Android Phone Forensic Analysis

ANDROID FILE SYSTEMS

There is no singularly defined file system for Android. Android is developed on Linux kernel and Linux supports many file systems. Each file system are the implementation of VFS (Virtual File System). VFS is the abstract layer of Kernel through which an application’s file and directory operations flows. Each of the file system has separate Kernel module that supports operations. Hence adding a new file system means adding a new kernel module. This implies that Kernel configuration file defines which all file systems should be compiled and hence files systems that are supported by Android varies with devices. The Android File Systems that are supported by Android Phones can be classified as flash memory file systems and media based file systems. Let’s proceed with Android Phone Forensics:

FLASH MEMORY ANDROID FILE SYSTEMS:

  1. YAFFS2 (Yet Another Flash File System V2) It was the default AOSP (Android Open Source Project) flash file system for kernel version 2.6.32. This file system is not supported in the newer kernel versions. But mobile vendors continues support for this file system.
  2. JFFS2 (The Journal Flash File System V2) Since Ice Cream Sandwich it is the default flash file system for the AOSP kernels.
  3. F2FS (Flash-Friendly File System) An Open Source file Linux system introduced by Samsung
  4. exFAT (extended File Allocation Table) It’s the proprietary file system of Microsoft for flash memories. It is not a part of standard Linux Kernel due to licensing requirements.

MEDIA-BASED ANDROID FILE SYSTEMS:

  1. EXT2 / EXT3 / EXT4 (Extended File System) It is the standard Linux File system. It is often used as internal memory file system instead of YAFFS2 & JFFS2.
  2. MSDOS The FAT12, FAT16 & FAT32 file systems
  3. VFAT It is not actually a file system, which are extensions to FAT12, FAT16 & FAT32

ROOTING ANDROID DEVICE

Rooting is the process of attain privileged control of an android devices. It gives yourself the root permission on your device. Rooting Android device helps to overcome the limitations of the devices put by the manufacturers. With a rooted phone we can run apps that require certain system access, flash custom ROMs which adds more features. Rooting can be done through command prompt development interface ADB or using special rooting applications. We can’t access the system files and database files of an un-rooted device as they are encrypted. So analysis of Android systems files are possible only if the device is rooted.

ANDROID FILE SYSTEM STRUCTURE: PARTITIONS

Android uses more than one file system and multiple partitions to organize files and folders in the device. In the file system partitions are represented by directories. There are mainly six partitions used by android devices. They are boot, system, recovery, data, cache, misc. Each of these partitions has its own functionalities. There may be other partitions which differ in each model such as sdcard, sd-ext.

android phone forensics
android mobile forensics

We can check which all partitions are available in a device along with its total, used and free size using adb command in the below image.

android phone forensics analysis
  1. /boot It is the boot partition of the android device which includes the android kernel and ramdisk. The device cannot boot without this partition. If we wipe this partition we need to install new ROM which includes /boot partition to boot the system again.
  2. /system This partition contain the entire OS including Android GUI and pre-installed system applications. We can enter the recovery or boot loader mode even if we wipe this partition.
  3. /recovery This partition is specially designed for backup purpose. It is considered as an alternative boot partition that lets the device to boot in a recovery console.
  4. /data This partition is to store user data. It contain all the user data like sms, contacts, settings and all data related to installed applications. When you are doing a factory reset, it actually wipe out data partition.
  5. /cache Cache partition stores frequently accessed application and data components. Even if we wipe this partition, it gets automatically rebuilt as you continue using the device.
  6. /misc This partition contains miscellaneous system settings. It includes hard ware settings, USB configuration etc. If we wipe this partition, device’s features will not function normally.
  7. /sdcard This partition is for the SD card, not for the internal memory. It is used to store any type of data such as media, documents, ROM etc. The SD card can be internal or external SD card depending on the device.
  8. /sd-ext This partition is commonly used by custom ROMs and not a standard Android partition. It is an additional partition on SD card that act as data partition in some custom ROMs that have the features like app2sd to get additional storage for installing their apps.

ANDROID LOGS : File Location & Related Artifact Forensic Analysis

The default location of Android log file can be find at /dev/log. We can see the logs if we execute logcat command from terminal inside Android. The logcat command executed using ADB.exe and dumped into text file are shown below. The command to export logs into PC using adb.exe:

adb logcat -v time > E:\log.txt

analysis android mobile forensics

ANDROID COMMON APPLICATION ANALYSIS

Few of most commonly using android applications selected here for analysis are:

  1. Google Chrome
  2. Whatsapp
  3. Android Contacts
  4. Telephony
  5. Bluetooth
  6. WiFi

GOOGLE CHROME

Location: \data\com.android.chrome\app_chrome\Default

DB FILE: COOKIES

  1. Table: cookies – Contains cookies
    android phone forensics

DB FILE: HISTORY

  1. Table: keyword_search_terms – Contains keyword searched
    android file system
  2. Table: urls – Contains URLs of visited pages
    android file structure

DB FILE: TOP SITES

  1. Table: thumbnails – Contains URLs of websites which are directly entered in tab WHATSAPP Location: \data\com.whatsapp\databases

DB FILE: AXOLOTL.DB

  1. Table: identities – Contains the contacts (phone number) to which the chat is done
    rooting android phone

DB FILE: MSGSTORE.DB

  1. Table: messages – Contains all messages (both group and individual)
    • The status column indicates message status values (applicable if there atleast single contact in a group satisfies these):
      1. 0 – received message
      2. 13 – sent message seen (blue tick)
      3. 5 – sent message unseen (double tick but not blue tick)
      4. 4 – sent message to Whatsapp server, but not received in recipient Whatsapp app(single tick)
      5. 6 – sent/received calls (key_from_me column specifies whether sent or received call)
    • key_from_me column has values 0 or 1:

      • Value 0 – Not from me (contact’s)
      • Value 1- From me (WhatsApp current user)
    • recipient_count column has 2 kind of values : value 0 for individual chats or shows group member count if it is message in a group
    • read_device_timestamp is empty if message is not seen by everyone in a group
    • media_name column contains name of the media storing in Whatsapp folder, which are sent
    • media_name column contains caption of the media we provided during sending
    • media_url gives location of the media in WhatsApp server

      android log file location
  2. Table: chat_list – Contains all contacts (subject column is empty) and groups (has value in subject column) where chat has been done (both sent & receive).
    • Group has column creation showing creation date
    • message_table_id column field values maps to docid column values in the messages_fts_content table (contains all messages), which says last message (sent/received).

      android phone forensics
      android phone forensics analysis
  3. Table: group_participants – Contains participants in the group
    • gjid colum contains group id
    • jid column contains group participants id (creator does not has this field)
    • admin colum has values 0 or 1:

      • Value 0 – user
      • Value 1 – admin
        android file structure

DB FILE: WA.DB

  1. Table: wa_contacts – Contains contact’s name display name, phone number and their status
    android phone forensics

    Whatsapp stores profile picture in the location \data\com.whatsapp\files\Avatars with extension [.j]. These can be renamed with extension [.jpg], the images will appear. The files are identified by name which are phone numbers.

    android file system & structure

CONTACTS Location: data\com.android.providers.contacts\databases

DB FILE: CONTACTS2.DB

  1. Table: data – Contains phone number and name
  2. Table: sync_state – Contains which all accounts has been synced with phone
    DB FILE: CONTACTS2.DB
  3. Table: calls – Contain full call log details.
    calls
    • The column ‘duration’ stores the duration of the call in seconds.
    • ‘type’ column:

      • 1 for incoming call
      • 2 for outgoing call
      • 2 with ‘duration’=0 for outgoing missed call.
      • 3 for incoming missed call
  4. Table: contacts – Contain contact details in the phone and SIM
    Table contacts
    • times_contacted indicate how many times contacted to that number and last_time_contacted is the time stamp of recent contact.
    • has_phone_number field will be 1 if the phone number is provided while saving the contact and else it will be 0.
    • photo_file_id value indicate which photo is given to the contact. The photo with that file name can be obtained from com.android.providers.contacts\files\photos.
    • The photo file details can be found in table photo_files.
      rooting android phone
      img19
    • custom_ringtone indicate the URI of the ringtone for a contact if assigned.

      img20
    • indicate_phone_or_sim_contact column will be -1 if the contact is saved in phone memory and will be 1 if it is saved in SIM memory.

      img21
  5. Table: raw_contacts – Contains a person’s data coming from a single account type and account name.
    1. The column deleted will be 0 for non-deleted contacts and 1 for deleted contacts.
      android mobile forensics

      TELEPHONY Location: data\com.android.providers.telephony\databases

DB FILE: TELEPHONY.DB

  1. Table: siminfo – Contains sims which have been inserted

DB FILE: MMSSMS.DB

  1. Table: siminfo – Contains service provider, messages, phone numbers and roaming status
  2. Table: accounts – Contains which all accounts are created – Lcal phone acc., SIM acc., Google, Whatsapp, Viber etc
    android mobile forensics
  3. Table: canonical_addresses – Contains all numbers through which SMS contact took place
    android phone forensics
  4. Table: sms – Contains phone number, size timestamp, message body, service center etc.
    img25

BLUETOOTH

Location: data\com.android.bluetooth\databases

DB FILE: SHARE.DB

  1. Table: btopp – Contains information about Bluetooth transfer
    • Column uri shows the URI of the transferred files
    • Column hint shows the name of the file transferred
    • Column _data shows the location of the received file stored
    • Column direction says whether the file is sent/received and it has 2 values – 0 and 1:
      • Value 0 – Sent
      • Value 1 – Received
    • Column destination shows MAC address of Bluetooth device connected
      android phone forensics

WIFI

Location: \data\misc\bluetooth

FILE NAME: DYNAMIC_AUTO_PAIRING.CONF

The dynamic_auto_pairing.conf file contains basic information about the phone and required details about the WiFi networks which are connected. WiFi details includes:

1. SSID name 2. PSK in plain text 3. Connection/ encryption type 4. Connection priority

Leave a Reply

Your email address will not be published. Required fields are marked *