First steps in incident response related to Android Based Devices

Abstract

Digital Forensics as a science is the process of acquiring, preserving, analyzing, and reporting of raw data residing in electronic or digital devices using scientific methods that are demonstrably reliable, verifiable and repeatable, such that they may be used in judicial and other format proceedings (SWGDE, 2014). One of the most particular circumstances that digital forensics must be applied is during the handling of a security incident where the operations of the first responders are extremely important and critical and a mistake is usually irreversible. Mobile devices are in fact a computer in small form, equipped with high performance processor, huge storage, and enhanced functionality. They have become an essential part of the owner’s live since they have drastically revolutionized the way that everyday activities (e.g., connecting with other people, e-banking) are achieved. As a result, a mobile device is now a huge repository that holds sensitive and personal information about its owner. A huge percentage of these personal and sensitive information is originated from social media and instant messaging applications like Viber, WhatsApp, and Telegram. In 2021, the number of mobile devices operating worldwide stood at almost 15 billion and their number is expected to reach 18.22 billion by 2025 (O’ Dea S., 2021). The huge proliferation of mobile devices and the social media and instant messaging applications have also shaped modern crime. Almost in every form of crime, bad actors make use of these technologies for planning and operating. This has, in turn, led to the development of a branch of digital forensics solely dedicated to mobile devices. Mobile forensics have unique characteristics and peculiarities since some of the core principles of other digital forensics do not apply like data preservation. Data inside a mobile device is continuously modified and the standard write protection techniques cannot be applied. For that reason, the actions of a first responder / examiner have even greater impact in the event of handling a mobile device as evidence. The content of this Thesis is divided into four distinct parts. The first part introduces the concepts of digital criminology when dealing with a security incident, as well as basic concepts related to the forensic examination of a mobile phone device with Android operating system installed. The structure and basic elements of the SQLite database, on which most of the applications on such a device are based, are then analyzed. In addition, well-known and widespread forensic and non-forensic tools and software used to examine both Android devices and databases (SQLite) are presented. The second part presents suggested methods for obtaining administrative rights on two devices of different manufacturer (LG, Samsung) and different operating system version (Android 9 and Android 11), to create forensic copies (physical image) and examine them more effectively. In the third part, a description of a hypothetical scenario based on realistic incidents, the structure of the experiments and the followed methodology are given. Furthermore, in this part is explained the selection of the messaging applications Viber, WhatsApp and Telegram used for the experiments. The fourth part presents an analysis of the aforementioned messaging applications’ operation, their examination and finally, the results of the experiments and a comparative analysis among them.