Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Save more on your purchases! discount-offer-chevron-icon
Savings automatically calculated. No voucher code required.
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Newsletter Hub
Free Learning
Arrow right icon
timer SALE ENDS IN
0 Days
:
00 Hours
:
00 Minutes
:
00 Seconds
Mastering Mobile Forensics
Mastering Mobile Forensics

Mastering Mobile Forensics: Develop the capacity to dig deeper into mobile device data acquisition

eBook
$9.99 $39.99
Paperback
$48.99
Subscription
Free Trial
Renews at $19.99p/m

What do you get with Print?

Product feature icon Instant access to your digital copy whilst your Print order is Shipped
Product feature icon Paperback book shipped to your preferred address
Product feature icon Redeem a companion digital copy on all Print orders
Product feature icon Access this title in our online reader with advanced features
Product feature icon DRM FREE - Read whenever, wherever and however you want
Modal Close icon
Payment Processing...
tick Completed

Shipping Address

Billing Address

Shipping Methods
Table of content icon View table of contents Preview book icon Preview Book

Mastering Mobile Forensics

Chapter 2. Do It Yourself – Low-Level Techniques

In the continuously evolving environment of the mobile world, digital forensic examiners can neither always nor exclusively rely on commercially available tools. The ability to handle low-level techniques is a must. In this chapter, we will go deep into some commonly used techniques to carve files, manually extract GPS data, and explain how things are at a lower level. This chapter will also cover some techniques for extracting strings from different objects (for example, smartphone images), and will describe the basics of applying reverse engineering on smartphone applications.

We will look at the following topics in this chapter:

  • Getting acquainted with file carving
  • Extracting metadata – GPS analysis
  • String dump and analysis
  • Encryption versus encoding versus hashing
  • Decompiling and disassembling

So let's get started with file carving!

Getting acquainted with file carving

Digital Forensic Research Workshop (DFRWS) defined data carving as the process of extracting a collection of data from a larger dataset. Applied to a digital investigation case, file carving is the process of extracting "data" from unallocated filesystem space using the file type inner structure, and not filesystem structure, which means that the extraction process is principally based on file types' headers and trailers.

Basically, all data gathered from a smartphone is always in the form of a file. In the digital world, each file is a block of stored binary digits, and each file type is defined depending on how these digits are stored—the use of extensions in file names is meant to easily and precisely determine the file's generic type. This is not a reliable approach since eyes, and even computers, can be fooled just by renaming the files. This leads us to a more advanced approach based on an analysis of the inner file...

Extracting metadata – GPS analysis

What is metadata? Well, this is quite an embarrassing question! In an ambiguous way, metadata is data that describes data or information about information. In general, metadata is extra hidden information generated and embedded automatically in a digital file. The definition of metadata differs depending on the context in which it's used and the community that refers to it. It can be considered as machine-understandable information, or can be referred to as records that describe digital records. In fact, metadata can be subdivided into three important types: descriptive (including elements like author, title, abstract, and keywords), structural (describing how an object is constituted, and how elements are arranged), and administrative (including elements like date and time of creation, data type, and other technical details).

For example, camera settings (like camera marker, camera model, exposure time, ISO speed, focal length, shutter speed...

String dump and analysis

Most digital investigations rely on textual evidence. This is obviously due to the fact that most stored digital data is linguistic, for example, logged conversation. A lot of important text-based evidence can be gathered while dumping strings from images (smartphone memory dumps); this can include e-mails, instant messaging, address books, browsing history, and more. Most of the currently available digital forensic tools rely on match and indexing algorithms to search for textual evidence at the physical level, so they search every byte to locate specific text strings.

Finding accurate hits is a critical need in every digital forensic case. In contrast to searching individual key terms or single words, things are much more complicated when an investigator wants to perform an advanced search such as for credit card numbers or phone number. Even if most digital forensic tools offer the capability to use regular expression for searching, the main difficulty resides...

Encryption versus encoding versus hashing

Encryption, encoding, and hashing are quite confusing notions. Without digging very deep into the mathematical dimension, we will see the difference between all of these notions, keeping in mind that all of them transform data from one given format to another. The most important aspect to note is that the encryption and encoding functions are reversible but hashing is not.

Encryption

Encryption is a method or a set of methods for scrambling data. The process of encrypting aims to transform plaintext information by means of a given algorithm, referred to as cipher, to produce obscure/scrambled data, referred to as ciphertext. The process of encryption requires the use of a key to both encrypt plaintext and to decrypt ciphertext. The main differences between encryption and hashing are the fact that in contrast to hashing algorithms, encryption algorithms do not produce fixed length outputs, and encrypted data can be reversed back into the original format...

Decompiling and disassembling

Decompiling and disassembling are both kinds of a reverse engineering process that do the opposite of what a compiler and an assembler do.

A decompiler translates a compiled binary's low-level code designed to be computer readable into human-readable high-level code. The accuracy of decompilers depends on many factors like the amount of metadata present in the code being decompiled and the complexity of the code (not in terms of algorithms, but in terms of sophistication of the high-level code used). The bytecode format used by Java Virtual Machine (JVM) and the intermediate language used by .NET framework Common Language Runtime (CLR) include, in most cases, a very extensive amount of information and high level features. This makes the process of creating a high-level code from a compiled input quite feasible, and in most cases, very reliable. Most of the decompilation processes pass through seven steps before producing a readable high level code: loading...

Getting acquainted with file carving


Digital Forensic Research Workshop (DFRWS) defined data carving as the process of extracting a collection of data from a larger dataset. Applied to a digital investigation case, file carving is the process of extracting "data" from unallocated filesystem space using the file type inner structure, and not filesystem structure, which means that the extraction process is principally based on file types' headers and trailers.

Basically, all data gathered from a smartphone is always in the form of a file. In the digital world, each file is a block of stored binary digits, and each file type is defined depending on how these digits are stored—the use of extensions in file names is meant to easily and precisely determine the file's generic type. This is not a reliable approach since eyes, and even computers, can be fooled just by renaming the files. This leads us to a more advanced approach based on an analysis of the inner file structure in order to determine...

Left arrow icon Right arrow icon

Key benefits

  • *A mastering guide to help you overcome the roadblocks you face when dealing with mobile forensics
  • *Excel at the art of extracting data, recovering deleted data, bypassing screen locks, and much more
  • *Get best practices to how to collect and analyze mobile device data and accurately document your investigations

Description

Mobile forensics presents a real challenge to the forensic community due to the fast and unstoppable changes in technology. This book aims to provide the forensic community an in-depth insight into mobile forensic techniques when it comes to deal with recent smartphones operating systems Starting with a brief overview of forensic strategies and investigation procedures, you will understand the concepts of file carving, GPS analysis, and string analyzing. You will also see the difference between encryption, encoding, and hashing methods and get to grips with the fundamentals of reverse code engineering. Next, the book will walk you through the iOS, Android and Windows Phone architectures and filesystem, followed by showing you various forensic approaches and data gathering techniques. You will also explore advanced forensic techniques and find out how to deal with third-applications using case studies. The book will help you master data acquisition on Windows Phone 8. By the end of this book, you will be acquainted with best practices and the different models used in mobile forensics.

Who is this book for?

The book is for mobile forensics professionals who have experience in handling forensic tools and methods. This book is designed for skilled digital forensic examiners, mobile forensic investigators, and law enforcement officers.

What you will learn

  • *Understand the mobile forensics process model and get guidelines on mobile device forensics
  • *Acquire in-depth knowledge about smartphone acquisition and acquisition methods
  • *Gain a solid understanding of the architecture of operating systems, file formats, and mobile phone internal memory
  • *Explore the topics of of mobile security, data leak, and evidence recovery
  • *Dive into advanced topics such as GPS analysis, file carving, encryption, encoding, unpacking, and decompiling mobile application processes
Estimated delivery fee Deliver to United States

Economy delivery 10 - 13 business days

Free $6.95

Premium delivery 6 - 9 business days

$21.95
(Includes tracking information)

Product Details

Country selected
Publication date, Length, Edition, Language, ISBN-13
Publication date : May 30, 2016
Length: 318 pages
Edition : 1st
Language : English
ISBN-13 : 9781785287817
Category :
Concepts :

What do you get with Print?

Product feature icon Instant access to your digital copy whilst your Print order is Shipped
Product feature icon Paperback book shipped to your preferred address
Product feature icon Redeem a companion digital copy on all Print orders
Product feature icon Access this title in our online reader with advanced features
Product feature icon DRM FREE - Read whenever, wherever and however you want
Modal Close icon
Payment Processing...
tick Completed

Shipping Address

Billing Address

Shipping Methods
Estimated delivery fee Deliver to United States

Economy delivery 10 - 13 business days

Free $6.95

Premium delivery 6 - 9 business days

$21.95
(Includes tracking information)

Product Details

Publication date : May 30, 2016
Length: 318 pages
Edition : 1st
Language : English
ISBN-13 : 9781785287817
Category :
Concepts :

Packt Subscriptions

See our plans and pricing
Modal Close icon
$19.99 billed monthly
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Simple pricing, no contract
$199.99 billed annually
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Choose a DRM-free eBook or Video every month to keep
Feature tick icon PLUS own as many other DRM-free eBooks or Videos as you like for just $5 each
Feature tick icon Exclusive print discounts
$279.99 billed in 18 months
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Choose a DRM-free eBook or Video every month to keep
Feature tick icon PLUS own as many other DRM-free eBooks or Videos as you like for just $5 each
Feature tick icon Exclusive print discounts

Frequently bought together


Stars icon
Total $ 164.97
Practical Mobile Forensics
$60.99
Mastering Mobile Forensics
$48.99
Practical Digital Forensics
$54.99
Total $ 164.97 Stars icon

Table of Contents

8 Chapters
1. Mobile Forensics and the Investigation Process Model Chevron down icon Chevron up icon
2. Do It Yourself – Low-Level Techniques Chevron down icon Chevron up icon
3. iDevices from a Forensic Point of View Chevron down icon Chevron up icon
4. Android Forensics Chevron down icon Chevron up icon
5. Windows Phone 8 Forensics Chevron down icon Chevron up icon
6. Mobile Forensics – Best Practices Chevron down icon Chevron up icon
A. Preparing a Mobile Forensic Workstation Chevron down icon Chevron up icon
Index Chevron down icon Chevron up icon
Get free access to Packt library with over 7500+ books and video courses for 7 days!
Start Free Trial

FAQs

What is the digital copy I get with my Print order? Chevron down icon Chevron up icon

When you buy any Print edition of our Books, you can redeem (for free) the eBook edition of the Print Book you’ve purchased. This gives you instant access to your book when you make an order via PDF, EPUB or our online Reader experience.

What is the delivery time and cost of print book? Chevron down icon Chevron up icon

Shipping Details

USA:

'

Economy: Delivery to most addresses in the US within 10-15 business days

Premium: Trackable Delivery to most addresses in the US within 3-8 business days

UK:

Economy: Delivery to most addresses in the U.K. within 7-9 business days.
Shipments are not trackable

Premium: Trackable delivery to most addresses in the U.K. within 3-4 business days!
Add one extra business day for deliveries to Northern Ireland and Scottish Highlands and islands

EU:

Premium: Trackable delivery to most EU destinations within 4-9 business days.

Australia:

Economy: Can deliver to P. O. Boxes and private residences.
Trackable service with delivery to addresses in Australia only.
Delivery time ranges from 7-9 business days for VIC and 8-10 business days for Interstate metro
Delivery time is up to 15 business days for remote areas of WA, NT & QLD.

Premium: Delivery to addresses in Australia only
Trackable delivery to most P. O. Boxes and private residences in Australia within 4-5 days based on the distance to a destination following dispatch.

India:

Premium: Delivery to most Indian addresses within 5-6 business days

Rest of the World:

Premium: Countries in the American continent: Trackable delivery to most countries within 4-7 business days

Asia:

Premium: Delivery to most Asian addresses within 5-9 business days

Disclaimer:
All orders received before 5 PM U.K time would start printing from the next business day. So the estimated delivery times start from the next day as well. Orders received after 5 PM U.K time (in our internal systems) on a business day or anytime on the weekend will begin printing the second to next business day. For example, an order placed at 11 AM today will begin printing tomorrow, whereas an order placed at 9 PM tonight will begin printing the day after tomorrow.


Unfortunately, due to several restrictions, we are unable to ship to the following countries:

  1. Afghanistan
  2. American Samoa
  3. Belarus
  4. Brunei Darussalam
  5. Central African Republic
  6. The Democratic Republic of Congo
  7. Eritrea
  8. Guinea-bissau
  9. Iran
  10. Lebanon
  11. Libiya Arab Jamahriya
  12. Somalia
  13. Sudan
  14. Russian Federation
  15. Syrian Arab Republic
  16. Ukraine
  17. Venezuela
What is custom duty/charge? Chevron down icon Chevron up icon

Customs duty are charges levied on goods when they cross international borders. It is a tax that is imposed on imported goods. These duties are charged by special authorities and bodies created by local governments and are meant to protect local industries, economies, and businesses.

Do I have to pay customs charges for the print book order? Chevron down icon Chevron up icon

The orders shipped to the countries that are listed under EU27 will not bear custom charges. They are paid by Packt as part of the order.

List of EU27 countries: www.gov.uk/eu-eea:

A custom duty or localized taxes may be applicable on the shipment and would be charged by the recipient country outside of the EU27 which should be paid by the customer and these duties are not included in the shipping charges been charged on the order.

How do I know my custom duty charges? Chevron down icon Chevron up icon

The amount of duty payable varies greatly depending on the imported goods, the country of origin and several other factors like the total invoice amount or dimensions like weight, and other such criteria applicable in your country.

For example:

  • If you live in Mexico, and the declared value of your ordered items is over $ 50, for you to receive a package, you will have to pay additional import tax of 19% which will be $ 9.50 to the courier service.
  • Whereas if you live in Turkey, and the declared value of your ordered items is over € 22, for you to receive a package, you will have to pay additional import tax of 18% which will be € 3.96 to the courier service.
How can I cancel my order? Chevron down icon Chevron up icon

Cancellation Policy for Published Printed Books:

You can cancel any order within 1 hour of placing the order. Simply contact [email protected] with your order details or payment transaction id. If your order has already started the shipment process, we will do our best to stop it. However, if it is already on the way to you then when you receive it, you can contact us at [email protected] using the returns and refund process.

Please understand that Packt Publishing cannot provide refunds or cancel any order except for the cases described in our Return Policy (i.e. Packt Publishing agrees to replace your printed book because it arrives damaged or material defect in book), Packt Publishing will not accept returns.

What is your returns and refunds policy? Chevron down icon Chevron up icon

Return Policy:

We want you to be happy with your purchase from Packtpub.com. We will not hassle you with returning print books to us. If the print book you receive from us is incorrect, damaged, doesn't work or is unacceptably late, please contact Customer Relations Team on [email protected] with the order number and issue details as explained below:

  1. If you ordered (eBook, Video or Print Book) incorrectly or accidentally, please contact Customer Relations Team on [email protected] within one hour of placing the order and we will replace/refund you the item cost.
  2. Sadly, if your eBook or Video file is faulty or a fault occurs during the eBook or Video being made available to you, i.e. during download then you should contact Customer Relations Team within 14 days of purchase on [email protected] who will be able to resolve this issue for you.
  3. You will have a choice of replacement or refund of the problem items.(damaged, defective or incorrect)
  4. Once Customer Care Team confirms that you will be refunded, you should receive the refund within 10 to 12 working days.
  5. If you are only requesting a refund of one book from a multiple order, then we will refund you the appropriate single item.
  6. Where the items were shipped under a free shipping offer, there will be no shipping costs to refund.

On the off chance your printed book arrives damaged, with book material defect, contact our Customer Relation Team on [email protected] within 14 days of receipt of the book with appropriate evidence of damage and we will work with you to secure a replacement copy, if necessary. Please note that each printed book you order from us is individually made by Packt's professional book-printing partner which is on a print-on-demand basis.

What tax is charged? Chevron down icon Chevron up icon

Currently, no tax is charged on the purchase of any print book (subject to change based on the laws and regulations). A localized VAT fee is charged only to our European and UK customers on eBooks, Video and subscriptions that they buy. GST is charged to Indian customers for eBooks and video purchases.

What payment methods can I use? Chevron down icon Chevron up icon

You can pay with the following card types:

  1. Visa Debit
  2. Visa Credit
  3. MasterCard
  4. PayPal
What is the delivery time and cost of print books? Chevron down icon Chevron up icon

Shipping Details

USA:

'

Economy: Delivery to most addresses in the US within 10-15 business days

Premium: Trackable Delivery to most addresses in the US within 3-8 business days

UK:

Economy: Delivery to most addresses in the U.K. within 7-9 business days.
Shipments are not trackable

Premium: Trackable delivery to most addresses in the U.K. within 3-4 business days!
Add one extra business day for deliveries to Northern Ireland and Scottish Highlands and islands

EU:

Premium: Trackable delivery to most EU destinations within 4-9 business days.

Australia:

Economy: Can deliver to P. O. Boxes and private residences.
Trackable service with delivery to addresses in Australia only.
Delivery time ranges from 7-9 business days for VIC and 8-10 business days for Interstate metro
Delivery time is up to 15 business days for remote areas of WA, NT & QLD.

Premium: Delivery to addresses in Australia only
Trackable delivery to most P. O. Boxes and private residences in Australia within 4-5 days based on the distance to a destination following dispatch.

India:

Premium: Delivery to most Indian addresses within 5-6 business days

Rest of the World:

Premium: Countries in the American continent: Trackable delivery to most countries within 4-7 business days

Asia:

Premium: Delivery to most Asian addresses within 5-9 business days

Disclaimer:
All orders received before 5 PM U.K time would start printing from the next business day. So the estimated delivery times start from the next day as well. Orders received after 5 PM U.K time (in our internal systems) on a business day or anytime on the weekend will begin printing the second to next business day. For example, an order placed at 11 AM today will begin printing tomorrow, whereas an order placed at 9 PM tonight will begin printing the day after tomorrow.


Unfortunately, due to several restrictions, we are unable to ship to the following countries:

  1. Afghanistan
  2. American Samoa
  3. Belarus
  4. Brunei Darussalam
  5. Central African Republic
  6. The Democratic Republic of Congo
  7. Eritrea
  8. Guinea-bissau
  9. Iran
  10. Lebanon
  11. Libiya Arab Jamahriya
  12. Somalia
  13. Sudan
  14. Russian Federation
  15. Syrian Arab Republic
  16. Ukraine
  17. Venezuela
Modal Close icon
Modal Close icon