Android Mobile forensics with custom recoveries
Download as PPTX, PDF4 likes2,283 views
The document discusses Android forensics and the development of custom recoveries, outlining the architecture of Android and the process of digital forensics. It highlights the potential for custom recoveries to aid forensic investigations by providing functionalities such as data acquisition and bypassing security features. Challenges include locked boot-loaders, while the document concludes with acknowledgments of contributors.
Android Mobile forensics with custom recoveries
- 1. Android forensics and Custom Recoveries Ibrahim M. El-Sayed 1
- 2. Outline Introduction to Android Custom Recoveries Custom recoveries and Forensics Challenges and Goals Conclusion 2
- 3. Introduction To Android Android ? Robot with a human appearance Open-source operating system currently Developed by Google 3
- 4. Introduction To Android Android Market Share (US) 4
- 5. Introduction To Android Android Market Share (Else Where) 5
- 6. Introduction To Android Android Architecture 6
- 7. Introduction To Android Android partition layout /system: mounted read-only system files /data: user data and applications /cache: partition used by the dalvik machine for performance /boot: the kernel of device /recovery: minimal kernel + file system /sdcard: removable sdcard 7
- 8. Custom Recoveries What are Recoveries partition? A mode on android devices that boots a minimal Linux environment. (Similar to Safe-mode in Windows OS) Why stock recoveries? Update The Operating System Backup and maintenance 8
- 9. Custom Recoveries How do their architecture look like? 9 RECOVERY.IMG
- 10. Digital forensics Digital forensics: is a branch of forensic science encompassing the recovery and investigation of material found in digital devices, often in relation to computer crime. Digital Forensics Process 10 Seizure Acquisition Analysis Reporting
- 11. Custom recoveries and Forensics What might be the relation between Custom Recoveries and Forensics? File system is not encrypted! Boot-loaders! Hypothesis: If we managed to develop a custom recovery with forensics functionalities, we will be able to forensically analyze mobile devices What are the forensics functionalities? 11
- 12. Custom recoveries and Forensics Forensics Functionalities – Viaforensic! Passphrase/pin/pattern bypass Logical data acquisition Physical data acquisition Rooting Adb Shell 12
- 13. Custom Recoveries How to develop a Custom recovery? 1. Install Linux/Mac OsX to start building 2. Download Cyangonmod source code 3. Develop the forensics functions 4. Build your Custom Recovery 5. Flash it on the device if you have the correct device configuration!!! 13
- 14. Custom Recoveries Develop the forensics functions Logical Acquisition Physical Acquisition Rooting ADB 14
- 15. Custom Recoveries Build Custom Recovery Known devices in Cyangonmod source tree. (Samsung S3) Let’s see the Build guide provided by Cyangonmod website :) 15
- 16. Custom Recoveries Build Custom Recoveries for new devices! What is the needed information? Partition info BoardConfig kernel Information Gathering 1. Already built stock-ROMs 2. Pull from rooted devices 3. Mobiles are similar How much possible you will get device configuration? 16
- 17. Custom Recoveries Flashing your Custom Recovery ODIN/Heimdall Samsung devices fastboot Almost all other android devices HBOOT 17
- 18. Testing The technique have been tested with Samsung Galaxy S2, S3, S4 Samsung Note I, Note II Oppo N1 Theortically applicable with 90% of Samsung devices Why Samsung is THAT bad? It also possible with Sony devices Might work with Nexus HTC 18
- 19. Challenges and Goals Challenges Locked boot-loaders Device configuration Goals Boot from SD-Cards Bypass locked boot-loaders 19
- 20. Acknowledgments Eng. Waleed Zakira Eng. Mohamed Nasr Eng. Mohamed Zaki Eng. Mahmoud Raouf 20
- 21. Any Questions ? 21