ZENA FORENSICS

During the forensic examination of a smartphone, we sometimes need to understand some basic settings of the device. Some simple examples are: What is the name of the device? Is the "Set time automatically" option on or off? Is the "Set time zone automatically" option on or off? Is mobile data switched on or off? Is mobile data roaming switched on or off? On Android devices, most of these settings are managed centrally by the Android settings provider.  The source code is available here . This topic is covered in a blog post by Yoghes Khatri who explores a way to extract and analyze Android settings using an Android Backup created with the "keyvalue" option. In this blog post, I'd like to expand the discussion a bit, by exploring: How can these settings be extracted? What information is potentially more relevant for a forensic investigation? Android Settings extraction There are basically 3 ways to extract the Android settings, depending on your case: ...

A common question during a forensic investigation of a digital device is: " Has the user ever used the XYZ application? ". As always when answering this question, it is important to create and follow a solid process. In this blog post, I want to share a possible process that everyone should customize based on their needs and roles. The ability to answer the question depends on the acquisition that was obtained from the device. In this blog post, I will address the scenario where you have a full file system acquisition (or physical, for older devices). Check whether the XYZ application is installed First, check whether the XYZ application is still installed on the device at the time of the acquisition . On an iOS device, there are several easy ways to check this. To name just a few of the most common: Check if the XYZ bundle is available under \private\var\containers\Bundle\Application\<GUID> Check whether the XYZ App Sandbox folder is available under \private\var\mobile...