Browse Library
Sign In Start Free Trial
Close icon Search icon
Account
Browse Library Advanced Search Sign In Start Free Trial

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Practical Mobile Forensics
  • Toc
  • feedback
Practical Mobile Forensics

Practical Mobile Forensics

4.4 (11)
close
Practical Mobile Forensics

Practical Mobile Forensics

4.4 (11)

Overview of this book

The book is an easy-to-follow guide with clear instructions on various mobile forensic techniques. The chapters and the topics within are structured for a smooth learning curve, which will swiftly empower you to master mobile forensics. If you are a budding forensic analyst, consultant, engineer, or a forensic professional wanting to expand your skillset, this is the book for you. The book will also be beneficial to those with an interest in mobile forensics or wanting to find data lost on mobile devices. It will be helpful to be familiar with forensics in general but no prior experience is required to follow this book.
Table of Contents (15 chapters)
close
close
Preface
chevron up
Preface
What this book covers
What you need for this book
Who this book is for
Conventions
Reader feedback
Customer support
Free Chapter
1
1. Introduction to Mobile Forensics
1. Introduction to Mobile Forensics
Mobile forensics
Mobile phone evidence extraction process
Practical mobile forensic approaches
Potential evidence stored on mobile phones
Rules of evidence
Good forensic practices
Summary
2
2. Understanding the Internals of iOS Devices
2. Understanding the Internals of iOS Devices
iPhone models
iPhone hardware
iPad models
iPad hardware
File system
The HFS Plus file system
Disk layout
iPhone operating system
Summary
3
3. Data Acquisition from iOS Devices
3. Data Acquisition from iOS Devices
Operating modes of iOS devices
Physical acquisition
Acquisition via a custom ramdisk
Acquisition via jailbreaking
Summary
4
4. Data Acquisition from iOS Backups
4. Data Acquisition from iOS Backups
iTunes backup
iCloud backup
Summary
5
5. iOS Data Analysis and Recovery
5. iOS Data Analysis and Recovery
Timestamps
SQLite databases
Property lists
Other important files
Recovering deleted SQLite records
Summary
6
6. iOS Forensic Tools
6. iOS Forensic Tools
Elcomsoft iOS Forensic Toolkit
Oxygen Forensic Suite 2014
Cellebrite UFED Physical Analyzer
Paraben iRecovery Stick
Open source or free methods
Summary
7
7. Understanding Android
7. Understanding Android
The Android model
Android security
Android file hierarchy
Android file system
Summary
8
8. Android Forensic Setup and Pre Data Extraction Techniques
8. Android Forensic Setup and Pre Data Extraction Techniques
A forensic environment setup
Screen lock bypassing techniques
Gaining root access
Summary
9
9. Android Data Extraction Techniques
9. Android Data Extraction Techniques
Imaging an Android Phone
Data extraction techniques
Summary
10
10. Android Data Recovery Techniques
10. Android Data Recovery Techniques
Data recovery
Summary
11
11. Android App Analysis and Overview of Forensic Tools
11. Android App Analysis and Overview of Forensic Tools
Android app analysis
Reverse engineering Android apps
Forensic tools overview
Cellebrite – UFED
MOBILedit
Autopsy
Summary
12
12. Windows Phone Forensics
12. Windows Phone Forensics
Windows Phone OS
Windows Phone file system
Data acquisition
Summary
13
13. BlackBerry Forensics
13. BlackBerry Forensics
BlackBerry OS
Data acquisition
BlackBerry analysis
Summary
14
Index
Index

Conventions

In this book, you will find a number of styles of text that distinguish between different kinds of information. Here are some examples of these styles and an explanation of their meaning.

Code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles are shown as follows: "To view the raw disk images on the iPhone, connect a jailbroken iPhone to a workstation over SSH and run the ls -lh rdisk* command."

Any command-line input or output is written as follows:

iPhone4:/dev root# ls -lh rdisk*
crw-r----- 1 root operator 14, 0 Oct 10 04:28 rdisk0
crw-r----- 1 root operator 14, 1 Oct 10 04:28 rdisk0s1
crw-r----- 1 root operator 14, 2 Oct 10 04:28 rdisk0s1s1
crw-r----- 1 root operator 14, 3 Oct 10 04:28 rdisk0s1s2

New terms and important words are shown in bold. Words that you see on the screen, in menus or dialog boxes for example, appear in the text like this: "iOS provides an option Erase All Content and Settings to wipe the data on the iPhone."

Note

Warnings or important notes appear in a box like this.

Tip

Tips and tricks appear like this.

Next Section
bookmark search playlist font-size

Change the font size

margin-width

Change margin width

day-mode

Change background colour

Close icon Search
Country selected
Close icon Your notes and bookmarks

Delete Bookmark

Modal Close icon
Are you sure you want to delete it?
Cancel
Yes, Delete