Browse Library
Sign In Start Free Trial
Close icon Search icon
Account
Browse Library Advanced Search Sign In Start Free Trial

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Book Overview & Buying Learning Android Forensics
  • Table Of Contents Toc
  • Feedback & Rating feedback
Learning Android Forensics

Learning Android Forensics

4.2 (6)
Buy this Book
close
close
Learning Android Forensics

Learning Android Forensics

4.2 (6)
Buy this Book

Overview of this book

If you are a forensic analyst or an information security professional wanting to develop your knowledge of Android forensics, then this is the book for you. Some basic knowledge of the Android mobile platform is expected.
Table of Contents (10 chapters)
close
close
close
Preface
Icon
Preface
Icon
What this book covers
Icon
What you need for this book
Icon
Who this book is for
Icon
Conventions
Icon
Reader feedback
Icon
Customer support
Free Chapter
1
1. Introducing Android Forensics
Icon
1. Introducing Android Forensics
Icon
Mobile forensics
Icon
The mobile forensics approach
Icon
Challenges in mobile forensics
Icon
The Android architecture
Icon
Android security
2
2. Setting Up an Android Forensic Environment
Icon
2. Setting Up an Android Forensic Environment
Icon
The Android forensic setup
Icon
The Android SDK
Icon
Connecting and accessing an Android device from the workstation
Icon
Android Debug Bridge
Icon
Rooting Android
Icon
ADB on a rooted device
Icon
Summary
3
3. Understanding Data Storage on Android Devices
Icon
3. Understanding Data Storage on Android Devices
Icon
Android partition layout
Icon
Android file hierarchy
Icon
Application data storage on the device
Icon
Android filesystem overview
Icon
Summary
4
4. Extracting Data Logically from Android Devices
Icon
4. Extracting Data Logically from Android Devices
Icon
Logical extraction overview
Icon
Manual ADB data extraction
Icon
ADB backup extractions
Icon
ADB Dumpsys
Icon
Bypassing Android lock screens
Icon
Cracking an Android pattern lock
Icon
Android SIM card extractions
Icon
Issues and opportunities with Android Lollipop
Icon
Summary
5
5. Extracting Data Physically from Android Devices
Icon
5. Extracting Data Physically from Android Devices
Icon
Physical extraction overview
Icon
Extracting data physically with dd
Icon
Extracting data physically with nanddump
Icon
Analyzing a full physical image
Icon
Imaging and analyzing Android RAM
Icon
Acquiring Android SD cards
Icon
Advanced forensic methods
Icon
Summary
6
6. Recovering Deleted Data from an Android Device
Icon
6. Recovering Deleted Data from an Android Device
Icon
An overview of data recovery
Icon
Recovering data deleted from an SD card
Icon
Recovering data deleted from internal memory
Icon
Analyzing backups
Icon
Summary
7
7. Forensic Analysis of Android Applications
chevron up
Icon
7. Forensic Analysis of Android Applications
Icon
Application analysis
Icon
Determining what apps are installed
Icon
Wi-Fi analysis
Icon
Contacts/call analysis
Icon
SMS/MMS analysis
Icon
User dictionary analysis
Icon
Gmail analysis
Icon
Google Chrome analysis
Icon
Google Maps analysis
Icon
Google Hangouts analysis
Icon
Google Keep analysis
Icon
Google Plus analysis
Icon
Facebook analysis
Icon
Facebook Messenger analysis
Icon
Skype analysis
Icon
Snapchat analysis
Icon
Viber analysis
Icon
Tango analysis
Icon
WhatsApp analysis
Icon
Kik analysis
Icon
WeChat analysis
Icon
Application reverse engineering
Icon
Summary
8
8. Android Forensic Tools Overview
Icon
8. Android Forensic Tools Overview
Icon
ViaExtract
Icon
Autopsy
Icon
ViaLab Community Edition
Icon
Summary
Icon
Conclusion
9
Index
Icon
Index

WhatsApp analysis

WhatsApp is a popular chat-/video-messaging service with over 500,000,000 downloads in Google Play.

Package name: com.whatsapp

Version: 2.11.498

Files of interest:

  • /files/

    • Avatars/

    • me

    • me.jpeg

  • /shared_prefs/

    • RegisterPhone.xml

    • VerifySMS.xml

  • /databases/

    • msgstore.db

    • wa.db

  • /sdcard/WhatsApp/

    • Media/

    • Databases/

The /files/avatars directory contains thumbnails of the profile pictures of contacts that use the app, and me.jpg is a full-size version of the user's profile picture. The me file contains the phone number associated with the account

The phone number associated with the account can also be recovered in /shared_prefs/RegisterPhone.xml. The /shared_prefs/VerifySMS.xml file shows the time that the account was verified (in the Linux epoch format, of course), indicating when the user first began using the app.

The msgstore.db database, like it sounds, contains messaging data:

Table

Description

chat_list

The key_remote_jid column shows each account the user has communicated...

Unlock full access

Continue reading for free

A Packt free trial gives you instant online access to our library of over 7000 practical eBooks and videos, constantly updated with the latest in tech
Start a 7-day FREE trial
End of Chapter 7
Next Chapter

Create a Note

Modal Close icon
You need to login to use this feature.
notes
bookmark search playlist font-size

Change the font size

margin-width

Change margin width

day-mode

Change background colour

Close icon Search
Country selected
Close icon Your notes and bookmarks

Delete Bookmark

Modal Close icon
Are you sure you want to delete it?
Cancel
Yes, Delete

Delete Note

Modal Close icon
Are you sure you want to delete it?
Cancel
Yes, Delete

Edit Note

Modal Close icon
Write a note (max 255 characters)
Cancel
Update Note

Confirmation

Modal Close icon
claim successful
Order Page Read Now

Buy this book with your credits?

Modal Close icon
Are you sure you want to buy this book with one of your credits?
Close
YES, BUY