移动设备取证：高级调查策略

5星 · 超过95%的资源需积分: 32 105 浏览量更新于2024-07-19 收藏 26.33MB PDF 举报

"Mobile Forensics - Advanced Investigative Strategies" 本书深入探讨了移动设备取证的高级策略和方法，旨在帮助读者克服在手机和 tablet 取证过程中遇到的困难。作者团队由行业专家组成，他们在数字取证领域有丰富的研究和实践经验。在本书中，读者将学习到： 1. **理解移动取证的挑战**：移动设备作为关键证据来源的重要性，以及如何应对不断变化的技术和设备带来的复杂性。 2. **正确处理数字证据**：遵循正确的程序来保护、保存和分析证据，确保其法律效力。 3. **不同平台的证据类型**：iOS、Android、Windows 和 BlackBerry 设备上可获取的不同类型的证据，包括应用程序数据、通讯记录、位置信息等。 4. **预期的取证结果**：在特定情况下，选择合适的取证方法可能得到的结果，以及如何评估这些结果对案件的影响。 5. **选择适当的获取方法**：物理获取（通过 USB 连接）、逻辑获取（通过数据备份）、空中（over-the-air）获取和低级别（高级）获取的适用场景和步骤。 6. **主要平台的获取方法**：对每个主要移动平台（如 Android、iOS、Windows Phone 和 BlackBerry）进行深入的获取技术研究。 7. **关键的移动取证工具和技巧**：了解并掌握针对各种平台的取证工具，包括用于数据提取、分析和云服务取证的工具。 8. **问题与特殊案例的处理**：面对设备加密、软件更新或硬件损坏等挑战时，如何有效地进行取证工作。 9. **移动取证工具与案例研究**：实际案例展示如何应用所学策略和技术，解决现实世界中的问题。通过阅读本书，无论是新手还是经验丰富的专业人士，都能提升对移动设备取证的理解，掌握应对各类取证挑战的实用技巧。作者 Oleg Afonin 和 Vladimir Katalov 在数字取证领域有着深厚的背景，他们的专业见解和实战经验使得本书成为该领域的宝贵资源。

[ viii ]

Windows RT 363

Windows 8 through 10

363

BlackBerry OS 1 through 7

364

BlackBerry 10 364

SD cards conclusion

365

SQLite databases (access to call logs, browsing history, and many

more)

366

Summary

366

Chapter 11: Mobile Forensic Tools and Case Studies

367

Cellebrite

367

Micro Systemation AB

368

AccessData

368

Oxygen Forensic toolkit

368

Magnet ACQUIRE

368

BlackBag Mobilyze

369

ElcomSoft tools

369

Case studies

369

Mobile forensics

369

Data recovery

370

BlackBerry scenarios

371

Locked BlackBerry devices

371

Locked BlackBerry, not attached to BlackBerry Enterprise Server (BES) 371

Locked BlackBerry attached to BES 372

Locked BlackBerry attached to BES with Pretty Good Privacy (PGP) encryption 372

Locked BlackBerry, not attached to BES 373

Locked BlackBerry – completed successful chipoff 374

Locked BlackBerry – password does not work 374

Unlocked BlackBerry devices

375

Unlocked BlackBerry device with no password 375

Unlocked BlackBerry device with password 375

Summary

375

Index

376

Preface

Smartphone and tablet technology has changed dramatically and rapidly in the last several

years and continues to do so at an astounding pace. These smaller computing devices are so

common, with the ability to replace their desktop counterparts in human-to-computer

interactions. Sit in any café, airport, or public place that offers Wi-Fi and you will see

humans with their faces ostensibly glued to their device screens, interacting on their device

with such focus, seemingly oblivious to their own physical environment.

Smartphone and tablet devices have become large digital storage vaults that store our

personal and professional secrets. Strangely enough, with little faith, we have also begun to

allow ourselves to accept backup up of this data to the cloud so that important aspects of our

local device storage are now also in cloud storage. Why did I mention cloud storage? Cloud

backup data can be accessed outside of the device itself through other processes, when

access to the device data itself may be obstructed due to security mechanisms. This book

addresses cloud forensics from the various smartphone platforms.

Whilst this could be considered a highly technical book, it is an excellent read for both

novices and experienced examiners alike. For those that have read any of the blog articles

that have been published by Elcomsoft, you will find a comfortable approach to the way

this book has been written.

The authors of this book strive to provide essential information about a number of concepts

including the following:

NAND eMMC flash memory

A brief summary of JTAG forensics

NANDroid backups

iOS security and acquisition method

Password breaking on iOS backups

Windows Phones security and acquisition

BlackBerry 7 and BlackBerry data acquisition methods and password breaking

There are of course references to customized tools that are developed by the authors and

their colleagues. What this highlights to anyone reading this is that in the field of mobile

forensics, no one tool can do it all. I know and say this from experience because I have used

all the tools mentioned in this book. All tools have their strengths and limitations. But to be

effective, an examiner must have at least several tools to cover the broad range of

technology in mobile forensics.

Preface

[ 3 ]

We will not go into any technical detail, such as which hex code at what address means

what, or how to calculate UDID, or how to use ADB to break through passcode protection

on Android 2.1. We believe these things are meaningless for a law enforcement officer, and

should only interest technicians working in an acquisition lab – and this book is not for

them.

Chapter 1, Introducing Mobile Forensics, introduces the concept of mobile devices as a source

of valuable evidence. The chapter describes what types of evidence are generally available

in mobile devices. It also outlines acquisition options depending on whether the reader has

access to the actual device, knows the user’s login and password (such as an Apple ID or

Google Account password), or has access to the computer that was used to sync the mobile

device. This chapter also discusses the various techniques used by suspects to counter

forensic efforts, and suggests methods to overcome such efforts. This chapter is essential to

understand what, why, and how the expert is trying to achieve when investigating mobile

devices. After reading this chapter, you will understand the big picture of mobile forensics

and realize that there is no single straightforward path to acquiring mobile evidence, and

understand that available acquisition options strongly depend on various factors. You’ll get

an idea of how to seize and store mobile devices and how to detect and counter anti-

forensic efforts.

Chapter 2, Acquisition Methods Overview, gives an overview of the acquisition methods

available for different mobile platforms. With the wide range of mobile devices around,

multiple acquisition methods exist. There is no single universal acquisition method

available for all models. Some acquisition methods depend on the phone’s lock and

encryption status, OS version, type of available storage, and so on. Investigators have to

work their way through the investigation to discover what acquisition methods are

available for a particular device.

Chapter 3, Acquisition – Approaching Android Devices, discusses the options available for

acquiring information from Android devices, providing a detailed outline of physical,

logical, and over-the-air acquisition methods for Android smartphones and tablets. In this

chapter, the reader will learn what acquisition methods are available for the Android

platform, which acquisition techniques are available in what circumstances, and how to

choose the appropriate acquisition method for a given device. This chapter also covers one

of the most challenging aspects of mobile forensics: the ability to recover destroyed

evidence. In this chapter, we discuss exactly how modern smartphones handle deleted data,

depending on the operating system (Android, iOS, Windows) and encryption status. We’ll

address the differences between internal (eMMC) and external (SD) storage of the device in

the context of being able to recover information from unallocated areas.

Preface

[ 4 ]

Chapter 4, Practical Steps to Android Acquisition, discusses the massive amounts of

information collected by Google, and explains how to extract this information from Google

servers. We’ll be using forensic tools to download data from Google, view it, and examine

obtained evidence. The acquisition of Google Accounts can provide a much deeper insight

into user activities than what’s available in a single Android smartphone. This chapter

offers a detailed discussion and demonstration of various physical acquisition methods

available for a wide range of Android devices, including manufacturer-specific low-level

service modes (LG, Qualcomm, and Mediatek), using custom recoveries (CWM, TWRP) for

dumping the data partition, making NANDroid backups, and using command-line tools

such as dd for live imaging the device. In addition, this chapter discusses the issue of

encryption and its effect on physical acquisition.

Chapter 5, iOS – Introduction and Physical Acquisition, discusses the benefits and unique

features of physical acquisition, and talks about stored passwords and Apple secure

storage, the keychain. This chapter provides a detailed compatibility matrix for physical

acquisition, discusses which locked devices can be acquired without knowing the correct

passcode, and lists forensic tools that offer physical acquisition of Apple iOS devices. It

discusses the differences between 32-bit and 64-bit Apple hardware, and explains how to

install a jailbreak.

Chapter 6, iOS Logical and Cloud Acquisition, introduces the concept of the logical

acquisition of iOS devices. Logical acquisition consists of extracting existing iTunes backups

or making the device produce a backup and then extracting it. The differences between

encrypted and unencrypted backups are explained, outlining the benefits of producing

encrypted backups with a known password over unencrypted one. This chapter outlines

the basics of recovering unknown backup passwords. In addition, this chapter provides

step-by-step instructions on using Elcomsoft Phone Breaker to extract iOS backups. If the

backup is protected with an unknown password, detailed instructions and

recommendations on recovering the password are provided. This chapter explains the

advantages and applicability of over-the-air acquisition, and demonstrates how to use

Elcomsoft Phone Breaker for cloud acquisition. In addition, this chapter discusses the use of

binary authentication tokens to bypass an Apple ID and password, as well as two-factor

authentication.

Chapter 7, Acquisition – Approaching Windows Phone and Windows 10 Mobile, introduces

Windows Phone forensics. It outlines the available methods and approaches to acquiring

Windows Phone 8 and 8.1 and Windows 10 Mobile devices. Physical acquisition, bootloader

exploits, invasive (advanced) acquisition via JTAG, and chip-off are explained. In this

chapter, we discuss the differences in device encryption between generations of the

Windows Phone platform, and provide a detailed walkthrough of over-the-air acquisition

of Windows mobile devices using Elcomsoft Phone Breaker.

剩余400页未读，继续阅读

ramissue

粉丝: 354
资源: 1487

移动设备取证：高级调查策略

mobile_forensics_pa:Cellebrite Physical Analyzer 和其他设备的移动取证解析和解码

Mobile Forensics Advanced Investigative Strategies 无水印原版pdf

Mastering Mobile Forensics

(175797816)华南理工大学信号与系统Signal and Systems期末考试试卷及答案

深圳建设施工项目安全生产奖惩管理制度.docx

离散数学课后题答案+sdut往年试卷+复习提纲资料

自考04741计算机网络原理真题及答案及课件

C++实现rpc，全程手写

前端拿到的列表数据里id都一样的处理办法.txt

最新仿720云全景制作源码-krpano仿720云全景网站源码 新增微信支付+打赏+场景红包

最新资源

最新仿720云全景制作源码-krpano仿720云全景网站源码新增微信支付+打赏+场景红包