The Importance of Mobile Forensic Analysis

While mobile devices have become a necessity for everyone, smartphones are the most used devices in our daily lives. There are many operating systems used by smartphones and one of these systems is the iOS. These phones are widely used in many fields such as making calls, email, communication through social media, and payment and purchase through the Internet (Kuittinen, 2013). Mobile forensics is a branch of science that is concerned with retrieving digital evidence from mobile devices using reliable and appropriate forensic tools (Riadi, Umar, & Firdonsyah, 2017). Because of the increasing demand for smartphone-based services and the increasing number of its users, mobile forensic science has become a necessity because of the proliferation of services, facilities for users, and the spread of the Internet of things technology that requires a device connection; there is also a popular tendency for people to use mobile phone transactions during their daily dealings (Al-Dhaqm, Razak, Ikuesan, Kebande, & Siddique, 2020).

Mobile forensics is the science of obtaining evidence from portable devices under forensically sound conditions utilizing acknowledged strategies, while mobile device forensics is a branch of digital forensics that entails gathering evidence from mobile devices under forensically sound conditions. Preservation, acquisition, examination, analysis, and reporting are the five phases of mobile forensics. Seizing and safeguarding suspect mobile devices without affecting the contents of stored data is preservation. The term “acquisition” refers to the process of recovering data from a computer. The term “cloud computing” refers to “the application of digital forensic science in cloud computing environments.”

Recent years have revealed the generation of behavior and exploitation of modern crimes through the Internet that was not known before, which led to these crimes threatening the security and safety of individuals and institutions; with the increasing use of the Internet in ecommerce operations, the types of these attacks and threats will increase, which prompted us to acknowledge the existence of this type of crime and be alerted to its seriousness and the need to take a strict stance to fight it and find appropriate solutions to it.

During this case study, we will focus mainly on iOS, which is one of the worldwide operating systems; we will use an iPhone 8 (A1905) device as a sample for one of the types of devices that use the Apple file system, and we will do an acquisition for this device. The acquisition passes through several promising stages. Through this research, we will learn about the most important challenges that we face while extracting and restoring files for Apple devices in general and for iPhone 8 devices in particular.

Understanding Mobile Forensics

Mobile forensics is defined as the science of obtaining and handling digital evidence from portable devices by use of techniques similar to digital forensic investigations. Mobile device models, depending on where the storage is located so that it can be stored on the internal or external memory card, and the phone memory may be volatile or nonvolatile.

Digital forensics can be defined as an applied and practical use of reliable and proven methods for digital devices, and this action has been done in several ways, the most important of which are verification, identification, analysis, and interpretation; then, the digital evidence that has been derived from digital data is presented. It is the reconstruction of the events that show the crime or that help in the anticipation of unauthorized procedures. With the ever-increasing popularity of smartphones and people’s reliance on instant messages in their everyday lives, quick updates of instant messages increase the features of the application and entice users to continue using their product. On the other hand, the majority of these characteristics will provide a significant challenge to digital forensic practitioners and specialists. Many studies have been done to acquire data from older versions of the WhatsApp apps. Many security measures arose with the introduction of new versions of WhatsApp, making it difficult for mobile forensic practitioners to gather information and evidence that live in internal storage.

Digital Investigation Process

Obtaining digital forensics data from mobile devices must include the use of the two main technologies, mainly logical acquisition and physical acquisition, and each of these features has its advantages (Anwar & Riadi, 2017); taking a logical copy of the device may not need to root the device, and it can give us the virtual files of the stored data on the memory, while the physical version (bit by bit) needs to root the device and may cause problems on mobile devices.

To pursue and achieve the goal in this practical case, we will conduct a forensic investigation into the iPhone, and we will also assume a scenario to simulate the case and apply all the mobile forensic stages. In terms of seizing, acquisition, extracting, analyzing, we will finally write the report on this phone.

We’ll assume a scenario in which there is a drug dealer, where this person takes pictures of narcotic substances and sends the drug pictures to his friends, along with audio recordings to tell them the prices through social networking sites, and then deletes these pictures and recordings from his phone and social media sites.

The digital forensic officer must take all safety measures for the seized phone to preserve the data and follow the official and legal procedures to check the phone without destroying the data and to present their final report to the court.

In 2006, NIST recommended a process that goes through four steps for conducting digital forensics, as shown in Figure 1-1:

1. 1.

   Collection - Identify, acquire, and protect the data collected at the crime scene.

    
2. 2.

   Examination - Process the collected data/evidence and extract relevant information.

    
3. 3.

   Analysis - Analyze the extracted information to connect the dots and be able to build a robust and admissible case.

    
4. 4.

   Reporting - Present the findings of the analysis stage into an admissible and understandable format.

    

Prepare for Acquisition

The acquisition is imaging the mobile device or else getting evidential information from it or its related media; examination starts with identifying the seized mobile device. Learning the device model and hardware characteristics helps determine the method of acquisition and forensic toolkit choices. This will be discussed in the next subsections for Android and iOS devices.

Mobile forensics is a wide field that aims to extract digital evidence from mobile devices running different operating systems. All the previous stages are within the digital investigation process, as the nature of the seized material determines what the digital investigator focuses on, establishes hypotheses about what happened, and verifies any information that proves or clarifies the case. As digital investigators, we always assume that any digital device may contain the required digital evidence, so it is important to adhere to these stages to protect and save all seizures.

Figure 1-2 shows the most common types of mobile phones in terms of operating systems, and the most devices used in the smartphone’s world. It also shows the most widespread tools in mobile digital forensics.

In the next section, we extracted data from the Apple iPhone using various tools, where we jailbreak an iPhone 8 and display the images including the results obtained through the use of different tools.

The Identification Phase

The Collection Phase

The collection phase includes a description of the device details that we use in our practical case; Table 1-1 shows that we use a set of tools such as iTunes, iBackup, and iExplorer as described in the next section, but the main tool we use is XRY FINALMobile.

XRY is a powerful, intuitive, and efficient software application that runs on the Windows operating system. It lets you securely extract more high-quality data in less time than ever before, while at all times fully maintaining the integrity of the evidence.

Tools Used for Mobile Forensics in Examination Phase

iPhone Acquisition Using XRY

When we connect the iPhone to XRY, the devices are added and verified as shown in Figure 1-3.

Then we choose the action we want (logical) and press “next”; after this stage we can choose if we want to jailbreak the phone to extract the deleted files, or just choose a logical acquisition to read the live mobile files as shown in Figure 1-4.

Now, we can choose what artifacts we want to search because of the privacy of the suspect. Figure 1-5 identifies what artifacts we can choose:

When the acquisition is finished, the XRY asks us if we want to open with the XRY reader or the XAMN reader, and when we choose XAMN (one method), it will display this summary about our case as shown in Figure 1-6 for the extracted artifacts, and also, the recovered files and artifacts as shown Figure 1-7:

Using Belkasoft

Now we went to try the previous steps with the Belkasoft tool trying to extract files and artifacts from the same iPhone (iPhone 8). In the beginning, we tried to choose a full logical backup, but we got the problem shown in Figure 1-8, which is what Belkasoft needs to make a jailbreak for the phone with an external tool.

The same thing happened when we tried to make an Agent backup. Figure 1-9 displays the error that appears with this step:

So, we finally chose the iTunes backup to get the extracted files shown in Figure 1-10.

As we see from the preceding figures, the Belkasoft tool could not recover deleted files from the selected phone, and the tool succeeded only in getting an iTunes acquisition. Figure 1-11 shows the results of the Belkasoft tool.

Using FINALMobile

Now we went to try the previous steps with the FINALMobile tool, trying to extract files and artifacts from the same iPhone (iPhone 8). FINALMobile succeeded in extracting files from the iPhone with logical image acquisition, but it also needed an external tool to jailbreak and get the deleted files, as shown in Figure 1-12 and Figure 1-13.

Figure 1-14 shows the extracted artifacts from FINALMobile that contain the nondeleted files.

Using iTunes Backup

When we connect the phone, iTunes asks us to make the iPhone a trusted one, as shown in Figure 1-15. Then, iTunes starts syncing the iPhone:

Using iBackup

When we open the Backup using iBackup we get the data shown in Figure 1-16.

Using iExplorer

When we open the backup using iExplorer, we get the data shown in Figure 1-17.

SQLite Database

According to SQLite, XAMN and some other tools have an external SQLite viewer as shown next; we note that both Belkasoft and XRY can export the database and view it in DB viewer as shown in Figure 1-18.

Evidence Extraction Process for Android Mobile Phone

In this section, we performed the process of extracting data from an Android phone using multiple tools, after we rooted the device, as we rooted a Samsung Galaxy S7 phone, and we displayed the images and results obtained by using different tools.

The Examination Phase

In this section, we will introduce how to examine the mobile device for Android OS, to reach the desired goal of our practical case, which is to find challenges for the work of digital investigators. The first thing we want to root the device; Figure 1-19 shows the verified root for the Samsung S7 device.

To make the root in this device, we use Odin3 software with a custom ROM for Samsung Galaxy S7 SM-G390F devices. After using Odin3, we get a rooted device as shown in Figure 1-20:

Note

When we root the device, a new firmware is installed on the device, all applications are gone, and a new ROM is also installed.

Using XRY and XAMN

When we connected the device to the XRY software and started acquisition, we noticed the logs shown in Figure 1-21 and Figure 1-22.

Using ADB Command

In this section, we will explain how to use the Platform tools shell to obtain a lot of information and data and access to the phone. Figure 1-23 shows many of the operations that can be done through this tool.

Using FINALMobile

The investigator team can use FINALMobile, which includes a set of integrated tools such as file explorer and SQLite database within the main screen, as shown in Figure 1-24.

Mobile Forensic Challenges on iOS and Android

Summary

In this chapter, we have introduced mobile forensics by using different programs and tools to acquire the data from iOS or Android devices for both rooted and jailbreak mobile; the XRY software tool ranked first in terms of its ability to recover deleted materials. As for the rest of the programs, although they were able to extract all the data from the phone, they were not able to retrieve deleted data because the iPhone has not been jailbroken. In addition, the XRY tool jailbreaks the phone without using any third-party software or tool. Rather, through the tool itself, the phone was successfully jailbroken, and all its data was retrieved and extracted. As for using other tools and programs, it requires jailbreaking the phone using external tools to be able to complete the extraction process.

References