Hello and welcome back to our official circus series.
This is the forensics using Kelly Lennox section.
We're going to talk about mobile device forensics.
We're getting into why forensics are important and a lot of the tools that Kelly comes built with.
Ah, for forensics though they can be used for other things as well.
There are many command line tools available to us and we'll get into all that and.
This is our outline or table of contents.
So many of the tutorials on Android forensics are kind of dated, so just because a tool is here today,
it may be gone tomorrow.
So just be aware of that.
It's not that there's anything wrong with all of that, but sometimes the tools don't get updated.
And there are there are several commercial industry standard tools, but those are not the subject of
the discussion today.
So why?
For mobile forensics?
Well, mobile devices in criminal investigations and similar activities has been present for many years.
The forensic methods study in mobile devices is relatively new, based back to the early 2000, but
many of the same ideas that police and law enforcement used to find information out on people that would
be doing nefarious activities can be gleaned from mobile devices.
So I want to talk about some of the different things, the data points and information you can get from
mobile devices.
And how to extract that.
This is our chapter flow.
Keep in mind, this is a generic chapter flow.
There will be a few more things here than just this, but we will talk about the Android Debug Bridge.
We will look at a few other tools like Autopsy and iOS analyzer.
We'll look at Android Studio, look at the DEDI Tool.
So let's talk about a few things now.
What kind of information can you get from a mobile device?
That's important to understand.
Before you get into forensics in general, so you can get not only subscriber information, you can
get IMEI numbers, which is the international mobile equipment identifier.
That number can essentially allow you to access many other things.
It allows you to a uniquely identify that device on the network.
Many times you have to give your cell phone provider and IMEI number.
For example, on Samsung phones, you can get the IMEI number by typing star LB zero £6.
So what?
What else can you get?
You can get.
Date time, information.
You can get into.
Settings you could mess with the person's files, their phone book, their contact information, their
calendar.
See where they might be going.
Try and build a profile of if you're doing a forensic acquisition of this and you're going to be trying
to recreate who might have gained access to the device.
And mobile operating systems are becoming more complex and being more and more advanced and like computers.
And they're largely in many cases, replacing traditional computing systems.
We now have Chromebooks that run Android apps.
We have even the ability to hook an Android phone into a docking station and have it essentially function
like a computer.
The computer also has incoming and outgoing text messages, call logs, missed calls, email your photos,
your Facebook, your Google photos, your iCloud, any recordings you might have made.
Of course.
Multimedia messages.
Instant messaging, web browsing activities.
Location information where you went.
Also geolocation data.
When you take pictures with your phone, unless you explicitly turn it off, it tags your location.
Cell phones can be a treasure trove of information.
Mobile devices tend to require specialized tools to extract the data.
Although Kelly Lennox does have a lot of those tools for working with mobile devices.
There are many other specialized tools in the market which can be utilized as well.
So let's talk briefly about a case study where mobile devices were one of the major focuses, those
that have not been following the news recently.
We have a technical report from the Dark Carousel campaign, one of the larger cyberespionage campaigns
to date.
And this report contains details on more than 90 indicators of compromise, including 11 different Android
malware.
26 desktop malware across Windows, Mac, Linux, as well as domain based indicators of compromise,
also some social engineering and many other things.
So we just briefly look at this cyber espionage of a global scale report and some of the key findings.
And you can scroll down and you can see some of the different data that was obtained, not only on domains,
email addresses, but look at the exfiltrated data, the call information, SMS information, call records,
contacts, installed applications.
Corporate information messaging apps, WhatsApp, Telegram, Skype.
So not only were they able to hide their evidence, over almost 60% of the 81 gigabytes of data they
extracted came from mobile devices.
That's an astonishing amount of data.
And if you look at the countries that this occurred in, so so it's an important to understand that.
Mobile device.
Forensics is here to stay and it's going to be here for a very long time.
So let's talk about digital forensics and the terms of Callie Lennox.
Kellie Lennox provides a live forensic mode so you can boot into essentially a live operating system.
This was introduced around the time when Kelly had just evolved out of Backtrack Lennox.
Kelly Lennox is widely available.
Many users already can download Kelly or have bootable thumb drives, so forensics is just one component
of Kelly Lennox.
And it's easy to make it convenient, actually a popular tool for forensics as well.
If you don't have any other commercial tools, it's a great option to start with.
So let's talk about the Android Debug Bridge.
But before we do that, we need to understand what it is.
Well, why we're starting with Android.
Because of the open nature of Android.
Android is a very versatile platform and then it's designed to be more open.
It's easier to root to gain administrative access to them.
So definitely spend some time with the forensic section.
It's definitely worth your time.
And it's a big part of becoming a certified pen tester because if you can't pick up the what actually
occurred, then it's a very difficult road to hoe.
So why don't you make a copy and you copy your drive?
Then you're going to want to look for.
Making a copy.
Of course, there are tools, forensic, duplicate, or things you can buy that will make your job a
little bit easier.
But Kelly, Linux has a lot of tools built in with it.
A lot of command line to some of the gooey tools.
So in summary, we talked about how we on this live distro, whether the virtual distro makes it quick
and easy to put Kelly right on the job.
It has a lot of the most popular forensic tools.
We looked at the Android Debug Bridge and being able to communicate with the device we looked at and
there were different ways you can push and pull things from the device, how you can install applications.
You get a very robust Unix shell with which you can run commands.
When you start the client.
It checks if there's a server that's already running.
If there is not, it starts the server process.
The iPhone analyzer allows you to forensically examine or recover data from the iOS device without modifying
it.
We also looked at the DV tool and the CFD tool.
So now let's do some practice questions.
What are the components of ADB?
A client?
A Daimon?
A server.
A client.
A server and firewall.
A client.
A firewall and a daimon.
Or a demon, a server and a firewall.
Correct answer is.
A client, a daimon and a server.
Number two.
What local port does the ADB or the Android debug bridge server bind to?
Is it a 5050?
The 80.
C four, four, three or D 5037.
The answer is D 5037.
I number three.
What does the 80 B command to list the devices attached a TV ADB devices dash l c adb dev or d adb dash
h.
Answer is b a d.
B.
Devices dash l.
Let's look at number four.
What is the command to install an app file on the device attached?
ADB Kill apk.
ADB Shell apk.
ADB Install apk or adb apk.
Answer a c adb install apk.
So number five, what is the command that's used for backing up of an Android device?
Is it a ADB backup apk that shared dash all dash f me adb backup and then the file name.
See ADB backup.
Or D none of the above.
The answer is a.
So we spoke briefly about forensics because forensics and mobile devices are linked.
And because of the open nature of Android, it's easier to work with forensic tools on Android that
there are some tools that work for both Android and iOS.
And these are some of the different summary of what we talked about.
So we talked about.
Different forensics tools.
We talked about the Android Debug Bridge.
There's some of the tools, the DV command.
We looked at how to imaging how to image a disk.
These are some of the different acronyms we looked at.
And I want to briefly show a couple of other tools that are out there before we conclude this module.
So there's a couple of tools from a company called Now Secure.
One of these is called Friday, Friday.
It's a dynamic instrumentation tool kit for developers, reverse engineers and security researchers.
You can actually install it in Kali.
It's pretty easy to do.
Either stupid or you have to be rude to install Freida as tools.
And it's important to have some kind of a reverse engineering tool kit.
At your disposal.
There's a lot out there, especially with forensics.
If you're potentially get a piece of malware or something you need to analyze, it'll be important that
you understand how to work with that.
So Friday, it takes a little bit of time to install, but the nice thing about it is that it is a very
robust tool at that script table.
It works on multiple operating systems.
It's completely free software, and it allows for deep analysis of mobile apps at scale.
So once it's installed.
So you can load in files, you can load in scripts, you can connect to USB devices, connect to remote
servers.
It's very, very powerful.
And we'll probably look at this tool in future iterations.
There's one other tool called Raid Array,
and it's not necessarily install it by calling it by default.
It's a portable rehearsing framework.
That can disassemble for many different platforms.
If you want to.
They've changed the name to Arcon.
If you want to run it on Linux.
You can you can also try it in the cloud.
You'll have to do it via source code.
You have to compile it.
There's the different builds for whether you're building from source or whether you're building on Android.
So you'll just clone the GitHub repository for this tool.
And we'll clone it.
And I'll take a little while.
Once you're done, then you'll run the installer script and then you'll have a portable reverse engineering
framework at your disposal.
It has many different meanings.
There's even a version that combines Freida with it.
So I hope you enjoyed this series.
Appreciate your time and we'll see you guys in the next course.
Thank you.