Sign In Start Free Trial

Book Overview & Buying
Table Of Contents
Feedback & Rating

Mobile Forensics Cookbook

By : Mikhaylov

5 (1)

Mobile Forensics Cookbook

5 (1)

By: Mikhaylov

Overview of this book

Considering the emerging use of mobile phones, there is a growing need for mobile forensics. Mobile forensics focuses specifically on performing forensic examinations of mobile devices, which involves extracting, recovering and analyzing data for the purposes of information security, criminal and civil investigations, and internal investigations. Mobile Forensics Cookbook starts by explaining SIM cards acquisition and analysis using modern forensics tools. You will discover the different software solutions that enable digital forensic examiners to quickly and easily acquire forensic images. You will also learn about forensics analysis and acquisition on Android, iOS, Windows Mobile, and BlackBerry devices. Next, you will understand the importance of cloud computing in the world of mobile forensics and understand different techniques available to extract data from the cloud. Going through the fundamentals of SQLite and Plists Forensics, you will learn how to extract forensic artifacts from these sources with appropriate tools. By the end of this book, you will be well versed with the advanced mobile forensics techniques that will help you perform the complete forensic acquisition and analysis of user data stored in different devices.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Sections

Conventions

Reader feedback

Customer support

Free Chapter

SIM Card Acquisition and Analysis

SIM Card Acquisition and Analysis

Introduction

SIM card acquisition and analysis with TULP2G

SIM card acquisition and analysis with MOBILedit Forensics

SIM card acquisition and analysis with SIMCon

SIM card acquisition and analysis with Oxygen Forensic

Android Device Acquisition

Android Device Acquisition

Introduction

Preparatory work

Android device acquisition with Oxygen Forensic

Android device acquisition with MOBILedit Forensic

Android device acquisition with Belkasoft Acquisition Tool

Android device acquisition with Magnet Aсquire

Making physical dumps of Android device without rooting

Unlocking locked Android device

Acquiring Android device through Wi-Fi

Samsung Android device acquisition with Smart Switch

Apple Device Acquisition

Apple Device Acquisition

Introduction

Apple device acquisition with Oxygen Forensics

Apple device acquisition with libmobiledevice

Apple device acquisition with Elcomsoft iOS Toolkit

Apple device acquisition with iTunes

Unlocking a locked Apple device

Windows Phone and BlackBerry Acquisition

Windows Phone and BlackBerry Acquisition

Introduction

BlackBerry acquisition with Oxygen Forensic

BlackBerry acquisition with BlackBerry Desktop Software

Windows Phone acquisition with Oxygen Forensic

Windows Phone acquisition with UFED 4PC

Clouds are Alternative Data Sources

Clouds are Alternative Data Sources

Introduction

Using Cloud Extractor to extract data from Android devices from the cloud

Using Electronic Evidence Examiner to extract data from a Facebook account

Using Elcomsoft Phone Breaker to extract data from iCloud

Using Belkasoft Evidence Center to extract data from iCloud

SQLite Forensics

SQLite Forensics

Introduction

Parsing SQLite databases with Belkasoft Evidence Center

Parsing SQLite databases with DB Browser for SQLite

Parsing SQLite databases with Oxygen Forensic SQLite Viewer

Parsing SQLite databases with SQLite Wizard

Understanding Plist Forensics

Understanding Plist Forensics

Introduction

Parsing plist with Apple Plist Viewer

Parsing plist with Belkasoft Evidence Center

Parsing plist with plist Editor Pro

Parsing plist with Plist Explorer

Analyzing Physical Dumps and Backups of Android Devices

Analyzing Physical Dumps and Backups of Android Devices

Introduction

Android physical dumps and backups parsing with Autopsy

Android TOT container parsing with Oxygen Forensics

Android backups parsing with Belkasoft Evidence Center

Android physical dumps and backups parsing with AXIOM

Android physical dumps parsing with Encase Forensic

Thumbnails analysis with ThumbnailExpert

iOS Forensics

iOS Forensics

Introduction

iOS backup parsing with iPhone Backup Extractor

iOS backup parsing with UFED Physical Analyzer

iOS backup parsing with BlackLight

iOS physical dump and backup parsing with Oxygen Forensic

iOS backup parsing with Belkasoft Evidence Center

iOS backup parsing with AXIOM

iOS backup parsing with Encase Forensic

iOS backup parsing with Elcomsoft Phone Viewer

Thumbnail analysis with iThmb Converter

Windows Phone and BlackBerry Forensics

Windows Phone and BlackBerry Forensics

Introduction

BlackBerry backup parsing with Elcomsoft Blackberry Backup Explorer Pro

BlackBerry backup parsing with Oxygen Forensic

Windows Phone physical dump and backup parsing with Oxygen Forensic

Windows Phone physical dump parsing with UFED Physical Analyzer

JTAG and Chip-off Techniques

JTAG and Chip-off Techniques

Introduction

A sample Android device JTAG

A sample Android device chip-off

A sample Windows Phone device JTAG

A sample iPhone device chip-off

Customer Reviews

5 (1)

5 star

100%

4 star

0

3 star

0

2 star

0

1 star

0

Customer support

Now that you are the proud owner of a Packt book, we have a number of things to help you to get the most from your purchase.

Errata

Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you find a mistake in one of our books-maybe a mistake in the text or the code-we would be grateful if you could report this to us. By doing so, you can save other readers from frustration and help us improve subsequent versions of this book. If you find any errata, please report them by visiting http://www.packtpub.com/submit-errata, selecting your book, clicking on the Errata Submission Form link, and entering the details of your errata. Once your errata are verified, your submission will be accepted and the errata will be uploaded to our website or added to any list of existing errata under the Errata section of that title. To view the previously submitted errata, go to https://www.packtpub.com/books/content/support and enter the name of the book in the search field. The required information will appear in the Errata section.

Piracy

Piracy of copyrighted material on the internet is an ongoing problem across all media. At Packt, we take the protection of our copyright and licenses very seriously. If you come across any illegal copies of our works in any form on the internet, please provide us with the location address or website name immediately so that we can pursue a remedy. Please contact us at [email protected] with a link to the suspected pirated material. We appreciate your help in protecting our authors and our ability to bring you valuable content.

Questions

If you have a problem with any aspect of this book, you can contact us at [email protected], and we will do our best to address the problem.

Search

Your notes and bookmarks