Chapter 8. Android Forensic Setup and Pre-Data Extraction Techniques

In the previous chapter, we covered the fundamentals of Android architecture, security features, filesystems, and other capabilities. Having an established forensic environment before the start of an examination is important, as it ensures that the data is protected while the examiner maintains control of the workstation. This chapter will explain the process of, and what to consider when, setting up a digital forensic examination environment. It is paramount that the examiner maintains control of the forensic environment at all times; this prevents the introduction of contaminants that could affect the forensic investigation.

We will cover the following topics in this chapter:

• Setting up a forensic environment
• Connecting the device and accessing it from a workstation
• Screen lock bypass techniques
• Gaining root access to the device

Setting up the forensic environment for Android

A forensic examiner may encounter a wide range of mobiles over the course of their investigation. Hence, it is necessary to have a basic environment set up, on top of which he can build based on the requirements. It is also very important that the forensic expert maintains complete control over the environment at all times, to avoid any unexpected situations. Setting up a proper lab environment is an essential part of the forensic process. The Android forensic setup usually involves the following steps:

• Start with a fresh or forensically sterile computer environment. This means that other data is either not present on the system or is contained in a manner that prevents it from contaminating the present investigation.
• Install the basic software necessary to connect to the device. Android forensic tools and methodologies will work on Windows, Linux, and OS X platforms.
• Obtain access to the device. An examiner must be able to enable settings or...

Screen lock bypassing techniques

Due to the increase in user awareness and the ease of functionality, there has been an exponential increase in the usage of passcode options to lock Android devices. Hence, bypassing the device's screen lock during a forensic investigation becomes increasingly important. The applicability of the screen lock bypass techniques discussed so far is based on the situation. Note that some of these methods may result in making changes to the device. Make sure that you test and validate all the steps listed on non-evidentiary Android devices. The examiner must have authorization to make the required changes to the device, document all steps taken, and be able to describe the steps taken if a courtroom testimony is required.

Currently, there are three types of screen lock mechanisms offered by Android. Although there are some devices which have voice lock, face lock, and fingerprint lock options, we will limit our discussion to the following three options, since these...

Gaining root access

As a mobile device forensic examiner, it is essential to know everything that relates to twisting and tweaking the device. This would help you to understand the internal workings of the device in detail and comprehend many issues that you may face during your investigation. Rooting Android phones has become a common phenomenon and you can expect to encounter rooted phones during forensic examinations. The examiner, where applicable, may also need to root the device in order to acquire data for the forensic examination. Hence, it's important to know the ins and outs of rooted devices and how they are different from other phones. The following sections cover information about Android rooting and other related concepts.

What is rooting?

The default administrative account in Unix-like operating systems is called root. So, in Linux, the root user has the power to start/stop any system service, edit/delete any file, change the privileges of other users, and so on. We have already...

Summary

A proper forensic workstation setup is required prior to conducting investigations on an Android device. Using open source methods to acquire and analyze Android devices requires the installation of specific software on the forensic workstation. If the method of forensic acquisition requires the Android device to be unlocked, the examiner needs to determine the best method by which to gain access to the device. The various screen lock bypass techniques explained in this chapter help an examiner to bypass the passcode under different circumstances. Depending on the forensic acquisition method and scope of the investigation, rooting the device should provide complete access to the files present on the device.

Now that the basic concepts of gaining access to an Android device have been covered, we will cover acquisition techniques and describe how data is pulled using each method in Chapter 9, Android Data Extraction Techniques.