Conception of a Master Course for IT and Media Forensics Part II: Android Forensics

Transcription

1 Conception of a Master Course for IT and Media Forensics Part II: Android Forensics Knut Bellin Brandenburg University of Applied Sciences Department of Informatics and Media Magdeburger Straße 50, D Brandenburg, Germany bellin@fh-brandenburg.de Reiner Creutzburg Brandenburg University of Applied Sciences Department of Informatics and Media Magdeburger Straße 50, D Brandenburg, Germany creutzburg@fh-brandenburg.de Abstract The growth of Android in the mobile sector and the interest to investigate these devices from a forensic point of view has rapidly increased. Many companies have security problems with mobile devices in their own IT infrastructure. To respond to these incidents, it is important to have professional trained staff. Furthermore, it is necessary to further train their existing employees in the practical applications of mobile forensics owing to the fact that a lot of companies are trusted with very sensitive data. Inspired by these facts, this paper addresses training approaches and practical exercises to investigate Android mobile devices. Keywords- mobile forensics, mobile forensic training, mobile forensic education, Android forensics, small scale digital device forensics I. INTRODUCTION The technique of computer forensics is used for the purposes of investigation into single computers, networks and mobile devices; there are two main methods for such investigations - Post Mortem and Live analysis. The post-mortem analysis is used for investigations after a computer is switched off, however should the computer still be switched on, a live analysis may be performed. In the field of forensic examination of mobile devices, an accurate distinction of post-mortem and live analysis is not always easily possible as most mobile phone manufacturers use in-house developed hardware and many different operating systems. The most common platforms in the mobile phone world are Windows Mobile, Apple ios and Google Android and from a forensic point of view, it is very difficult to use a unified analysis method, especially in the creation of a forensic disk image, owing to the many different platforms that are currently used e.g. Android and it is currently not possible to create an image without changing the output medium. The forensic analysis of network traffic can often only be performed in a live system and ideally, the attacker is still in the system and information can be collected in real time. II. WORKPLACE, SOFTWARE AND HARDWARE The Brandenburg University of Applied Sciences established a well-equipped forensics lab, opened in 2010, for the purposes of mobile traineeships in which a huge range of hardware and software can be used: Oxygen Forensic Suite 2013, Belkasoft, viaextract, EnCase Smartphone Examiner and wide selection of freeware tools. All forensic tasks are matched to these programs, including specific tasks which can be realized with the functions of the programs; the exercises containing specific questions aimed at a comparison of the presented software. The hardware facilities include 10 quad-core Workstations, many varieties of Android devices (Figure 1), at least 20 test drives, additional smartphones and tablets such as iphone 5, ipads and write blockers are available and used regularly for forensic practice.

2 Figure 1. Android devices III. EXERCISE The Android forensics traineeship includes more than 6 selected exercises which address the forensic examination of mobile phones. The exercises include the correct connecting and read-out of an Android phone, the detailed study of individual types of Android phones and a special viewing of forensically interesting differences - such as the analysis of rooted and nonrooted Android Phones [8]. In the University s forensics laboratory traineeships and further training in the fields of computer and small scale digital device forensics, media, networking, mobile, CD, DVD and live forensics are carried out. Contained within the presented training concept, more than 20 exercises have been created, two of those forensic exercises are briefly introduced below. All previously created exercises are summarized in Table 1. Topic TABLE I. Number of exercises LIST OF ALL PREVIOUSLY CREATED EXERCISES Content and tasks of exercises Computer forensics 10 creating a forensic disk image, integrating a forensic duplicate and search for deleted data, extracting Slack Space, analysis, Windows 7 Registry, passwordanalysis of Office files, and Windows 7 Live forensics 3 assurance of volatile information, create dumps of RAM, investigation of a RAM dump

3 Mobile forensics 6 Android forensics: analyze user data and extract, analyze and evaluate android phones by Oxygen Forensic Suite and viaextract (pictures, clients, geo-data, etc.), differences between root and unroot devices, location of interesting forensic data Network forensics 6 analysis of a Web application, SQL injection, creating a network dump, investigation of a network dump, social networks, IPFire CD and DVD forensics 1 forensic analysis of CD, DVD and Blu-ray Linux forensics 5 Autopsy as a forensic browser, creating a forensic disk image, integrating a forensic duplicate and search for deleted data, extracting Slack Space Android Forensics Exercise 1 Detailed forensic analysis of a android mobile phone After connecting to a device and collecting the data, which are of forensic importance, a detailed analysis of the obtained data is performed. For the purpose of the exercise, the following scenario is outlined: Several android mobile phones were secured and in order to prevent data loss, e.g. by a depleted battery, it its imperative that the devices be seized and the data stored directly in Oxygen as an image. At a later point these stored images may be analyzed by the investigators in the forensics laboratory for suspicious information. Tasks Create your own project folder and name it according to your family name and your case Start the forensic tool and add a forensic image. Use the forensic software Oxygen Forensic Suite If possible use your own Android smartphone for the extraction of the data. Use forensic provided by Oxygen Forensic that can be found on there website: ( Perform an analysis of the forensic image with the help of Oxygen Forensic Suite Carefully document your analysis and add screenshots. Demonstrate your results to other groups and compare it with your own. Save all the forensically relevant results, screenshots documents and protocols in your project folder. Read the whole task carefully, follow all hints of the instructor and answer all asked questions as detailed as possible. Important Information Make sure that not every group is studying the same forensic image. Exchange ideas with the other groups and distribute the forensic images evenly. For the use of the forensic tool Oxygen Forensic Suite 2013 a USB dongle is needed. Evaluation Which forensic image did you use and why? What data structure will appear after adding the forensic image (is it a system files or is the file system visible)? Carefully document your investigation results using screenshots, i.e. - What information did you find, where did you find it and why in your opinion are these data forensically interesting (use a PC for your documentation). From which two other exercise groups did you get a presentation of results and which forensic image was used? Which image provided the most valuable information that could be extracted and why? Questions and suggestions for improving this exercise: Android Forensics Exercise 2 Differences between rooted and unrooted devices For the examination of an Android smartphone is it very important that the investigators have good knowledge about the Android platform and functions. A forensic investigation focuses on the data recorded, the extraction, the analysis and understanding of these data. It is important to understand how and where the data is stored and what types of data are available. These factors are important to restore and analyze data. Android saves a lot of data that consist of user and system information.

4 The following exercise will give an understanding of the development of Android and shows methods to analyse the data structures. Task Use the tool "adb" from the Android SDK and the software Oxygen Forensic Suite Use if possible your own Android smartphone for the extraction of application data. For the data analyses use the provided Oxygen Forensic Suite Backup "Jeff's Payge Motorola Milestone (354,635,030,161,892). Ofb". Read the complete task, pay attention to the instructions and answer all the questions in as detailed a manner as possible. Turn on the "USB debugging" - function. This is located in Settings under Applications -> Development. Connect your phone via USB to the PC. If the Device Manager in Windows shows an unknown device named "Android" or similar, please install the appropriate driver for the Smartphone. Start the adb - tool from the Android SDK and view all connected Android Devices. Establish a connection to your device. Check your access rights. Try to navigate to the /data/data/com.android.browser folder. Extract the entire contents of the folder. Analyze the extracted SQLite database files and search for interesting forensic information Use the SQLite Database Viewer (Oxygen Forensic Suite 2013). To answer the questions use the provided Oxygen Forensic Image "Jeff Payge's Motorola Milestone (354,635,030,161,892). Ofb". Important Information For all Android devices of the laboratory exist a Google account that can be used. ****@gmail.com Password: **** The forensic tool Oxygen Forensic Suite 2013 requires a USB dongle. Alternatively, use the Oxygen Forensic Suite demo. Accompanying theory For basic theoretical information see [11]. For storing user data, mainly two storage locations are used (external and internal memory), and the external memory is often an SD card or a virtualized SD card. Users or applications can save any data and create any folder structure on the external memory device, there are no special permissions required. The folder structure of the main directory is similar to many other Linux-based systems. Figure 2 shows the structure of the root directory of Android

5 Figure 2. The structure of the root directory of Android If a new application is installed the Android API creates a new folder /Data/Data/. The folder name is derived from the package name of the installed application - For example, if the default Android browser was installed; a folder with the name Com.Android.Browser is created. All data of the application are stored within this folder and in each program folder are some subdirectories that are created automatically by Android or by the developer (see table 2). Name shared_prefs lib files cache databases TABLE II. SUBDIRECTORIES THAT ARE CREATED AUTOMATICALLY BY ANDROID Function saves global settings in the XML format contains libraries needed to run the application files provided by the developer for the internal memory cached files of the application, often including browser cache or cached files of an application that use the WebKit engine SQLite databases of applications Part of the safety concept of Android involves that by default, the data in /data /data/<package name>/subfolder is only read by the application itself. Either the other programs do not have access to the folder or the developer has defined additional access rights. Without root access, it is also not possible for the forensic investigator to read out the content of the application folder and typically, the user has no root rights in most Android devices. Should an investigator require root access to the device, they must find the right method for every different model. There are many methods to achieve this goal. A practical method is to overwrite the original recovery image with an alternative one to get access to the whole file system.

6 For the forensic investigator to gain root access, it is important to know what kind of files are of interest in the Android system. Android saves a lot of data in SQLite databases and these files are very important from a forensic point of view as SQLite databases are a good source of forensically interesting data, if an Android App creates a SQLite database it is stored in the /data/data/<package name>/databases folder. In 5 different folders many different database files of the browser can be found: app_icons: 1 database with websites icons app_cache: 1 database with internet-cache data app_geolocation: 2 databases with GPS positions and access rights app_databases: 21 databases to store webpages locally databases: 3 databases with data from the browser cache To analyze a SQLite database there are a lot of viewer applications, for example the SQLite Viewer from the cell phone forensics software Oxygen Forensic Suite ADB The command-line application adb (Android debug bridge) is a part of the Android SDK and it is a very useful tool for a forensic investigation. With the adb tool it is possible to install/uninstall apps, evaluate logfiles, transmit debug information, transfer files and run a command line on the device, however in order to run the adb tool on the Android device the "usbdebugging" option must be enabled [10]. Useful adb commands are: adb devices: listing of all connected android smartphones adb push or adb pull: transfer of files between PC and smartphone adb shell: execution of a command line on the android smartphone adb install <path_to_apk>: installing an application adb logcat: output of logging information adb kill-server: exit of the pc-daemon For more information about adb tool see Another useful tool of the Android SDK is the "Dalvik debug monitor". With this tool much of the system information can be reviewed and analyzed from the device. The tool allows the examiner to: list the processes output of logging information indicate memory usage / CPU usage display of used threads and processes perform screenshots view the file explorer The tool is located in the "tools" subfolder of the Android SDK. The figure 3 shows the usage of the Dalvik debug monitor [11].

7 Figure 3. Dalvik debug monitor [11] Evaluation Which smartphone do you use and which version of Android is installed? Do you have access to the directory data/data/com.android.browser and could you extract the data to your PC? If not, why not? In total, how many databases are on the device and how many in particular did you find in the application folder of the default Internet browser? Identify and name the database files that are stored in the folder of the Internet browser. What forensically interesting data are included in the databases? Name at least 6 database files and 8 forensically interesting information items. How does the structure of deleted rows of data look like in SQLite databases? Which websites should record the location of the device? Name the five most visited websites of the browsers.db and the number of their views. What information can be extracted from the webview.db? What information is especially interesting? IV. USABILITY The following chapter demonstrates that the exercises can be implemented and are practically feasible. For this purpose, they have been included in the Master Course on IT and Media Forensics at the Brandenburg University of Applied Sciences, Germany. For detailed information please see the part I of this series of papers. Procedure of the usability test The Android forensics exercises were evaluated as a part of the whole forensics training lesson. For the test phase 18 exercises were used and 20 students of the Master of Science study program performed the tasks. For the evaluation of the

8 tasks, a single evaluation form was used. This questionnaire contained eight questions had to be answered by each participant who performed the exercises. The questionnaire contained the following questions: Did the exercises help you to better understand the complex topic of IT forensics? How do you evaluate the workload and time expenses of the exercises? How did you like the practical part of the exercises? How difficult did, you find the exercises. How difficult did, you find the tasks of the exercises. How complex (in your opinion) were the questions? Was the accompanying theory sufficient? How big was the learning experience through the practical exercises according to the topic? Results The results of the form and the additional questions and suggestions that were handed over to the instructor during the exercises displayed the main component of the evaluation. The information was evaluated and compiled by the instructor. The results of the analysis and evaluation of the Android exercises are summarized in table 3.. TABLE III. THE RESULTS OF THE ANALYSIS AND EVALUATION OF THE QUESTIONNAIRES 1.) Did the exercises help you to better understand the complex topic of Android forensics? Answer very good 6 good 14 sufficient 0 no 0 2.) How do you evaluate the workload and time expenses of the exercises? Answer appropriate 16 too high 4 too low 0 not available 0 3.) How did you like the practical part of the exercises? Answer very much 0 exactly right 18 superfluous 2 not available 0 4.) How difficult did you find the exercises? Answer too difficult 4 exactly right 15 superfluous 1 not available 0

9 5.) How difficult did you find the tasks of the exercises? Answer too complex 1 exactly right 15 superfluous 4 not available 0 6.) How complex (in your opinion) were the questions? Answer very high 4 high 14 appropriate 2 too high 0 7.) Was the accompanying theory enough? Answer yes 13 no 2 too few 3 too much 2 8.) How big was the learning experience through the practical exercises according to the topic? Answer very high 2 high 17 low 1 very low 0 Suggestions for improvement The participants - as well as the instructor - learned how to improve the exercises. The main areas found in need of improvement were: Deficiencies found in the understanding of the tasks, caused by an ambiguous expression. A solution is suggested into that it may be useful to give some instructions for greater clarification in the extent and precision of the answers. Also the very different hardware of the Android devices was found to be a problem. For many students it was very difficult to connect the Android devices to the computer or the forensic software as the correct driver for the device was often not automatically found by the operating system. Drivers often had to be installed manually. V. CONCLUSION Android forensics plays nowadays an important role in the wide field of IT forensics. In order to analyze all forensically interesting data of an Android smartphone, it is necessary to revise the standardized forensic procedures, as both the hardware and software of Android phones are often very complex and difficult to understand. Within an investigation and in the implementation of the exercises, it is also important to know the exact type of the device, because the missing Android drivers are causing the most problems and errors in the investigation. For that reason the preparation costs are high, however the learning curve is also very high. Investigators can greatly enhance their knowledge and can cover a wide range of smartphone forensics.

10 The theme "Creating courses in the field of IT forensics" offers many possibilities. Already, the request is steadily increasing for qualified and well-trained IT forensic professionals. And it can be forecasted that - especially in Germany - this trend will continue over the next few years. Additionally, the very rapid development in the area of IT and mobile devices makes it continuously necessary for a forensic researcher to constantly enlarge upon specific topics and to learn new techniques. For detailed information please see the part I of this series of papers. REFERENCES [1] Overill, R.: Development of masters modules in computer forensics and cybercrime for computer science and forensic science students. In: Electronic Security Forensics Vol. 2, No. 2, 2009 [2] Stephens, P.: Should Training Be Part Of An Educational Computer Forensics Program? Report, Canterbury Christ Church University [3] Mink, M.; F. Beek: Wie lehrt man IT-Sicherheit am Besten? Eine empirische Studie Universität Mannheim [4] Breeuwsma, M.; M. Jongh; C. Klaver; R. Knijff; M. Roeloffs: Forensic Data Recovery from Flash Memory. In: Small Scale Digital Device Forensics Journal, Vol. 1, No. 1, June 2007 [5] Nelson, J.: Guide to Computer Forensics and Investigations. Cengage Learning Services, 2009 [6] Luttenberger, S.; K. Kröger; R. Creutzburg: Examination of mobile phones in a university forensic lab environment. In: Proc. SPIE 8063 (2011), 80630Q, DOI: / , (last access December 21, 2012), (Last access December 24, 2012) [7] Jansen, W.: Forensic Software Tools for Cell Phone - Subscriber Identity Modules. In: Technical Report CISE-CSE [8] Geschonnek, A.: Computer Forensik - Computerstraftaten erkennen, ermitteln, aufklären. 4th Edition, dpunkt-verlag, [9] Hoog, A.: Android Forensics. Syngress, [10] Android Developers, Android Developers - Tools, [Online]. Available: [ ]. (Last access December 21, 2012)