Introduction TO MOBILE APP ANALYSIS
The LCDI continues its Mobile Application Forensics research this semester with a new set of exciting apps to crack open. Last semester’s Mobile App team looked into Pokemon GO, MapMyRun, Tinder, and Voxer across iOS and Android mobile devices. We’ll now shift our focus towards Open Whisper Systems Signal, Passkeep, Facebook Lite, and possibly the Circle with Disney. Our goal is to find any artifacts of forensic value left behind by these new mobile apps.
Analysis
We are currently researching how the applications listed above create data on mobile devices. During this preliminary phase of our project, we will also be looking at how data is stored on the mobile devices and create strategies that will allow us to access that data.
Specifically, we will look at MMS (multimedia messaging service) messages, SMS (short messaging service) texts, and possible contact information on the Signal app. For Passkeep, we will be going after usernames and passwords stored on the device and pulling URLs (uniform resource locator) from browsing history. On Facebook Lite, we want to see what artifacts are stored in comparison to the official Facebook mobile application. This means that we will be searching for profile pictures, status updates information, friends lists, and timeline information.
Our current plan is to use tools like Cellebrite or MSAB’s XRY to extract the data from the mobile devices and use tools like UFED Physical Analyser to parse that data.
Conclusion
From what we gathered, not much research has been conducted on the mobile applications listed above. We hope to explore methodologies and procedures digital investigators can use in the future and report them through this research. With many exciting tests coming up and our experience with mobile application forensics increasing, we hope to publish an interesting and informative report to share with you at the end of the semester. Stay tuned!
Questions or comments? Please share with us in the comment section below! You can also reach out to our Twitter and Facebook or email us at lcdi@champlain.edu.