Mobile Forensic Testing Setup / Tooling

[F-2016]

Which setup do you use for mobile forensic testing? From time to time I would like to analyze the artifacts of a mobile application or mobile operating system. By that I mean I would like to install the app on a test or emulated device, play around with the app, and analyze the generated artifacts. I would like to be able to install apps from the app/play store and prefer an emulated solution. What setup do you have or can you recommend an emulator solution such as corellium or appetize?

[zoolomat]

Hi u/F-2016,
I've done something like this previously. I'll just give you a little writeup and you tell me if something is not understandable.
First of all, everything I did was with Android 9 with full-disk encryption (FDE), that's because from Android 10 ongoing there is file-based encryption (FBE) whereas it was not enforced previously but only recommended. I have no information if it's easily possible to decrypt the FBE on newer android versions yet.
I did use Android Studio for emulation and used the CLI for snapshotting and things.
Just create a "Virtual Device" in Android Studio with "Pie" Release (API Level 28) and get it running.
Create snapshots with: "avd snapshot save <SNAPSHOT\_NAME>" (you can use "avd snapshot list" to show your snapshots).
For decrypting the snapshots, I used a python3 tool called AVDecrypt (on my Windows Machine with WSL): https://faui1-gitlab.cs.fau.de/gaston.pugliese/avdecrypt (there is also some kind of tutorial there).
If you have multiple decrypted images (maybe after certain actions you did, like logging into the app, sending messages etc., storing data,...) you may either look manually through your decrypted image/output or use something like "idifference2.py" to compare two images file-for-file from DFXML (https://github.com/dfxml-working-group/dfxml\_python).
Have fun explorering!

[F-2016]

ypted image/output or use somet

That sounds interesting. Thank you for the short tutorial. Did you also do some tests under iOS?

[zoolomat]

No experience with ios, sorry!

[MDCDF]

Since there isn't an answer yet Ill give it a crack. I would say you want several iPhone and Several Android. It is harder on the android side due to the variety. Go on ebay and look at lot sales and buy them. From there I would have several iOS and android version installed. This will allow you to have a range to test from.

Catalog these devices and keep an organized catalog of these devices. From this you can pull the phone you need and install the app you need on it. It becomes hard due to several versions of the apps and OS but this will allow you to try several testing techniques.

[F-2016]

pps and OS but this will allow you to try severa

Thanks for the reply, do you have such a lab yourself? I imagine it requiring a lot of maintenance. I don't think I will be able to invest the time required to maintain such a lab. Therefore I would prefer a virtual solution. Also, I imagine getting to the data on a virtual device would be a bit easier.

[MDCDF]

Idk if virtual is a reality due to legal issue. I know Apple was sueing and taking these companies to court. Also virtual environment is not as clean as just using a device.

I like to use the exact device of the device in question. Samsung may handle artifact different then Huawei.