Downloaded 324 times
Uploaded byClubHack
Android forensics (Manish Chasta)
This document provides an overview of Android forensics. It discusses rooting Android devices to gain access for forensic imaging. The forensic process involves seizing the device and accessories, creating a bit-by-bit image of the memory card and device to preserve all data, recovering useful data from the image, analyzing the image by examining key locations like the SQLite database and searching for evidence, and maintaining a proper chain of custody. Indian laws like the IT Act 2000 cover digital crimes using computers as targets or weapons.
In this document
Powered by AI
Presented by Manish Chasta, the agenda covers Android basics, rooting, seizing devices, forensic steps, chain of custody, and cyber laws.
Android is the most used mobile OS, developed by Google. It had a 36% market share in Q1 of 2011.
Explains Android architecture including Linux kernel and SQLite Database used for applications.
Explores how Android can be involved in cyber crimes such as software theft, terrorism, financial crimes, etc.
Outlines the forensic steps: seizing devices, creating images, and analyzing data while maintaining the chain of custody.Steps for creating a 1:1 image of memory cards and devices, highlighting importance of data preservation.
Stepwise guide to rooting Android devices, detailing software needed and setup procedures.
Explains how to create a low-level image of an Android device using the 'dd' command and viaExtract tool.
Describes methods for recovering and analyzing data from Android images using tools like WinHex.
Focus on analyzing SQLite databases which store critical data, with tools for examination.
Defines chain of custody in forensic investigations, highlighting the need for meticulous evidence handling.
Discusses Indian cyber laws related to digital crimes, including the IT Act and its amendments.
Manish Chasta's contact details for further inquiries regarding the presentation.
More Related Content
Similar to Android forensics (Manish Chasta)
![UiPath Automation Suite Installation (Hands-On) [2/3]](https://cdn.slidesharecdn.com/ss_thumbnails/automationsuitecommunitysession2-251015095633-a6d862f1-thumbnail.jpg?width=600ounds&width=560&fit=bounds)
Android forensics (Manish Chasta)
- 1. PRESENTED BY Manish Chasta, Principal Consultant, Indusface Android Forensics Manish Chasta, CISSP | CHFI
- 2. Agenda Introduction to Android Rooting Android Seizing Android Device Forensic Steps Chain of Custody Indian Cyber Laws
- 3. Introduction to Android • Most widely used mobile OS • Developed by Google • OS + Middleware + Applications • Android Open Source Project (AOSP) is responsible for maintenance and further development
- 4. Presence in theMarket • According to Gartner report, Android captured 36% market share in Q1 of 2011. • Listed as the best selling Smartphone worldwide by Canalys. 4
- 5.
- 6. Android Architecture: LinuxKernel • Linux kernel with system services: – Security – Memory and process management – Network stack • Provide driver to access hardware: – Camera – Display and audio – Wifi – … 6
- 7. Android Architecture: AndroidRunTime • Core Libraries: – Written in Java – Provides the functionality of Java programming language – Interpreted by Dalvik VM • Dalvik VM: – Java based VM, a lightweight substitute to JVM – Unlike JVM, DVM is a register based Virtual Machine – DVM is optimized to run on limited main memory and less CPU usage – Java code (.class files) converted into .dex format to be able to run on Android platform 7
- 8. SQLite Database • SQLiteDatabase: – SQLite is a widely used, lightweight database – Used by most mobile OS i.e. iPhone, Android, Symbian, webOS – SQLite is a free to use and open source database – Zero-configuration - no setup or administration needed. – A complete database is stored in a single cross- platform disk file. 8
- 9. How Android canbe used in Cyber Crime? • Software Theft • Terrorism Activity • Pornography / Child Pornography • Financial Crime • Sexual harassment Cases • Murder or other Criminal activities 9
- 10. Forensic Process: AnOpen Source Approach • Seizing the device • Creating 1:1 image • Recovering the useful data • Analyzing the image to discover evidences • Maintain Chain of Custody 10
- 11. Seizing Android Device •If device is Off – Do not turn ‘ON’ • If device is On – Let it ON and keep device charging • Take photos and display of the device • Seize all other accessories available i.e. Memory card, cables etc. • Label all evidences and document everything 11
- 12. Creating 1:1 Image •Creating Image of Memory Card • Creating Image of Device 12
- 13. Creating Image ofMemory Card • Fat 32 file system • Easy to create image • In most cases, applications wont store any sensitive data in memory card • Number of commercials and open source tools are available 13
- 14. Creating Image ofMemory Card • Using Winhex 14
- 15. Creating Image ofthe Device • Android’s file systems • Importance of rooting • Rooting Samsung Galaxy device 15
- 16. Rooting Android Device Step1: Download CF Rooted Karnal files and Odin3 Software 16
- 17. Rooting Android Device •Step 2: Keep handset on debugging mode 17
- 18. Rooting Android Device •Step 3: Run Odin3 18
- 19. Rooting Android Device •Step 4: Reboot the phone in download mode • Step 5: Connect to the PC 19
- 20. Rooting Android Device •Step 6: Select required file i.e: PDA, Phone, CSC files • Step 7: Click on Auto Reboot and F. Reset Time and hit Start button 20
- 21. Rooting Android Device •If your phone is Rooted... You will see PASS!! In Odin3 21
- 22. Creating Image ofthe Device • Taking backup with DD – low-level copying and conversion of raw data – Create bit by bit image of disk – Output Can be readable by any forensic tool – Typical Syntax : dd if=/dev/SDA of=/sdcard/SDA.dd – Interesting Locations • datadata • datasystem 22
- 23. Creating Image ofthe Device 23
- 24. Creating Image ofthe Device • Taking image with viaExtract tool 24
- 25. Recovering Data • UsingWinHex 25
- 26. Analysing Image • Readingthe Image • Looking for KEY data • Searching techniques (DT Search) 26
- 27. Analysing Image • Winhex •Manual Intelligence • viaExtract 27
- 28. Analyzing SQLite • SQLitestores most critical information • Interesting place for Investigators • Tools – Epilog – sqlite database browser – sqlite_analyzer 28
- 29.
- 30. Maintaining ‘Chain ofCustody’ • What is Chain of Custody? • CoC can have following information: What is the evidence? How did you get it? When was it collected? Who has handled it? Why did that person handle it? Where has it travelled, and where was it ultimately stored? 30
- 31. Indian Laws coveringDigital Crimes • We can categorize Cyber crimes in two ways: – The Computer as a Target – The computer as a weapon • Indian Laws: – IT Act 2000 – IT(Amendment) Act, 2008 – Rules under section 6A, 43A and 79 • MIT site: http://mit.gov.in/content/cyber-laws 31
- 32. Manish Chasta manish.chasta@owasp.org chasta.manish@gmail.com