In order for this to work, the first thing you must do
is enable USB debugging.
And I'm going to show you in the next slide
how to actually do this.
USB debugging is required to trust for ADB to work.
ADB is the Android Debug Bridge.
What I want you to think about this is,
imagine that little green guy walking across a bridge,
getting information from the phone,
and bringing it back to your forensic workstation.
That is exactly what must happen.
If USB debugging is not enabled, when
that Android guy tries to cross the bridge, he hits a wall.
USB debugging will allow him into the phone.
So if you think about this little process
of going back and forth, these two things are required.
A File System or Advanced Logical
could be a combination of several things.
One, it could essentially just be a backup
that gets you those ab files.
It could be a backup and also MTP protocols that
are run to pull SD card data.
It could be a software agent that's actually
installed onto the phone.
And this is where people are like, wait, what?
Yes, the commercial tools will want to install software
onto that Android that is evidence in order
to extract information.
And I'm going to show you why this happens
and how to verify what that software agent actually
looks like.
So we're going to treat it almost like malware.
We're going to decompile it and take a look at it.
Then there's something called APK Downgrade.
Now, this is a Cellebrite capability.
You can see here it says last effort, but it works.
It could ruin the device.
Chances of it ruining it are slim,
however, it does make changes that
look like a lot of deletions.
If you don't believe me, on section 6--
that's CTF-- [INAUDIBLE] Android--
we used APK Downgrade to examine it.
It looks like massive deletion.
Best recommendations here-- if you're doing a backup,
do not assume it's going to pull that SD card.
Do not assume it is going to acquire the SIM card.
Nowhere in here do you see SIM card mentioned.
You must take the SIM card out and acquire it yourself.
Do that with the SD card too if you have time.
It's definitely relevant.
I would write-protect it to protect those lost access
dates.
And also, make sure you're paying attention
because, as you see in the slides coming up,
the user or examiner has to interact with the device
in order to prevent a screen from being missed.
Also note, it will cause the phone to reboot.
Meaning, it will take a hot device and make it cold.