Browse Library
Sign In Start Free Trial
Close icon Search icon
Account
Browse Library Advanced Search Sign In Start Free Trial

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Book Overview & Buying Practical Mobile Forensics
  • Table Of Contents Toc
  • Feedback & Rating feedback
Practical Mobile Forensics

Practical Mobile Forensics

By : Mahalik, Satish Bommisetty
4.8 (8)
Buy this Book
close
close
Practical Mobile Forensics

Practical Mobile Forensics

4.8 (8)
By: Mahalik, Satish Bommisetty

Overview of this book

Covering up-to-date mobile platforms, this book will focuses on teaching you the most recent techniques for investigating mobile devices. We delve mobile forensics techniques in iOS 9-11, Android 7-8 devices, and Windows 10. We will demonstrate the latest open source and commercial mobile forensics tools, enabling you to analyze and retrieve data effectively. You will learn how to introspect and retrieve data from the cloud, and document and prepare reports of your investigations. By the end of this book, you will have mastered the current operating systems and the relevant techniques to recover data from mobile devices by leveraging open source solutions.
Table of Contents (14 chapters)
close
close
close
Free Chapter
1
Introduction to Mobile Forensics
Introduction to Mobile Forensics
Why do we need mobile forensics?
Mobile forensics
The mobile phone evidence extraction process
Practical mobile forensic approaches
Potential evidence stored on mobile phones
Examination and analysis
Rules of evidence
Good forensic practices
Summary
2
Understanding the Internals of iOS Devices
Understanding the Internals of iOS Devices
iPhone models
iPhone hardware
iPad models
Understanding the iPad hardware
Apple Watch models
Understanding the Apple Watch hardware
The filesystem
The HFS Plus filesystem
The APFS filesystem
Disk layout
iPhone operating system
Summary
3
Data Acquisition from iOS Devices
Data Acquisition from iOS Devices
Operating modes of iOS devices
Logical acquisition
Filesystem acquisition
Physical acquisition
Summary
4
Data Acquisition from iOS Backups
Data Acquisition from iOS Backups
iTunes backup
Extracting unencrypted backups
Encrypted backup
Working with iCloud backups
Summary
5
iOS Data Analysis and Recovery
iOS Data Analysis and Recovery
Timestamps
Summary
6
iOS Forensic Tools
iOS Forensic Tools
Working with Cellebrite UFED Physical Analyzer
Working with Magnet AXIOM
Working with Belkasoft Evidence Center
Working with Oxygen Forensic Detective
Summary
7
Understanding Android
Understanding Android
The evolution of Android
The Android model
Android security
The Android file hierarchy
The Android file system
Summary
8
Android Forensic Setup and Pre-Data Extraction Techniques
Android Forensic Setup and Pre-Data Extraction Techniques
Setting up the forensic environment for Android
Screen lock bypassing techniques
Gaining root access
Summary
9
Android Data Extraction Techniques
Android Data Extraction Techniques
Data extraction techniques
Summary
10
Android Data Analysis and Recovery
Android Data Analysis and Recovery
Analyzing an Android image
Android data recovery
Summary
11
Android App Analysis, Malware, and Reverse Engineering
Android App Analysis, Malware, and Reverse Engineering
Analyzing Android apps
Reverse engineering Android apps
Android malware
Summary
12
Windows Phone Forensics
chevron up
Windows Phone Forensics
Windows Phone OS
Security model
Windows Phone filesystem
Data acquisition
Commercial forensic tool acquisition methods
Key artifacts for examination
Summary
13
Parsing Third-Party Application Files
Parsing Third-Party Application Files
Third-party application overview
Encoding versus encryption
Application data storage
Forensic methods used to extract third-party application data
Summary
14
Other Books You May Enjoy
Other Books You May Enjoy
Leave a review - let other readers know what you think

Key artifacts for examination

In this section, we are going to introduce you to the location of some of the most common Windows Phone forensic artifacts, including contacts, SMS, and call and internet history.

Extracting contacts and SMS

All the contacts and incoming and outgoing short messages (SMS) in Windows Phone 7–10 are stored in the file named store.vol, which is present under the \Application Data\Microsoft\Outlook\Stores\DeviceStore (Windows 7) and Users\WPCOMMSERVICES\APPDATA\Local\Unistore (Windows 8-10) directories. An example of a Windows 10 store.vol file is shown in the following screenshot:

The store.vol file in a Windows Phone

Extracting call history

Call history data can currently be extracted from the Phone file. It's important to note that the file doesn't have an extension and is located at \Users\WPCOMMSERVICES\APPDATA\ Local\UserData\. Here is an example of a Windows 10 Phone file:

The Phone file in a Windows Phone

Extracting internet history

Internet history can be extracted...

Unlock full access

Continue reading for free

A Packt free trial gives you instant online access to our library of over 7000 practical eBooks and videos, constantly updated with the latest in tech
Start a 7-day FREE trial
End of Section 4
Next Section
bookmark search playlist font-size

Change the font size

margin-width

Change margin width

day-mode

Change background colour

Close icon Search
Country selected
Close icon Your notes and bookmarks

Delete Bookmark

Modal Close icon
Are you sure you want to delete it?
Cancel
Yes, Delete

Confirmation

Modal Close icon
claim successful
Order Page Read Now

Buy this book with your credits?

Modal Close icon
Are you sure you want to buy this book with one of your credits?
Close
YES, BUY