YCSC

Mobile Forensics

Introduction to Mobile Forensics

Mobile forensics is the process of recovering digital evidence from mobile devices using accepted methods. Unlike traditional digital forensics processes, mobile forensics solely focuses on retrieving information from mobile devices such as smartphones, androids, and tablets. 

Learning Outcome

  • You will be able to create a new case on ALEAPP and iLEAPP (Forensic tool). 
  • You will be able to explain the types of data sources ALEAPP and iLEAPP can analyze, such as mobile Logs, Events, and Protobufs.
  • You will be able to describe the structure and content of Android ad iOS Logs and Events.
  • You will be able to analyze parsed data to identify user activities, application usage, notifications, and system events.

Tools

Kali Linux VMware/VirtualBox: https://www.kali.org/get-kali/#kali-virtual-machines

ALEAPP v3.1.8: https://github.com/abrignoni/ALEAPP

iLEAPP v1/18.7: https://github.com/abrignoni/iLEAPP

 

Setting up ALEAPP & iLEAAP

ALEAPP and iLEAPP is an open-source tool developed by Alexis Brignoni that is able to quickly triage both Android and iOS data collection. It is a cross-platform tool that can be run on any major operating system that supports Python, we are going to use it on Kali Linux. You may refer to the links provided above for guidance to install ALEAPP and iLEAPP

Part 1: Android Forensics Analysis using ALEAPP 

  • Copy the folder “Mobile Forensics” into the virtual machine desktop.
  • Unzip the “Android Logical Image” folder.
  • Create a new folder called “Android”. This folder will be selected as the output folder to store the parsed files.

Open the kali linux terminal and navigate to the directory where ALEAPP was installed as shown below.

5. Run the below command to execute the GUI interface of ALEAPP.

             

6. You should be able to see the ALEAPP GUI interface.

7. Click the “Browse Folder” tab and select the “Android Logical Image” folder as shown below and click “OK” tab.

8. Click the “Browse Folder” tab and select the new folder created in step 3 above. Once done, click “OK” tab. Subsequently, click the “Process” below marked in red.

9. Once the process is completed, you will be prompted with the following window. Click the “OK” tab.

10. Subsequently, the report of the analysis will open on browser automatically.

11. Analyse the information within the report and answer the following questions.

              Questions:      

    1. State the email address that was logged into the google account of the android device.
    2. Was there any twitter account information? If yes, please provide the account name.
    3. Where can we find information related to app launch? (Provide the file path)
    4. How many apps were launched via the home screen?
    5. What is the MAC address of the Bluetooth adapter?
    6. Where there any bluetooth device connected to the android device?
    7. What software did the user download into the android device?
    8. When was “fun flag games” was searched? (Answer should be in the format YYYY- MM – DD_HH: MM: SS Timestamp in UTC)
    9. Does the login data information reveal password details? If yes, list the password disclosed.
    10. From where was boot.img downloaded?
    11. Who was Tina Louis chating with via Google Chat?
    12. What is the SSID of the following Wifi Mac Address 00:00:5e:00:01:03?
    13. It seems that Tina intended to spawn some office romance as she searched for its legality. What was the article’s title that answered her question? (Hint: dating) 

      Part 2: iOS Forensics Analysis using iLEAPP

      1. Copy the folder “Mobile Forensics” into the virtual machine desktop.
      2. Unzip the “iOS Logical Image” folder.
      3. Create a new folder called “iphone”. This folder will be selected as the output folder to store the parsed files.
      4. Open the kali linux terminal and navigate to the directory where iLEAPP was installed as shown below.
      5. Run the below command to execute the GUI interface of ALEAPP.
      6. You should be able to see the iLEAPP GUI interface.
      7. Click the “Browse Folder” tab and select the “iOS Logical Image” folder as shown below and click “OK” tab.
      8. Click the “Browse Folder” tab and select the new folder created in step 3 above. Once done, click “OK” tab. Subsequently, click the “Process” below marked in red.

         

      9. Once the process is completed, you will be prompted with the following window. Click the “OK” tab.
      10. Subsequently, the report of the analysis will open on browser automatically. 
      11.  Analyse the information within the report and answer the following questions.
      12.       Questions:      
          1. What is the username of the AppleID of the iOS device?
          2. What username was used for AllTrails?
          3. Did Patrick receive any incoming call? If yes, please state the number he received call from.
          4. Patrick’s iphone was connected to which device?
          5. What version of iphone was on the system?
          6. What time zone was used on the system?
          7. When was the last mobile backup done? (Answer should be in the format YYYY- MM – DD_HH: MM: SS)
          8. When was “Grocery List” notes created? (Answer should be in the format YYYY- MM – DD_HH: MM: SS)
          9. What is the name of the GIF sent to Patrick via Bumble message? (Hint: The answer is three words)
          10. It seems that Patrick’s computer has been hacked. What was the search term he used to get guidance on what action to take?
          11. Which app was uninstalled from the device?