Hi and welcome to video 2.4 Android device imaging with DC 3D in the previous video we looked at how
to image a hard disk with DC 3D in this video we cover another common case that can occur in a digital
investigation.
The imaging of an Android device indeed mobile devices such as smartphones and tablets have become very
common and widespread.
And Android is by far the most used mobile platform in this video we're going to explain how data storage
is organized on Android.
What routing means the use of the Android de-bug bridge the two types of data acquisition logical and
physical and how to practically perform both of them android like other mobile OS as stores data on
two locations the internal flash memory of the device and the external removable micro SD card.
The internal flash memory is the main storage location where the recovery image the kernel and system
apps and data are stored.
The external storage is usually used to mainly store user data like images videos and so on.
But it can also contain user applications.
The internal storage is divided into different partitions.
These are the important ones.
The bootloader partition is where the bootloader is responsible for initializing the device and booting
the kernel resides the boot partition contains the files that are necessary to boot the device and the
kernel while the recovery partition stores the recovery image.
A minimal Android system used for recovery backup and Vered stalling custom Android ROMs the system
partition is where the Android framework and system libraries are stored.
While the data partition contains user application and all related data the data partition is where
the most useful data for forensic investigation are supposed to be found.
Standard users on Android are allowed to access only specific directories of the data partition and
cannot access the other partitions at all to be able to access all the partitions of data on an Android
device.
We must obtain the root permissions root is the super user account analog to that.
On Linux Unix systems and is not a surprise given that Android is derived from Linux.
The procedure that allows the normal user to obtain root privileges on Android is called routing in
order to route a device it's normally necessary to unlock the bootloader because manufacturers generally
lock it to prevent users from tampering with the firmware.
The procedure to unblock and Root a device greatly varies from model to model so we don't cover it here.
A very useful resource for these topics is the a developer forum.
In this video we assume that the device we're going to image is already routed.
Therefore we have full access to its storage to communicate access and control the Android device connected
via a USP port to our forensic workstation.
A precious SEO tool is the android de-bug Bridge which is part of the Android SDK that comes pre-installed
on Kalli Linux HTB has many options and allow us among others to list of ISIS connected to the computer
pull and push files from and to the device execute a shell and install apps on the device.
If we're connecting a running device to the computer the USP debugging feature must be set on for Android
debugging bridge to work to set it on go to settings developer options the imaging of the device should
not be performed when the device is turned on.
Because Android OS and apps modify data when running the most forensically sound method is to boot the
device into recovery mode.
This way if the device screen is locked we cannot enable us be debugging.
We can work around this issue and use Adeeb be the same.
We have to previously install a custom recovery as 80 does not work with stock recovery images.
When booted into recovery mode the partitions must be mounted to access them and we could do it selecting
the appropriate entries in the menu with the hardware buttons.
Basically there are two ways of acquiring data from a mobile device logically and physically.
The logical acquisition involves the copy of all or specific files and directories at the file system
level as we do as we would do when making a backup.
The other side.
Physical acquisition involves copying the device storage bit by bit at a raw level as we've already
seen in the previous video with imaging the hard drive.
Now we're going to see how to perform both types of acquisition.
First step is to connect the device to a USP port of our forensic workstation then boot the device into
recovery mode to communicate and execute commands on the device we use.
As I said before the Android debugging bridge to check at the device is recognised.
We run the devices in a terminal the output should look like this.
A device ID and the state as recovery to spot a shell on the device we execute the command Adeeb shell
if the device is rooted.
The shell should appear with the symbol hash.
Since we have root privileges we can list all the directories on the list with the last dash L command.
We could list for example the contents of the data data directory
data slash data directory that stores all the apps data like databases settings and so on.
Each app in the relative directory suppose that we're only interested in the directory for investigators.
We'd like to copy it to our computer.
We cannot execute the copy command in the shell because it only works internally on the device storage
so we exit the shell with the exit command returning to the one on a workstation to copy the data slushed
data we have to use the Adeeb pool where the option shows the copy progress and the last parameter is
the local directory
on the workstation where we want to copy the data
if we want to copy all the directory tree of the device we would type slash instead of slash data slash
data.
For more information on how a D-B works and its options please refer to the official Adeeb user guide.
The limit of logical acquisition is that it misses unallocated and slacke storage spaces.
So we would not be able to recover deleted files to obtain a full dump of all or some partitions we
have to perform a physical acquisition physical imaging involves acquiring both removable micro SD card
and the internal memory to image the micro sd.
We must remove it from the device and connect to the workstation using a hardware right blocking device
or software right blocking techniques.
Then we image it with DC 3D in the same way as we've seen in the previous video with the hard drive
imaging the internal storage is trickier as we have to copy and execute DC 3D directly on the device.
Of course it could not be the standard PC comp. DC 3D.
We have to look for a version compiled for the ARMM architecture.
This is available among other tools at this page.
We click on download and save the file in the current working directory.
We should not copy it on the internal storage because it would modify and corrupt possible evidence.
Instead we could insert a clean micro SD card and copy the binary file on it.
In our case when we melt the SD card in the recovery menu we see that it's mounted under the storage
slash SD card one directory so we execute the command.
Be pushed DC 3 D flash storage flash SD card one
the output shows the transfer rate and the bytes copied.
Now we spawn a shell on the device with HDB shell.
We have to identify the input for DC 3D to image remembered that DC 3D does not except directories as
input but block device files on Android these device files are associated with partitions to list block
device files.
We run LS slashed Deb slash block slash command the eternal flash memory is usually associated with
the NMC B-L case zero device file and all the files with this name followed by P and a number represents
its partitions to image the entire internal memory.
We move into the storage slash SD card one directory and execute DC 3 DD before doing so we must remount
the SD card to run DC 3D as by default Android mounts SD cards with the no exec option.
It does not allow to run applications on the SD card itself.
So we run the following command.
Then we execute
in some cases we might only be interested in imaging specific partitions like for example the data partition
to see which partition corresponds to which device we give a look to the slash proc slash Maltz file
as we note the data partition is associated with this device file.
So if we only want to image this partition we would run the same command as before
but with a different input file specifying the one device file associated with will be a partition
great.
So we're at the end of this video where we covered the organization of storage and partitions on Android
devices.
We introduced the concept of routing and the tool and finally explain the difference between logical
and physical data acquisition and how to practically execute them in the next video image acquisition
with Guy Maigre.
We're going to cover a GeoEye program to acquire forensic image that is Guy Magar.