application reverse engineering

Summary

8. Android Forensic Tools Overview

8. Android Forensic Tools Overview

ViaExtract

Autopsy

ViaLab Community Edition

Summary

Conclusion

Index

Index

Customer Reviews

4.2 (6)

5 star

50%

4 star

16.7%

3 star

33.3%

2 star

0

1 star

0

User dictionary analysis

The user dictionary is an incredible source of data for an examiner. While it is not necessarily a standalone application, its data is stored in /data/data directory as if it were. The user dictionary is populated any time the user types a word that isn't recognized and chooses to save the word to avoid it being flagged by autocorrect. Interestingly, our test device contained dozens of words that we never typed or saved on the device. This data appears to sync with a user's Google account and persists across multiple devices. Words synced from the account were added in alphabetical order at the top of the database, while words added manually afterwards were populated in the order they were added at the bottom.

Package name: com.android.providers.userdictionary

Version: Default version with Android 5.0.1 (not listed within app)

Files of interest:

/databases/user_dict.db

The table in the user dictionary is described as follows:

Table	Description
`words`	The `word` column...

Search

Your notes and bookmarks