Practical Mobile Forensics

By : Rohit Tamma, Oleg Skulkin, Mahalik, Satish Bommisetty

4.3 (9)

Buy this Book

Practical Mobile Forensics

4.3 (9)

By: Rohit Tamma, Oleg Skulkin, Mahalik, Satish Bommisetty

Buy this Book

Overview of this book

Mobile phone forensics is the science of retrieving data from a mobile phone under forensically sound conditions. This updated fourth edition of Practical Mobile Forensics delves into the concepts of mobile forensics and its importance in today's world. The book focuses on teaching you the latest forensic techniques to investigate mobile devices across various mobile platforms. You will learn forensic techniques for multiple OS versions, including iOS 11 to iOS 13, Android 8 to Android 10, and Windows 10. The book then takes you through the latest open source and commercial mobile forensic tools, enabling you to analyze and retrieve data effectively. From inspecting the device and retrieving data from the cloud, through to successfully documenting reports of your investigations, you'll explore new techniques while building on your practical knowledge. Toward the end, you will understand the reverse engineering of applications and ways to identify malware. Finally, the book guides you through parsing popular third-party applications, including Facebook and WhatsApp. By the end of this book, you will be proficient in various mobile forensic techniques to analyze and extract data from mobile devices with the help of open source solutions.

Preface

Who this book is for

What this book covers

To get the most out of this book

Disclaimer

Get in touch

Introduction to Mobile Forensics

The need for mobile forensics

Understanding mobile forensics

Challenges in mobile forensics

The mobile phone evidence extraction process

Practical mobile forensic approaches

Potential evidence stored on mobile phones

Examination and analysis

Rules of evidence

Good forensic practices

Summary

Free Chapter

Section 1: iOS Forensics

Understanding the Internals of iOS Devices

iPhone models and hardware

iPad models and hardware

The HFS Plus and APFS filesystems

The iPhone OS

Summary

Data Acquisition from iOS Devices

Operating modes of iOS devices

Password protection and potential bypasses

Logical acquisition

Filesystem acquisition

Summary

Data Acquisition from iOS Backups

Working with iTunes backups

Creating and analyzing backups with iTunes

Extracting unencrypted backups

Handling encrypted backup files

Working with iCloud backups

Summary

iOS Data Analysis and Recovery

Interpreting iOS timestamps

Working with SQLite databases

Key artifacts – important iOS database files

Property lists

Other important files

Recovering deleted SQLite records

Summary

iOS Forensic Tools

Working with Cellebrite UFED Physical Analyzer

Working with Magnet AXIOM

Working with Belkasoft Evidence Center

Working with Elcomsoft Phone Viewer

Summary

Section 2: Android Forensics

Understanding Android

The evolution of Android

The Android architecture

Android security

The Android file hierarchy

The Android filesystem

Summary

Android Forensic Setup and Pre-Data Extraction Techniques

Setting up a forensic environment for Android

Connecting an Android device to a workstation

Screen lock bypassing techniques

Gaining root access

Summary

Android Data Extraction Techniques

Understanding data extraction techniques

Manual data extraction

Logical data extraction

Physical data extraction

Summary

Android Data Analysis and Recovery

Analyzing and extracting data from Android image files using the Autopsy tool

Understanding techniques to recover deleted files from the SD card and the internal memory

Summary

Android App Analysis, Malware, and Reverse Engineering

Analyzing widely used Android apps to retrieve valuable data

Techniques to reverse engineer an Android application

Android malware

Summary

Section 3: Windows Forensics and Third-Party Apps

Windows Phone Forensics

Windows Phone OS

Windows 10 Mobile security model

Windows Phone filesystem

Data acquisition

Commercial forensic tool acquisition methods

Extracting data without the use of commercial tools

Key artifacts for examination

Summary

Parsing Third-Party Application Files

Introduction to third-party applications

iOS, Android, and Windows Phone application data storage

Forensic methods used to extract third-party application data

Summary

Other Books You May Enjoy

Leave a review - let other readers know what you think

Customer Reviews

4.3 (9)

5 star

55.6%

4 star

33.3%

3 star

2 star

11.1%

1 star

Password protection and potential bypasses

We want to start with the bad news: if you are examining an iPhone that runs iOS 8 or newer, and especially if it's a newer device, for example, the iPhone 6s, your chances of unlocking it are not good at all.

Of course, there are some hardware-based solutions, such as IP-BOX 3, but all of them work only occasionally, and using one of them can even result in bricking the device. With iOS 11, this problem becomes even more severe – even if the device under examination is not passcode protected, you will need the passcode anyway as it must be entered to confirm the trust between the device and your workstation.

So, what should a mobile forensic examiner do? Use the lockdown files! The lockdown files, which are stored as a plist file on trusted computers, allow you to trick the device into believing it's unlocked or trusted...