An Introduction to Forensics Data Acquisition From Android Mobile Devices

The position {that a} Digital Forensics Investigator (DFI) is rife with steady studying alternatives, particularly as expertise expands and proliferates into each nook of communications, leisure and enterprise. As a DFI, we cope with a each day onslaught of recent gadgets. Many of those gadgets, just like the cellular phone or pill, use widespread working programs that we want to be acquainted with. Definitely, the Android OS is predominant within the pill and cellular phone business. Given the predominance of the Android OS within the cell gadget market, DFIs will run into Android gadgets in the midst of many investigations. Whereas there are a number of fashions that counsel approaches to buying information from Android gadgets, this text introduces 4 viable strategies that the DFI ought to think about when proof gathering from Android gadgets.

A Little bit of Historical past of the Android OS

Android’s first industrial launch was in September, 2008 with model 1.0. Android is the open supply and ‘free to use’ working system for cell gadgets developed by Google. Importantly, early on, Google and different {hardware} corporations fashioned the “Open Handset Alliance” (OHA) in 2007 to foster and assist the expansion of the Android within the market. The OHA now consists of 84 {hardware} corporations together with giants like Samsung, HTC, and Motorola (to title a number of). This alliance was established to compete with corporations who had their very own market choices, comparable to aggressive gadgets supplied by Apple, Microsoft (Home windows Telephone 10 – which is now reportedly lifeless to the market), and Blackberry (which has ceased making {hardware}). Regardless if an OS is defunct or not, the DFI should know in regards to the numerous variations of a number of working system platforms, particularly if their forensics focus is in a specific realm, comparable to cell gadgets.

Linux and Android

The present iteration of the Android OS is predicated on Linux. Remember the fact that “based mostly on Linux” doesn’t imply the same old Linux apps will all the time run on an Android and, conversely, the Android apps that you simply may take pleasure in (or are acquainted with) is not going to essentially run in your Linux desktop. However Linux is just not Android. To make clear the purpose, please observe that Google chosen the Linux kernel, the important a part of the Linux working system, to handle the {hardware} chipset processing in order that Google’s builders would not have to be involved with the specifics of how processing happens on a given set of {hardware}. This enables their builders to give attention to the broader working system layer and the consumer interface options of the Android OS.

A Massive Market Share

The Android OS has a considerable market share of the cell gadget market, primarily due to its open-source nature. An extra of 328 million Android gadgets had been shipped as of the third quarter in 2016. And, in accordance to netwmarketshare.com, the Android working system had the majority of installations in 2017 — almost 67% — as of this writing.

As a DFI, we are able to anticipate to encounter Android-based {hardware} in the midst of a typical investigation. Due to the open supply nature of the Android OS at the side of the various {hardware} platforms from Samsung, Motorola, HTC, and so forth., the number of mixtures between {hardware} kind and OS implementation presents a further problem. Contemplate that Android is at the moment at model 7.1.1, but every telephone producer and cell gadget provider will sometimes modify the OS for the particular {hardware} and repair choices, giving a further layer of complexity for the DFI, because the strategy to information acquisition might fluctuate.

Earlier than we dig deeper into further attributes of the Android OS that complicate the strategy to information acquisition, let’s take a look at the idea of a ROM model that will likely be utilized to an Android gadget. As an summary, a ROM (Learn Solely Reminiscence) program is low-level programming that’s shut to the kernel stage, and the distinctive ROM program is usually known as firmware. If you happen to assume when it comes to a pill in distinction to a cellular phone, the pill may have completely different ROM programming as contrasted to a cellular phone, since {hardware} options between the pill and cellular phone will likely be completely different, even when each {hardware} gadgets are from the identical {hardware} producer. Complicating the necessity for extra specifics within the ROM program, add within the particular necessities of cell service carriers (Verizon, AT&T, and so forth.).

Whereas there are commonalities of buying information from a cellular phone, not all Android gadgets are equal, particularly in gentle that there are fourteen main Android OS releases available on the market (from variations 1.0 to 7.1.1), a number of carriers with model-specific ROMs, and extra numerous customized user-complied editions (buyer ROMs). The ‘buyer compiled editions’ are additionally model-specific ROMs. Generally, the ROM-level updates utilized to every wi-fi gadget will comprise working and system fundamental functions that works for a specific {hardware} gadget, for a given vendor (for instance your Samsung S7 from Verizon), and for a specific implementation.

Despite the fact that there isn’t a ‘silver bullet’ answer to investigating any Android gadget, the forensics investigation of an Android gadget ought to comply with the identical common course of for the gathering of proof, requiring a structured course of and strategy that tackle the investigation, seizure, isolation, acquisition, examination and evaluation, and reporting for any digital proof. When a request to study a tool is acquired, the DFI begins with planning and preparation to embody the requisite methodology of buying gadgets, the mandatory paperwork to assist and doc the chain of custody, the event of a goal assertion for the examination, the detailing of the gadget mannequin (and different particular attributes of the acquired {hardware}), and a listing or description of the knowledge the requestor is searching for to purchase.

Distinctive Challenges of Acquisition

Mobile gadgets, together with cell telephones, tablets, and so forth., face distinctive challenges throughout proof seizure. Since battery life is restricted on cell gadgets and it’s not sometimes really helpful {that a} charger be inserted into a tool, the isolation stage of proof gathering generally is a important state in buying the gadget. Confounding correct acquisition, the mobile information, WiFi connectivity, and Bluetooth connectivity must also be included within the investigator’s focus throughout acquisition. Android has many safety features constructed into the telephone. The lock-screen characteristic might be set as PIN, password, drawing a sample, facial recognition, location recognition, trusted-device recognition, and biometrics comparable to finger prints. An estimated 70% of customers do use some kind of safety safety on their telephone. Critically, there may be accessible software program that the consumer might have downloaded, which may give them the flexibility to wipe the telephone remotely, complicating acquisition.

It’s unlikely through the seizure of the cell gadget that the display screen will likely be unlocked. If the gadget is just not locked, the DFI’s examination will likely be simpler as a result of the DFI can change the settings within the telephone promptly. If entry is allowed to the cellular phone, disable the lock-screen and alter the display screen timeout to its most worth (which might be up to half-hour for some gadgets). Remember the fact that of key significance is to isolate the telephone from any Web connections to stop distant wiping of the gadget. Place the telephone in Airplane mode. Connect an exterior energy provide to the telephone after it has been positioned in a static-free bag designed to block radiofrequency alerts. As soon as safe, you must later give you the chance to allow USB debugging, which is able to enable the Android Debug Bridge (ADB) that may present good information seize. Whereas it could be necessary to study the artifacts of RAM on a cell gadget, that is unlikely to occur.

Buying the Android Data

Copying a hard-drive from a desktop or laptop computer laptop in a forensically-sound method is trivial as in contrast to the info extraction strategies wanted for cell gadget information acquisition. Usually, DFIs have prepared bodily entry to a hard-drive with no boundaries, permitting for a {hardware} copy or software program bit stream picture to be created. Mobile gadgets have their information saved inside the telephone in difficult-to-reach locations. Extraction of information via the USB port generally is a problem, however might be achieved with care and luck on Android gadgets.

After the Android gadget has been seized and is safe, it’s time to study the telephone. There are a number of information acquisition strategies accessible for Android they usually differ drastically. This text introduces and discusses 4 of the first methods to strategy information acquisition. These 5 strategies are famous and summarized beneath:

1. Ship the gadget to the producer: You may ship the gadget to the producer for information extraction, which is able to value additional money and time, however could also be vital when you would not have the actual talent set for a given gadget nor the time to be taught. Specifically, as famous earlier, Android has a plethora of OS variations based mostly on the producer and ROM model, including to the complexity of acquisition. Producer’s usually make this service accessible to authorities businesses and regulation enforcement for many home gadgets, so when you’re an impartial contractor, you will want to test with the producer or acquire assist from the group that you’re working with. Additionally, the producer investigation choice is probably not accessible for a number of worldwide fashions (like the numerous no-name Chinese language telephones that proliferate the market – consider the ‘disposable telephone’).

2. Direct bodily acquisition of the info. One in all guidelines of a DFI investigation is to by no means to alter the info. The bodily acquisition of information from a cellular phone should have in mind the identical strict processes of verifying and documenting that the bodily methodology used is not going to alter any information on the gadget. Additional, as soon as the gadget is related, the operating of hash totals is important. Bodily acquisition permits the DFI to receive a full picture of the gadget utilizing a USB wire and forensic software program (at this level, you ought to be considering of write blocks to stop any altering of the info). Connecting to a cellular phone and grabbing a picture simply is not as clear and clear as pulling information from a tough drive on a desktop laptop. The issue is that relying in your chosen forensic acquisition device, the actual make and mannequin of the telephone, the provider, the Android OS model, the consumer’s settings on the telephone, the basis standing of the gadget, the lock standing, if the PIN code is understood, and if the USB debugging choice is enabled on the gadget, you is probably not in a position to purchase the info from the gadget underneath investigation. Merely put, bodily acquisition results in the realm of ‘simply making an attempt it’ to see what you get and will seem to the court docket (or opposing aspect) as an unstructured method to collect information, which may place the info acquisition in danger.

3. JTAG forensics (a variation of bodily acquisition famous above). As a definition, JTAG (Joint Take a look at Motion Group) forensics is a extra superior method of information acquisition. It’s basically a bodily methodology that includes cabling and connecting to Take a look at Entry Ports (TAPs) on the gadget and utilizing processing directions to invoke a switch of the uncooked information saved in reminiscence. Uncooked information is pulled immediately from the related gadget utilizing a particular JTAG cable. That is thought-about to be low-level information acquisition since there isn’t a conversion or interpretation and is analogous to a bit-copy that’s carried out when buying proof from a desktop or laptop computer laptop onerous drive. JTAG acquisition can typically be carried out for locked, broken and inaccessible (locked) gadgets. Since it’s a low-level copy, if the gadget was encrypted (whether or not by the consumer or by the actual producer, comparable to Samsung and a few Nexus gadgets), the acquired information will nonetheless want to be decrypted. However since Google determined to put off whole-device encryption with the Android OS 5.0 launch, the whole-device encryption limitation is a bit narrowed, until the consumer has decided to encrypt their gadget. After JTAG information is acquired from an Android gadget, the acquired information might be additional inspected and analyzed with instruments comparable to 3zx (hyperlink: http://z3x-team.com/ ) or Belkasoft (hyperlink: https://belkasoft.com/ ). Utilizing JTAG instruments will robotically extract key digital forensic artifacts together with name logs, contacts, location information, shopping historical past and much more.

4. Chip-off acquisition. This acquisition approach requires the removing of reminiscence chips from the gadget. Produces uncooked binary dumps. Once more, that is thought-about a complicated, low-level acquisition and would require de-soldering of reminiscence chips utilizing extremely specialised instruments to take away the chips and different specialised gadgets to learn the chips. Just like the JTAG forensics famous above, the DFI dangers that the chip contents are encrypted. But when the knowledge is just not encrypted, a bit copy might be extracted as a uncooked picture. The DFI will want to deal with block tackle remapping, fragmentation and, if current, encryption. Additionally, a number of Android gadget producers, like Samsung, implement encryption which can’t be bypassed throughout or after chip-off acquisition has been accomplished, even when the right passcode is understood. Due to the entry points with encrypted gadgets, chip off is restricted to unencrypted gadgets.

5. Over-the-air Data Acquisition. We’re every conscious that Google has mastered information assortment. Google is understood for sustaining large quantities from cell telephones, tablets, laptops, computer systems and different gadgets from numerous working system sorts. If the consumer has a Google account, the DFI can entry, obtain, and analyze all data for the given consumer underneath their Google consumer account, with correct permission from Google. This includes downloading data from the consumer’s Google Account. At the moment, there aren’t any full cloud backups accessible to Android customers. Data that may be examined embody Gmail, contact data, Google Drive information (which might be very revealing), synced Chrome tabs, browser bookmarks, passwords, a listing of registered Android gadgets, (the place location historical past for every gadget might be reviewed), and far more.

The 5 strategies famous above is just not a complete listing. An often-repeated observe surfaces about information acquisition – when engaged on a cell gadget, correct and correct documentation is important. Additional, documentation of the processes and procedures used in addition to adhering to the chain of custody processes that you’ve got established will make sure that proof collected will likely be ‘forensically sound.’

Conclusion

As mentioned on this article, cell gadget forensics, and particularly the Android OS, is completely different from the standard digital forensic processes used for laptop computer and desktop computer systems. Whereas the private laptop is well secured, storage might be readily copied, and the gadget might be saved, protected acquisition of cell gadgets and information might be and sometimes is problematic. A structured strategy to buying the cell gadget and a deliberate strategy for information acquisition is important. As famous above, the 5 strategies launched will enable the DFI to acquire entry to the gadget. Nonetheless, there are a number of further strategies not mentioned on this article. Extra analysis and gear use by the DFI will likely be vital.