Speaker 1: Welcome to our deep dive into mobile forensics. You've given
Speaker 1: me a stack material on iOS and Android file systems,
Speaker 1: security features, and even how to break into them, all legally.
Speaker 2: Of course, right, you want to get a grip on
Speaker 2: how mobile forensics works, what data we can actually get back,
Speaker 2: the tools and techniques involved, from.
Speaker 1: The basics to some seriously advanced stuff. You've even got
Speaker 1: reverse engineering apps and malware in here.
Speaker 2: Should be a fun ride.
Speaker 1: So we've all seen those TV shows where they pulled
Speaker 1: data off phones like magic, But real life mobile forensics
Speaker 1: that's way more complex.
Speaker 2: Right, Oh? Absolutely For starters, think about the sheer volume
Speaker 2: of devices out there, each one with its own hardware
Speaker 2: and software, its own security quirks. Then there's the fact
Speaker 2: that technology is constantly.
Speaker 1: Evolving, so investigators are always playing catchup always, And.
Speaker 2: Then you have the legal side of things, the constant
Speaker 2: back and forth between law enforcement and individual privacy rights.
Speaker 2: Remember that whole FBI versus Apple encryption battle.
Speaker 1: Oh yeah, Apple refused to unlock that terrorist's iPhone landmark case.
Speaker 1: So how do investigators even approach a device knowing it
Speaker 1: could be totally locked down?
Speaker 2: Well, the first step is always to figure out what
Speaker 2: specific device model you're dealing with. Sounds obvious, but that
Speaker 2: dictates what tools and techniques will actually work. iPhones, iPads,
Speaker 2: different Android models from every manufacturer, imaginable, It's a lot.
Speaker 1: Yeah, You've got a whole section in here on iOS.
Speaker 1: What makes iPhones so tricky for forensics?
Speaker 2: Well, for one, the file systems. Older iPhones used HFS plus,
Speaker 2: which is complex on its own, but newer ones switched
Speaker 2: to APFS that throws in some curveballs. Like what sparse files?
Speaker 2: A file can exist but not take up actual storage
Speaker 2: space until data is written to it. Imagine trying to
Speaker 2: recover a deleted file that technically exists but has no
Speaker 2: content yet. It really messes with traditional data recovery methods.
Speaker 1: Wow, So even understanding how the data is stored is
Speaker 1: a challenge. What about all those security features Apple's always
Speaker 1: talking about.
Speaker 2: Huge factor You've got code signing to prevent unauthorized apps, sandboxing,
Speaker 2: isolating apps from each other, and the system. But the
Speaker 2: big one is encryption. The whole file system is encrypted
Speaker 2: by default on all modern iPhones.
Speaker 1: So even if you get the phone, the data scrambled.
Speaker 1: Makes sense why those chip off methods are often useless
Speaker 1: it's like breaking into a safe and finding a bunch
Speaker 1: of gibberish.
Speaker 2: Exactly, and that encryption is tied to the user's.
Speaker 1: Passcode, adding another layer of difficulty exactly.
Speaker 2: So investigators have to get creative logical acquisition. Things like
Speaker 2: iTunes backups are often the go to method for newer iPhones,
Speaker 2: but sometimes they need deeper access, which.
Speaker 1: Is where jail breaking comes in. Risky but necessary to
Speaker 1: get past those security barriers. You've got a whole section
Speaker 1: here on jail breaking tools, which ones work with, what
Speaker 1: iOS versions. It's like a hacker's playbook.
Speaker 2: Jail Breaking is a delicate process for sure, but sometimes
Speaker 2: it's the only way to get a full filesystem acquisition
Speaker 2: yea on a complete copy of the device's storage.
Speaker 1: So even with iPhone, there's a spectrum of approaches, from
Speaker 1: relatively simple backups to pretty intense filesystem dumps. But Android,
Speaker 1: I'm guessing that's a whole other beast.
Speaker 2: You bet. Android's open nature, the sheer variety of devices
Speaker 2: it makes it both challenging and really fascinating. From a
Speaker 2: forensic standpoint.
Speaker 1: We're back ready to tackle the wild world of Android forensics.
Speaker 1: From what I've read, it's a whole different ballgame compared
Speaker 1: to iOS.
Speaker 2: That's putting it mildly massive, open source ecosystem, countless device manufacturers,
Speaker 2: and a history of let's just say, evolving security measures.
Speaker 1: So investigators need to be adaptable, to say the least.
Speaker 1: But before we jump into techniques, break down the Android
Speaker 1: system itself. How is it structured in a way that
Speaker 1: matters for forensics?
Speaker 2: Okay, so, at its core, Android runs on the Linux
Speaker 2: kernel that handles all the low level stuff, memory processes,
Speaker 2: some baseline security, but then you start adding layers, libraries
Speaker 2: for graphics, databases, the Android run time that actually executes
Speaker 2: the apps.
Speaker 1: It goes on and on, so it's not just a
Speaker 1: single thing. Investigators need to know what layer they're even
Speaker 1: dealing with to find the data precisely.
Speaker 2: And don't forget about those filesystems. You might encounter, flash, memory,
Speaker 2: media based, or pseudo file systems, each one with its
Speaker 2: own quirks. Fun fact, Android used to rely heavily on
Speaker 2: why affs two. Okay, but lots of devices have transitioned
Speaker 2: over to EXT four and that migration can actually create
Speaker 2: challenges for investigators.
Speaker 1: Okay, I'm intrigued. Why would switching file systems be a
Speaker 1: big deal. Sounds like a technical detail.
Speaker 2: It is, but it impacts data recovery. Why affs two.
Speaker 2: It had this thing called out of band data stored
Speaker 2: separately from the main file data. If you're not careful
Speaker 2: during the acquisition process, you could miss that data entirely.
Speaker 1: Oh so it's like a hitting compartment that could hold
Speaker 1: key evidence Sneakye. But let's talk about the elephant in
Speaker 1: the room. Android security. I know it's improved over the years,
Speaker 1: but it's also had well, it's had its share of vulnerabilities.
Speaker 2: Definitely, early versions of Android pretty easy to crack. Yeah,
Speaker 2: but Google is really stif up their game. Now. You've
Speaker 2: got the secure kernel, permission models that limit what apps
Speaker 2: can do, sandboxing to isolate them, and of course full
Speaker 2: disc encryption on all modern devices.
Speaker 1: So it's a mix of familiar concepts from iOS, but
Speaker 1: implemented in a different way. How does androids approach to
Speaker 1: app signing differ from Apples you mentioned that earlier.
Speaker 2: Yeah, key distinction. Apple's code signing is incredibly strict. Only
Speaker 2: apps they vetted can run on iOS devices period. Androids
Speaker 2: a lot more open apps need to be signed, but
Speaker 2: it's more about verifying the developer's identity and preventing tampering,
Speaker 2: not necessarily guaranteeing safety.
Speaker 1: So it's like a walled garden versus I don't know,
Speaker 1: a bustling marketplace. More freedom, but more potential for shady
Speaker 1: stuff to slip through the cracks.
Speaker 2: A very app to analogy, and that's where things like
Speaker 2: Selinicx come in. Security enhanced Linux adds another layer of control,
Speaker 2: enforcing really strict rules on what processes can access which resources.
Speaker 1: So even if an app is compromised, slinx limit, it's
Speaker 1: the damage it can do like a security guard inside
Speaker 1: the system itself. But let's get practical. How do investigators
Speaker 1: approach data acquisition on an Android device?
Speaker 2: Like with iOS, they've got logical and physical options. Logical
Speaker 2: often involves using the Android Debug Bridge or ADB.
Speaker 1: Yeah, we talked about setting up that controlled environment for forensics.
Speaker 1: So ADB it's basically like a remote control for Android devices, right,
Speaker 1: you got it.
Speaker 2: It has commands for creating backups. Think of it like
Speaker 2: an iTunes backup, but for Android, pulling specific files, even
Speaker 2: accessing the command.
Speaker 1: Line handy, But what if you need deeper access when
Speaker 1: you're dealing with encryption or deleted data.
Speaker 2: Then you might look at physical acquisition chip off, where
Speaker 2: you physically remove the memory chip. Right, it's an option,
Speaker 2: but it's destructive, there is risky. Then there's JTAG, a
Speaker 2: hardware interface that can sometimes access the memory without removing
Speaker 2: the chip.
Speaker 1: So again a range of techniques depending on the situation.
Speaker 1: But all this data acquisition is useless if you can't
Speaker 1: get past that lock screen.
Speaker 2: Very true Android lock screens. There are constant battleground techniques
Speaker 2: that exploit vulnerabilities, social engineering tricks. You can even try
Speaker 2: to reset the password remotely using Google's Find My Device.
Speaker 1: So it gets pretty creative, but brute force attacks just
Speaker 1: trying every combination that can't be practical most of the time.
Speaker 2: Right, No, not really lockout mechanisms, the sheer length and
Speaker 2: complexity of pass codes these days, it all adds up,
Speaker 2: and then you've got the classic smudge attack, analyzing fingerprints
Speaker 2: left on the screen to guess the unlocked pattern, though
Speaker 2: that's more effective on older devices.
Speaker 1: Speaking of older devices, I remember reading that rooting is
Speaker 1: often necessary for in depth Android forensics, but it's not
Speaker 1: without its risks. Right.
Speaker 2: Absolutely, rooting gives you super ruser privileges, complete control over
Speaker 2: the device. It's essential for accessing certain data, like the
Speaker 2: data data folder where app store sensitive information. But you
Speaker 2: can also break the device if you're not careful, and
Speaker 2: it definitely avoids the warranty.
Speaker 1: So investiators need to way the risks and benefits there.
Speaker 1: But let's say they successfully acquire the data, how do
Speaker 1: they even navigate the Android file hierarchy? Is it anything
Speaker 1: like iOS? Oh?
Speaker 2: It's more complex. You've got various directories like data for
Speaker 2: user and app data, a state card for external storage,
Speaker 2: dot system for the operating system itself. Knowing where to
Speaker 2: look is crucial.
Speaker 1: And every manufacturer might tweak things a bit, adding another
Speaker 1: layer of complexity. It's like trying to find a needle
Speaker 1: in a haystack that keeps changing shape.
Speaker 2: A very colorful way to put it. But that's what
Speaker 2: makes Android forensics so challenging and so rewarding. There's always
Speaker 2: something new to learn. Each case presents its own unique
Speaker 2: puzzles to solve.
Speaker 1: So we've covered the giants iOS Android, but you've also
Speaker 1: got some material in here on well an underdog Windows Phone.
Speaker 1: I haven't thought about those in years.
Speaker 2: Yeah, it's true. Windows Phone never really gained the same
Speaker 2: traction as iOS or Android, but they're still out there,
Speaker 2: and for an investigator encountering a less comp device, that
Speaker 2: could be a real curve ball.
Speaker 1: Let's dust off the history books for a second. Remind
Speaker 1: me what was the whole deal with Windows Phone? What
Speaker 1: were they even trying to do?
Speaker 2: Well, Microsoft was trying to carve out their own space
Speaker 2: in the smartphone market. They went with a very bowl
Speaker 2: visual approach, one of those colorful tiles.
Speaker 1: Oh yeah, those life tiles, constantly updating with information. So
Speaker 1: from a forensic standpoint, what's set Windows Phone apart?
Speaker 2: Well, it had its own unique set of features and quirks,
Speaker 2: just like any os. They had this concept called chambers
Speaker 2: for isolation, similar to sandboxing, but with its own twist.
Speaker 2: And of course encryption was a factor in later versions,
Speaker 2: just like with iOS and Android.
Speaker 1: So even though it wasn't as popular, Windows Phone still
Speaker 1: had security measures in place. Anything particularly interesting or different
Speaker 1: about its security.
Speaker 2: Well, one standout feature was the capability based security model,
Speaker 2: similar to Android's permissions, but even more granular. Apps could
Speaker 2: only do what they were explicitly allowed to do. It
Speaker 2: was a pretty robust approach.
Speaker 1: So it's not just about knowing how to get data
Speaker 1: off a whi. Windows phone investigators need to understand those
Speaker 1: nuances of its architecture and security to even know what
Speaker 1: they're looking for, how to access it.
Speaker 2: Exactly, And like with the other platforms, there's a range
Speaker 2: of acquisition methods logical options, but tool support is often
Speaker 2: more limited just because of Windows Phones, smaller market share.
Speaker 1: Makes sense, fewer devices, fewer developers making tools for them.
Speaker 1: Are there any go to tools for Windows Phone even
Speaker 1: if the options are limited.
Speaker 2: Celebrate ufed, a popular commercial suite, offers some support, but
Speaker 2: there's also a free tool called wpinternals that has gained
Speaker 2: some traction. Lets you extract data without needing that expensive
Speaker 2: commercial software.
Speaker 1: So there are ways to diyatt good to know, But
Speaker 1: once you've got the data, how do you navigate the
Speaker 1: Windows Phone filesystem? Is it anything like what we've seen
Speaker 1: with iOS and Android.
Speaker 2: It's actually closer to NTFS, the filesystem used in Windows
Speaker 2: desktop PCs, but it's optimized for mobile, so some of
Speaker 2: that knowledge transfers over. But there are unique directories in
Speaker 2: file formats.
Speaker 1: To learn familiar but with a mobile twist, any specific
Speaker 1: files or directories that investigators should prioritize when they're looking
Speaker 1: for evidence On a Windows.
Speaker 2: Phone, absolutely, the data directory is key. It holds user data,
Speaker 2: app data, system settings, and then you've got applications. Pretty
Speaker 2: self explanatory. Those are the usual starting points, and.
Speaker 1: No Windows system would be complete without a registry, right,
Speaker 1: I'm guessing that's a treasure trove of information, just like
Speaker 1: on a PC.
Speaker 2: Oh, you know it. Registry is a gold mine for
Speaker 2: configuration settings, all sorts of clues, and of course investigators
Speaker 2: are always on the lookout for those specific artifacts contacts, messages,
Speaker 2: call logs, browsing history, all that good stuff.
Speaker 1: So even though Windows Phone might seem like a blast
Speaker 1: from the past, the fundamentals of mobile forensics still apply.
Speaker 1: You need to understand the system, know where to look,
Speaker 1: use the right tools to get that data and analyze it.
Speaker 2: That's the beauty of it. The specifics change, but the
Speaker 2: core principles they stay the same. It's all about piecing
Speaker 2: together that digital puzzle no matter what device you're dealing with.
Speaker 1: This has been a really incredible deep dive into mobile forensics,
Speaker 1: from iPhones to androids to those forgotten Windows phones. You've
Speaker 1: really shown the challenges, the possibilities, all of it.
Speaker 2: It's been my pleasure and remember with every new device,
Speaker 2: every new technology, the field of mobile forensics keeps evolving.
Speaker 1: That's a great point to end on. Thanks for joining us,
Speaker 1: and we'll see you next time for another deep dive.