Introduction

Increasingly, many devices do much more than receive a telephone call occasionally. These devices are becoming more and more capable, and the number of people using them has increased accordingly. With the increasing availability of these powerful devices, criminals can also use this technology. Criminals might use smartphones for several activities, such as email fraud, textual harassment, trafficking in child pornography, communication for narcotics trafficking, and so on. Analysts can be extremely helpful in the investigation by storing data on smartphones. Mobile equipment already shows a large amount of data connected to a person with a basic telephone history, contact information, and text information; even more useful information such as email, browser history, and chat logs is provided by smartphones. Mobile devices probably display more proof of byte connectivity than most computers – and it may be harder to collect forensically. Part of the problem is that there is plenty of available hardware, software, and/or interfaces. These differences vary between media, in which data is stored in the operating system and the file system, and the efficiency of specific instruments. Even different cellular models manufactured by the same manufacturer may need cables and software for access to telephone information [8].

In recent days, the popularity of Android OS has grown. It has almost the same features on desktop/laptop computers. Users can create documents, access the Internet, read and forward email, call, text and MMS, and maintain confidential information in many different ways. You can access the information via the Internet. These Android devices and apps make it easy for friends, family members, and groups to communicate on the web and socially. For many cybercrime investigations, a forensic smartphone exam is necessary to determine a range of suspected activities. Advanced cells contain a lot of information, which is extremely useful to investigators in the exploration cycle. Cell phones give significantly more valuable data, for example, talk logs, messages, individual data, and program history. These incorporate the major history of your phones, texts, and contacts. In this chapter, strategies for and instruments of scientific seizure of the specified instrument and the investigation of crimes is analyze [9].

When reading cutting-edge Android forensic approaches, particular writing or techniques about rooting were used to achieve root user privileges because of the device. The largest user privilege is to show the partition and wreath over the gadget with the aid of “dd” (ADB). The images received are analyzed using common forensic commercial enterprise tools [10]. The creator talked otherwise concerning the fast imaging and analysis information partition area based on Yaffs2 Android. Even without a precise tool and system, a wealth of pertinent information has been recovered forensically [11].

Android File System

Most Android users just use their Android phones for telephone, text messaging, browsing, and basic apps, but for development prospects, we should know the Android internal structure. To organize files and folders on your device (for example booting, systems, recovery, data, etc.), Android uses multiple parts just like Windows OS. This is a feature for each partition, but the meaning and content of each partition are unknown to most of us [13].

Android file systems handle the data storage techniques, organization, and retrieval from the disk volume. Android has several file systems. The volume can have several partitions where each partition can be managed separately by a different file system. The file system can be attached as an additional file system to a partition when it is mounted. File system type may affect the analysis process for the targeted partition, so it is forensically important to know the file system used on the partitions of interest. Android file systems are organized into three main categories [15]: flash memory file systems, media-based file systems, and pseudo file systems.

Android System Architecture

Android OS is based on Linux OS, and it is an open source platform from Google for mobile devices. Since Android is open source, it is easy to view code and update it as needed. The native code of Android is set up the way it is because other operating systems must talk with hardware as a sequence of layers, as shown in Figure 3-1.

There are various components for all Android apps in Android’s architecture. There are many C/C++ libraries exposed by the application framework services within an open source kernel of the Android software of Linux [14].

The Android architecture is shown in Figure 3-1. The main components are as follows:

• Applications

• Application Framework

• Android Runtime

• Platform Libraries

• Linux Kernel

The starting point is the Linux kernel layer , which acts between hardware and Linux. The hardware abstraction layer (HAL) consists of several libraries and interfaces for a specific type of hardware, allowing hardware companies to develop functionality without altering system components. Libraries include all programming packages interacting between HAL and Java API layers. The Java API framework layer is responsible for the main functional module in mobile. The system apps layer is basically where the user can work with either preinstalled applications or new ones such as social media, email client, and others (Rohit T., Oleg S., Heather M., Satish B., 2020).

The second layer is HAL, which presents the hardware capabilities of the device through standard interfaces to the higher-level API framework. HAL consists of library modules. These libraries implement interfaces for hardware components. When taking a picture from an application, the API needs to access the hardware camera. Accordingly, the OS loads the related library modules for the camera. The next layer is the Android Runtime (ART), which is one of Android’s most important components. The main components of this layer are Just in Time (JIT) and Ahead of Time (AOT) compilers. JIT executes the frequently used codes of identified operations and compiles them to machine code. This improves the performance of the most used operations. AOT compiles the entire application into machine code. This is done once the application is installed. This will result in reducing power consumption and increasing performance. Accordingly, FBM DEX files will be compiled and converted to executable code. Dalvik includes essential libraries and a virtual chin, among other things (DVM). It primarily serves as the foundation for the app frame and makes use of key libraries to make our application more user-friendly. Dalvik virtual machine (DVM), like Java virtual machine (JVM), is an Android-based virtual machine that runs on a registry that has been carefully developed and optimized for performance. The threading kernel and low-memory management will be crucial to the Linux layer. For Android apps, we employ the mainstream Java and Kotlin programming languages in our core libraries.

Platform Libraries: The collection comprises some Native C and C++ libraries (such as media, graphics, Surface Manager, OpenGL, etc.) from the next layer in Android architecture. Some of these libraries can be accessed using Java framework APIs provided by the Android platform. Some of the Android components are built using Native C and C++. This is like the ART mentioned in the previous layer. Additionally, any application developed using native C and C++, in case they need to reference the related code libraries, will be provided by this layer. Above the libraries and ART layers, there is the Java API framework layer. It is responsible for providing Java APIs to handle the basic phone services and OS features. Developers can use these APIs as building blocks for their apps to use the core components and services of Android.

The last layer, the system apps layer, supports the direct user interaction with the device. This layer has a set of core apps such as a calendar, browser, email app, and others. Only this layer will be installed in preinstalled apps like home, contacts, camera, gallery, and so on, as well as third-party apps downloaded from the Play Store. It operates within Android times with the help of classes and services provided by the app framework. Developers can utilize these apps. This layer manages the default app to be used, which can be a native app or a user-installed app. User interaction with some installed apps, such as writing and sending messages, involves the direct use of the system apps layer.

Android System Permission Model

Android applications need to be granted explicit permission by users to be able to access sensitive functionality and certain services of the MD, such as the Internet, call lists, contact details, and so on (Almomani & Khayer, 2020). This provides the opportunity for users to know beforehand what the functionality is and which running services are on a device accessed by the application. Thus, it requires a user’s explicit permission to be able to perform any type of malicious activity like stealing identity, stealing data, or compromising the system. In devices running Android 6.0 and prior versions, the users needed to explicitly grant the permissions while the app was installed.

Users have the choice of either accepting the entire permissions or not installing the entire application at all. Starting from devices running Android 6.0 and later versions, users can grant permissions to the applications at the running status. This new permission model also increases user control over the application’s functionality and running services by allowing the user to be able to grant any appropriate and selective permissions (Talegaon & Krishnan, 2020). Thus, users can deny particular application access to their location, but are able, meanwhile, to provide access to the Internet services. From a mobile forensic point of view, this means that the type and amounts of information capable of being extracted from MD not only depends on the device and the installed applications but also depends on the permissions granted and configured by the user.

The app authorization model described in Figure 3-2 governs how applications access such sensitive resources, such as personal data of users or sensor data (e.g., camera, GPS, etc.). For example, to read entries on a user’s phone, an application must have READ CONTACTS permission. Device permissions are split into four levels of protection: standard and dangerous permissions are the two most important levels to this manuscript.

Standard permissions require access to data or resources beyond the sandbox of the app, but there is very little risk to the privacy of the user or the operation of other applications. Permission to set the alarm, for instance, is an example. Dangerous permissions are needed if the app wants information or services that include the private information of the user or that could potentially impact the stored information of the user or the activity of other apps. For instance, dangerous permission is the ability to read user contacts.

To limit the usage of components in an application that can perform critical tasks, applications can also specify their permissions. The third level of authorization is signature permission, which developers use to move resources and data between their applications while protecting them from other developer applications. Finally, there is high-level signature or system authorization, which involves modifying security settings, downloading an application, and so on. OS developers and manufacturers retain these permissions. The system grants these applications either found in the system image or signed by the same certificate as the system image (Bhandari et al., 2017).

Harmony Operating System

HarmonyOS is one of the first open source operating systems developed by the Chinese, as Huawei Technologies Company developed it. HarmonyOS was developed due to political and economic conflicts between China and the United States (Ng & Weng, 2020). HarmonyOS is based on the microkernel, an operating system oriented to the 5G era. HarmonyOS can be deployed on different devices such as mobile devices, TVs, cars, and other smart devices. HarmonyOS is compatible with all Android and web applications.

HarmonyOS Architecture

HarmonyOS is designed with a layered architecture, which from bottom to top consists of the kernel layer, system service layer, framework layer, and application layer as shown in Figure 3-3. System functions are expanded by levels, from system to subsystem, and further to function/module. In a multidevice deployment scenario, unnecessary subsystems, functions, or modules can be excluded from the system as required. Figure 3-3 shows the technical architecture of HarmonyOS.

Kernel Layer

Data Extraction Techniques on Android

Logical Data Forensics

The logical acquisition enables the analysis of data on the Android device to be made more thorough and is the first way to use data ‘extraction’ for a separate review. This means connecting the device to the forensic workstations by wired or wireless. It also means accessing your phone file system and obtaining a copy of the backup information, for example, ADB pull data extraction. In our practical case for this chapter, the logical forensic analysis will be done to Samsung Galaxy Note 9 without rooting.

Method 1: Using ADB Pull Command:

The first step is to enable developer options.

The second step is to enable debugging mode as Figure 3-4 shows.

The third step is to go where ADB is located: “C:UsersfullpathLocalAndroidSdkplatform-tools”.

The fourth step is to run ADB pull datadata “path”. As shown in Figure 3-5, no output was found, because the device is not rooted.

Method 2: Using Mobiledit Forensics

Now the criminal has deleted the porno image from the gallery and also from the trash cycle; in this section, we present another method of mobile forensics to obtain the deleted images (child pornography). Mobiledit is a good example to mention, as it doesn’t require rooting and it can collect data from the normal privileges.

Step 1: Connect the phone to the PC using a USB cable and enable debugging mode, as Figure 3-5 shows.

Step 2: From the mobiledit panel choose the device type, as Figure 3-6 shows.

Step 3: Choose the connection type, as Figure 3-7 shows.

Step 4: Analyze the data that is extracted, as Figure 3-8 shows.

After examining and analyzing the data that was extracted by mobiledit , we can see that the program has the advantages that the phone doesn’t require root, and it’s good for analysis of nondeleting media, but it doesn’t get any deleted data, which means that the data extracting is not bit by bit; it’s only for existing data.

Screen Lock Bypassing Techniques

Based on the lock technology used, the key file will be named. The naming of the key file depends on the manufacturer too. In this experiment the key files were located under /data/system partition. Names of the key files are gatekeeper.password.key for password or passcode lock and gatekeeper, pattern key for the pattern lock. To bypass the lock, delete the mentioned key files using the rm command with superuser privilege and then reboot the device. This method works on a rooted device only.

The update settings.db file technique requires accessing a rooted device from the shell. This can be done from the ADB shell. The settings file is located under /data/data/com.android.providers.settings/databases; using sqlite3 you can update by setting the lock screen values to 0.

Physical Forensics

Physical means getting the current bit-by-bit image of a device. It should be understood that a device copy and paste doesn’t have one image per bit. Only files that have been copied and pasted on a device, such as visible files, hidden files, and system-related files. It’s a logical photograph. The deleted files and archives are not copied with this method. Now after we rooted the Samsung Galaxy Note 9, we finally can obtain a bit-by-bit image. This will help us to detect any deleted photos; in our case the criminal viewed the porno image and deleted it from the gallery and also from the trash, so it was hard or even impossible to detect it using manual and logical forensics. Therefore, we now present the physical forensics, which is getting a bit-by-bit image.

Back to logical extraction: now we will use ADB tools to create bit-by-bit images.

Step 1: Go to where adb is located: “C:UsersdellAppDataLocalAndroidSdkplatform-tools”

Step 2: You can use the dd command for creating a raw image of the device. This command helps us create an Android image bit-by-bit by copying low-level data.

Step3: After copying all data, it will be shown as a .dd file extension as Figure 3-11 shows; this file extension is supported and can be opened by Magnet Axiom toolkit and many forensic toolkits.

Step 4: Open autopsy and analyze the file.

Step 5: After we analyzed the mobile data, we finally found the child porn image after the criminal deleted it from the gallery and the trash, as Figure 3-12 shows .

In some cases, we can flash the recovery partition that was used to replace the recovery partition on the Android device with previously stored images from a computer (backup image). This works if the bootloader is not locked on the device. The flashing is made through the fastboot diagnostic protocol, which comes with the Android SDK. To apply this method, reboot the device in the boot loader mode. Use a set of commands from the shell to flash or write over the recovery partition. After the process finishes, reboot the device in recovery mode. From the recovery mode shell, mount /data and /system partitions. Investigators can use the ADB bypass method on the mounted partitions. This technique makes unrecoverable changes to the evidence. The alternative approach supported by fastboot is to boot a temporary recovery image without changing the original recovery partition.

Other advanced physical data extraction techniques are JTAG and chip-off. Note that these techniques will not work on devices with full desk encryption enabled.

Joint Test Action Group Data Extraction

JTAG is the Joint Test Action Group data acquisition method. It involves electronic works to connect specific ports on the device and ordering the processor to send the data in the RAM to the connections. This is a physical data extraction method, as it moves all bits in the RAM to an image. This is a very advanced technique and should be referenced by experts for very rare cases in which applying other data extraction techniques is not possible. Even though this method is very hard to implement, it has some advantages in special cases. It is useful on a damaged device that is not able to boot normally, as JTAG works on powered-off devices. Additionally, it is useful in extracting data from locked devices without the need for root or USB debugging mode enabled. It should be noted that this technique may result in damages to the device and losing all data.

Chip-Off Data Extraction

This technique involves detaching the NAND flash electronic chips from the device and attaching them to a specific device to extract the data. Chip-off has the advantages of JTAG in accessing unlocked, damaged, or unrooted devices. On the other hand, it has an extremely high risk of damaging the device. This is due to the very delicate chip-detaching process. Additionally, it is much more difficult to reattach the removed chips back to their place. Accordingly, the device after this process should be considered unrecoverable.

Mobile Forensics Investigation Challenges on Android Devices

With the rapid evolution of smartphones, mobile forensics is more difficult than ever. Every new Android version introduces new features and security enhancements, which might obstruct the forensic procedure. Based on what was discussed during this section and the previous section, the problems and difficulties that exist in Apple devices are the same as the difficulties found in Android devices. Add to this that Android devices are witnessing a great development in the field of security and encryption. Moreover, phones that run on the Android system are multiple, and we witness many versions from companies and multiple versions that are very difficult to follow:

When the user creates a second interface in the device, it seems that it is another phone in the same phone; when an investigator tried to acquire the second space, it wasn’t included in the acquisition copy because it is a separate space. Figure 3-14 shows that even if we get inside the second space we can’t extract the third-party apps because we need to enable the developer mode and we can’t make this happen because of device security (MIUI, 2019).

Summary

The iPhone 6s was backed up by the iTunes program, and we were able through this backup to get the porno picture using Magnet Axiom. However, the Belkasoft program could not get the porn picture; we note that the iPhone has not been jailbroken, so we were able to get the image after deleting it, unlike the Samsung Note 9. I browsed the device manually and found the image in the trash file, but when we deleted the image from the trash file, we made a logical image without rooting the device, but we were unable to get the deleted image. So we did a physical image and rooted the device, and after that, we were able to get the deleted image. In the end, the forensic investigation of the iPhone was easier than the forensic process for the Samsung phone.

Practical Lab 3.1

Access the device using ADB (developer.android.com) by enabling USB debugging as described from step 1 to step 7, then type the command ADB devices in step 8.

References