Mobile Device
Forensics & Extraction
A technical guide on extraction methods (logical, physical, file system) for iOS and Android devices, keychain analysis, and database parsing.
1. Forensic Extraction Levels
Mobile forensics differs from standard disk forensics due to hardware-based encryption, sandboxed operating systems, and dynamic file systems. Extraction typically falls into three categories:
Logical Extraction
Queries the device APIs to request user content (e.g. contacts, media, messages). Easiest to perform but does not retrieve deleted files or system database files.
File System Extraction
Uses exploits or custom agents to read the complete hierarchical directory tree. Accesses databases, keychain elements, and protected sandbox directories.
Physical Extraction
A bit-stream copy of the entire flash memory (NAND). Extremely difficult on modern devices due to hardware-backed file-based encryption (FBE).
2. Android Extraction & SQLite Parsing
Android investigations target app sandbox directories located in /data/data/. Accessing this requires root privileges, Android Debug Bridge (ADB) exploits, or utilizing backup-level extraction vulnerabilities.
Most application data (e.g. WhatsApp, Signal, contacts) is stored in SQLite databases. Extracting these databases allows you to write custom SQL queries to piece together chat timelines and message histories.
3. iOS Investigations: plist and keychain Analysis
On iOS, configuration files and application metadata are stored as Property List (plist) files. Analyzing plist files reveals device settings, Wi-Fi networks connected, and system timestamps.
Apple's hardware security enclave protects credentials in the **Keychain**. Advanced tools exploit vulnerability vectors (like Checkm8) to execute temporary custom ramdisks, allowing physical decryption keys to be cached and keychain entries dumped.
4. Forensic Database Querying
Once a database is acquired (e.g. an SMS database file), you can run an SQL script to reconstruct conversations:
SELECT
datetime(date/1000000000 + 978307200, 'unixepoch') AS message_date,
address AS sender,
text AS message_content
FROM message
ORDER BY date DESC
LIMIT 20;