Practical Mobile Forensics
Fourth Edition
Forensically investigate and analyze iOS, Android, and Windows 10 devices
Rohit Tamma
Oleg Skulkin
Heather Mahalik
Satish Bommisetty
BIRMINGHAM - MUMBAI
Practical Mobile ForensicsFourth Edition
Copyright 2020 Packt Publishing
All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.
Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the authors, nor Packt Publishing or its dealers and distributors, will be held liable for any damages caused or alleged to have been caused directly or indirectly by this book.
Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.
Commissioning Editor: Vijin Boricha
Acquisition Editor: Rohit Rajkumar
Content Development Editor: Ronn Kurien
Senior Editor: Rahul Dsouza
Technical Editor: Dinesh Pawar
Copy Editor: Safis Editing
Project Coordinator: Vaidehi Sawant
Proofreader: Safis Editing
Indexer: Rekha Nair
Production Designer: Deepika Naik
First published: July 2014
Second edition: May 2016
Third edition: January 2018
Fourth edition: April 2020
Production reference: 1090420
Published by Packt Publishing Ltd.
Livery Place
35 Livery Street
Birmingham
B3 2PB, UK.
ISBN 978-1-83864-752-0
www.packt.com
Packt.com
Subscribe to our online digital library for full access to over 7,000 books and videos, as well as industry leading tools to help you plan your personal development and advance your career. For more information, please visit our website.
Why subscribe?
Spend less time learning and more time coding with practical eBooks and Videos from over 4,000 industry professionals
Improve your learning with Skill Plans built especially for you
Get a free eBook or video every month
Fully searchable for easy access to vital information
Copy and paste, print, and bookmark content
Did you know that Packt offers eBook versions of every book published, with PDF and ePub files available? You can upgrade to the eBook version at www.packt.com and as a print book customer, you are entitled to a discount on the eBook copy. Get in touch with us at customercare@packtpub.com for more details.
At www.packt.com , you can also read a collection of free technical articles, sign up for a range of free newsletters, and receive exclusive discounts and offers on Packt books and eBooks.
Contributors
About the authors
Rohit Tamma is a senior program manager currently working with Microsoft. With over 10 years of experience in the field of security, his background spans management and technical consulting roles in the areas of application and cloud security, mobile security, penetration testing, and secure coding. Rohit has also co-authored Learning Android Forensics, from Packt, which explain various ways to perform forensics on mobile platforms. You can contact him on Twitter at @RohitTamma.
I want to sincerely thank Satish Bommisetty, my ex-colleague and mentor, who inspired me early in my career and supported me throughout the journey of this book. I also want to thank the Packt team for their continued support and help in taking this book to the fourth edition. And finally, this book is for my parents, to whom I owe everything.
Oleg Skulkin is a senior digital forensic analyst at Group-IB, one of the global leaders in preventing and investigating high-tech crimes and online fraud. He holds a number of certifications, including GCFA, GCTI, and MCFE. Oleg has also co-authored Windows Forensics Cookbook, and Learning Android Forensics, both from Packt , as well as many blog posts and articles on digital forensics, incident response, and threat hunting that you can find online. You can contact him on Twitter at @oskulkin.
I would like to thank my family and the Group-IB Digital Forensics and Incident Response Team for their love and support, as well as the Packt team and my co-authors for making this book possible.
Heather Mahalik is the senior director of digital intelligence at Cellebrite. She is a senior instructor and author for the SANS Institute, and she is also the course lead for the FOR585 Smartphone Forensic Analysis In-Depth course. With 18 years of experience in digital forensics, she continues to thrive on smartphone investigations, digital forensics, forensic course development and instruction, and research on application analysis and smartphone forensics.
Satish Bommisetty is a security architect currently working with JDA. His primary areas of interest include web and mobile application security, cloud security, and iOS forensics. He has presented at security conferences, such as ClubHACK and C0C0n. Satish is one of the top bug bounty hunters and is listed in the halls of fame of Google, Facebook, PayPal, Microsoft, Yahoo, Salesforce, and more, for identifying and reporting their security vulnerabilities. You can reach him on Twitter at @satishb3.
About the reviewers
Igor Mikhaylov has been working as a forensic examiner for 22 years. During this time, he has attended a lot of seminars and training classes by top digital forensic companies (such as Guidance Software, AccessData, and Cellebrite) and forensic departments of government organizations of the Russian Federation. He has experience and skills in computer forensics, incident response, cell phone forensics, chip-off forensics, malware forensics, data recovery, digital image analysis, video forensics, and big data. He has written three tutorials on cell phone forensics and incident response for Russian forensic examiners.
Detective Chad Prda has served in law enforcement for over 16 years. Throughout his distinguished career he has obtained several certifications, including Advanced Peace Officer, Advanced Interview and Interrogation, and Expert in Mobile Forensics. Detective Prda served on S.W.A.T. for 8 years as a firearms instructor and a lead marksman (sniper).
He later moved into criminal investigations, specializing in social media investigations, mobile forensics, and cellular mapping, as well as testifying in several criminal cases as an expert witness and studying at the United States Secret Service National Computer Forensics Institute.
Next page