Hey everyone welcome to analysis of an android image with autopsy.
Previously we learned how to analyze a Windows image.
Use an autopsy.
For now we're going to take a look at how to extract and analyze artifacts from an Android device.
Image use an autopsy Android analyzer module.
It's one of the new features introduced with V for will introduce the Android analyzer module.
Then show a practical example of using it to analyze an android image Kelly Linux does it come with
tools designed to forensically analyze mobile devices and Android devices in particular autopsy since
v3 provides a valuable feature.
That is the capability of extracting and analyzing artifacts from an android image implemented by the
Android analyzer module.
This module works on physical Dubbs for most Android devices but does not support older devices that
do not have a volume system.
This video we're going to show the module in action we assume have an autopsy for already running on
a Windows VM this time instead of opening a new case will open an existing one of a suspect Android
device image that's already been analyzed.
If we open a new case instead we would ensure to enable Android analyzer in the in just modules configuration
window.
The module has no per run settings.
The results of the analysis are displayed as usual under the tree viewer.
The data source is subtree reports all the partitions identified on the device.
We could select a partition and browse through it.
Inspecting directories and Biles
undervalues deleted files.
We could view all the deleted files recovered by the photo read Carver module the results extracted
contents subtree.
Besides the Internet artifacts and X of meta data like we've already seen in the last video with the
Windows image show specific Android artifacts like call logs contacts and messages.
Android stores these data in sequel databases for example if we take a look at the call logs we could
see the table with the list of calls and the relative info we could choose which columns to display
in a list.
This case I've hidden the phone numbers and names for privacy issues.
The call logs or contacts are stored in the contacts to get DB sequel like database file.
We can also extract these files by right clicking on it then clicking on extract files.
Save it open it later with a sequel light viewer to execute queries on it.
If you right click on contacts to date DBI file we can also see its location on the device file system
by clicking on view source file in directory.
It takes a while to complete the execution
this case.
We could see that the database is located here at data Comcare Android providers contacts databases.
The message is so Tree displays a list of messages outgoing or incoming the message type the date and
time zone.
Even in this case the names of phone numbers are hidden.
The database for the messages is and SS and s not D.B we can see its location by right clicking on it
and selecting view source file in directory
this case we can see the location is data com.
Android providers telephony databases telephony databases as we seen in the previous video.
We can analyze the Android image in the same way as we've analyzed the Windows image.
For example for searching for specific files and keywords and viewing and examining the timeline of
the events for searching for specific files and keywords viewing and examining the timeline of the events.
Great work in this video we've come to the end of the section we've introduced autopsy and the new features
that come with before.
We also covered how to install this version on a Windows VM and show two practical examples of how to
extract and analyze artifacts from a Windows and Android images from windows and Android image.
Autopsy 4 is a really valuable tool that allows to easily analyze forensic images.
Also local disks.
Next section we're going to cover the techniques and tools to acquire and analyze RAM memory.