Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Save more on your purchases! discount-offer-chevron-icon
Savings automatically calculated. No voucher code required.
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Newsletter Hub
Free Learning
Arrow right icon
timer SALE ENDS IN
0 Days
:
00 Hours
:
00 Minutes
:
00 Seconds
Mastering Mobile Forensics
Mastering Mobile Forensics

Mastering Mobile Forensics: Develop the capacity to dig deeper into mobile device data acquisition

eBook
$9.99 $39.99
Paperback
$48.99
Subscription
Free Trial
Renews at $19.99p/m

What do you get with eBook?

Product feature icon Instant access to your Digital eBook purchase
Product feature icon Download this book in EPUB and PDF formats
Product feature icon Access this title in our online reader with advanced features
Product feature icon DRM FREE - Read whenever, wherever and however you want
Modal Close icon
Payment Processing...
tick Completed

Billing Address

Table of content icon View table of contents Preview book icon Preview Book

Mastering Mobile Forensics

Chapter 2. Do It Yourself – Low-Level Techniques

In the continuously evolving environment of the mobile world, digital forensic examiners can neither always nor exclusively rely on commercially available tools. The ability to handle low-level techniques is a must. In this chapter, we will go deep into some commonly used techniques to carve files, manually extract GPS data, and explain how things are at a lower level. This chapter will also cover some techniques for extracting strings from different objects (for example, smartphone images), and will describe the basics of applying reverse engineering on smartphone applications.

We will look at the following topics in this chapter:

  • Getting acquainted with file carving
  • Extracting metadata – GPS analysis
  • String dump and analysis
  • Encryption versus encoding versus hashing
  • Decompiling and disassembling

So let's get started with file carving!

Getting acquainted with file carving

Digital Forensic Research Workshop (DFRWS) defined data carving as the process of extracting a collection of data from a larger dataset. Applied to a digital investigation case, file carving is the process of extracting "data" from unallocated filesystem space using the file type inner structure, and not filesystem structure, which means that the extraction process is principally based on file types' headers and trailers.

Basically, all data gathered from a smartphone is always in the form of a file. In the digital world, each file is a block of stored binary digits, and each file type is defined depending on how these digits are stored—the use of extensions in file names is meant to easily and precisely determine the file's generic type. This is not a reliable approach since eyes, and even computers, can be fooled just by renaming the files. This leads us to a more advanced approach based on an analysis of the inner file...

Extracting metadata – GPS analysis

What is metadata? Well, this is quite an embarrassing question! In an ambiguous way, metadata is data that describes data or information about information. In general, metadata is extra hidden information generated and embedded automatically in a digital file. The definition of metadata differs depending on the context in which it's used and the community that refers to it. It can be considered as machine-understandable information, or can be referred to as records that describe digital records. In fact, metadata can be subdivided into three important types: descriptive (including elements like author, title, abstract, and keywords), structural (describing how an object is constituted, and how elements are arranged), and administrative (including elements like date and time of creation, data type, and other technical details).

For example, camera settings (like camera marker, camera model, exposure time, ISO speed, focal length, shutter speed...

String dump and analysis

Most digital investigations rely on textual evidence. This is obviously due to the fact that most stored digital data is linguistic, for example, logged conversation. A lot of important text-based evidence can be gathered while dumping strings from images (smartphone memory dumps); this can include e-mails, instant messaging, address books, browsing history, and more. Most of the currently available digital forensic tools rely on match and indexing algorithms to search for textual evidence at the physical level, so they search every byte to locate specific text strings.

Finding accurate hits is a critical need in every digital forensic case. In contrast to searching individual key terms or single words, things are much more complicated when an investigator wants to perform an advanced search such as for credit card numbers or phone number. Even if most digital forensic tools offer the capability to use regular expression for searching, the main difficulty resides...

Encryption versus encoding versus hashing

Encryption, encoding, and hashing are quite confusing notions. Without digging very deep into the mathematical dimension, we will see the difference between all of these notions, keeping in mind that all of them transform data from one given format to another. The most important aspect to note is that the encryption and encoding functions are reversible but hashing is not.

Encryption

Encryption is a method or a set of methods for scrambling data. The process of encrypting aims to transform plaintext information by means of a given algorithm, referred to as cipher, to produce obscure/scrambled data, referred to as ciphertext. The process of encryption requires the use of a key to both encrypt plaintext and to decrypt ciphertext. The main differences between encryption and hashing are the fact that in contrast to hashing algorithms, encryption algorithms do not produce fixed length outputs, and encrypted data can be reversed back into the original format...

Decompiling and disassembling

Decompiling and disassembling are both kinds of a reverse engineering process that do the opposite of what a compiler and an assembler do.

A decompiler translates a compiled binary's low-level code designed to be computer readable into human-readable high-level code. The accuracy of decompilers depends on many factors like the amount of metadata present in the code being decompiled and the complexity of the code (not in terms of algorithms, but in terms of sophistication of the high-level code used). The bytecode format used by Java Virtual Machine (JVM) and the intermediate language used by .NET framework Common Language Runtime (CLR) include, in most cases, a very extensive amount of information and high level features. This makes the process of creating a high-level code from a compiled input quite feasible, and in most cases, very reliable. Most of the decompilation processes pass through seven steps before producing a readable high level code: loading...

Getting acquainted with file carving


Digital Forensic Research Workshop (DFRWS) defined data carving as the process of extracting a collection of data from a larger dataset. Applied to a digital investigation case, file carving is the process of extracting "data" from unallocated filesystem space using the file type inner structure, and not filesystem structure, which means that the extraction process is principally based on file types' headers and trailers.

Basically, all data gathered from a smartphone is always in the form of a file. In the digital world, each file is a block of stored binary digits, and each file type is defined depending on how these digits are stored—the use of extensions in file names is meant to easily and precisely determine the file's generic type. This is not a reliable approach since eyes, and even computers, can be fooled just by renaming the files. This leads us to a more advanced approach based on an analysis of the inner file structure in order to determine...

Left arrow icon Right arrow icon

Key benefits

  • *A mastering guide to help you overcome the roadblocks you face when dealing with mobile forensics
  • *Excel at the art of extracting data, recovering deleted data, bypassing screen locks, and much more
  • *Get best practices to how to collect and analyze mobile device data and accurately document your investigations

Description

Mobile forensics presents a real challenge to the forensic community due to the fast and unstoppable changes in technology. This book aims to provide the forensic community an in-depth insight into mobile forensic techniques when it comes to deal with recent smartphones operating systems Starting with a brief overview of forensic strategies and investigation procedures, you will understand the concepts of file carving, GPS analysis, and string analyzing. You will also see the difference between encryption, encoding, and hashing methods and get to grips with the fundamentals of reverse code engineering. Next, the book will walk you through the iOS, Android and Windows Phone architectures and filesystem, followed by showing you various forensic approaches and data gathering techniques. You will also explore advanced forensic techniques and find out how to deal with third-applications using case studies. The book will help you master data acquisition on Windows Phone 8. By the end of this book, you will be acquainted with best practices and the different models used in mobile forensics.

Who is this book for?

The book is for mobile forensics professionals who have experience in handling forensic tools and methods. This book is designed for skilled digital forensic examiners, mobile forensic investigators, and law enforcement officers.

What you will learn

  • *Understand the mobile forensics process model and get guidelines on mobile device forensics
  • *Acquire in-depth knowledge about smartphone acquisition and acquisition methods
  • *Gain a solid understanding of the architecture of operating systems, file formats, and mobile phone internal memory
  • *Explore the topics of of mobile security, data leak, and evidence recovery
  • *Dive into advanced topics such as GPS analysis, file carving, encryption, encoding, unpacking, and decompiling mobile application processes

Product Details

Country selected
Publication date, Length, Edition, Language, ISBN-13
Publication date : May 30, 2016
Length: 318 pages
Edition : 1st
Language : English
ISBN-13 : 9781785281068
Category :
Concepts :

What do you get with eBook?

Product feature icon Instant access to your Digital eBook purchase
Product feature icon Download this book in EPUB and PDF formats
Product feature icon Access this title in our online reader with advanced features
Product feature icon DRM FREE - Read whenever, wherever and however you want
Modal Close icon
Payment Processing...
tick Completed

Billing Address

Product Details

Publication date : May 30, 2016
Length: 318 pages
Edition : 1st
Language : English
ISBN-13 : 9781785281068
Category :
Concepts :

Packt Subscriptions

See our plans and pricing
Modal Close icon
$19.99 billed monthly
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Simple pricing, no contract
$199.99 billed annually
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Choose a DRM-free eBook or Video every month to keep
Feature tick icon PLUS own as many other DRM-free eBooks or Videos as you like for just $5 each
Feature tick icon Exclusive print discounts
$279.99 billed in 18 months
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Choose a DRM-free eBook or Video every month to keep
Feature tick icon PLUS own as many other DRM-free eBooks or Videos as you like for just $5 each
Feature tick icon Exclusive print discounts

Frequently bought together


Stars icon
Total $ 164.97
Practical Mobile Forensics
$60.99
Mastering Mobile Forensics
$48.99
Practical Digital Forensics
$54.99
Total $ 164.97 Stars icon

Table of Contents

8 Chapters
1. Mobile Forensics and the Investigation Process Model Chevron down icon Chevron up icon
2. Do It Yourself – Low-Level Techniques Chevron down icon Chevron up icon
3. iDevices from a Forensic Point of View Chevron down icon Chevron up icon
4. Android Forensics Chevron down icon Chevron up icon
5. Windows Phone 8 Forensics Chevron down icon Chevron up icon
6. Mobile Forensics – Best Practices Chevron down icon Chevron up icon
A. Preparing a Mobile Forensic Workstation Chevron down icon Chevron up icon
Index Chevron down icon Chevron up icon
Get free access to Packt library with over 7500+ books and video courses for 7 days!
Start Free Trial

FAQs

How do I buy and download an eBook? Chevron down icon Chevron up icon

Where there is an eBook version of a title available, you can buy it from the book details for that title. Add either the standalone eBook or the eBook and print book bundle to your shopping cart. Your eBook will show in your cart as a product on its own. After completing checkout and payment in the normal way, you will receive your receipt on the screen containing a link to a personalised PDF download file. This link will remain active for 30 days. You can download backup copies of the file by logging in to your account at any time.

If you already have Adobe reader installed, then clicking on the link will download and open the PDF file directly. If you don't, then save the PDF file on your machine and download the Reader to view it.

Please Note: Packt eBooks are non-returnable and non-refundable.

Packt eBook and Licensing When you buy an eBook from Packt Publishing, completing your purchase means you accept the terms of our licence agreement. Please read the full text of the agreement. In it we have tried to balance the need for the ebook to be usable for you the reader with our needs to protect the rights of us as Publishers and of our authors. In summary, the agreement says:

  • You may make copies of your eBook for your own use onto any machine
  • You may not pass copies of the eBook on to anyone else
How can I make a purchase on your website? Chevron down icon Chevron up icon

If you want to purchase a video course, eBook or Bundle (Print+eBook) please follow below steps:

  1. Register on our website using your email address and the password.
  2. Search for the title by name or ISBN using the search option.
  3. Select the title you want to purchase.
  4. Choose the format you wish to purchase the title in; if you order the Print Book, you get a free eBook copy of the same title. 
  5. Proceed with the checkout process (payment to be made using Credit Card, Debit Cart, or PayPal)
Where can I access support around an eBook? Chevron down icon Chevron up icon
  • If you experience a problem with using or installing Adobe Reader, the contact Adobe directly.
  • To view the errata for the book, see www.packtpub.com/support and view the pages for the title you have.
  • To view your account details or to download a new copy of the book go to www.packtpub.com/account
  • To contact us directly if a problem is not resolved, use www.packtpub.com/contact-us
What eBook formats do Packt support? Chevron down icon Chevron up icon

Our eBooks are currently available in a variety of formats such as PDF and ePubs. In the future, this may well change with trends and development in technology, but please note that our PDFs are not Adobe eBook Reader format, which has greater restrictions on security.

You will need to use Adobe Reader v9 or later in order to read Packt's PDF eBooks.

What are the benefits of eBooks? Chevron down icon Chevron up icon
  • You can get the information you need immediately
  • You can easily take them with you on a laptop
  • You can download them an unlimited number of times
  • You can print them out
  • They are copy-paste enabled
  • They are searchable
  • There is no password protection
  • They are lower price than print
  • They save resources and space
What is an eBook? Chevron down icon Chevron up icon

Packt eBooks are a complete electronic version of the print edition, available in PDF and ePub formats. Every piece of content down to the page numbering is the same. Because we save the costs of printing and shipping the book to you, we are able to offer eBooks at a lower cost than print editions.

When you have purchased an eBook, simply login to your account and click on the link in Your Download Area. We recommend you saving the file to your hard drive before opening it.

For optimal viewing of our eBooks, we recommend you download and install the free Adobe Reader version 9.

Modal Close icon
Modal Close icon