Let's talk acquisition now.
So we have two different categories and steps
that you could take here.
Do you have root?
Or do you not?
So let's talk about not.
If you do not have root privilege,
and there's no way you can get it, either because there's not
a root available, or, two, you're
not willing to lose any user data or wipe the device.
Best methods-- attempt a full file system extraction
with UFED.
So UFED-- and notice, we're being very tool-specific here.
UFED's going to offer the Kirin Live, the Qualcomm
Live, and MTK Live.
These are unique capabilities built within UFED
that are going to get you advanced access
to these devices.
You could conduct an Advanced Logical or Logical.
Now, this should capture your basic things-- contacts, calls,
SMS, and some others.
It's not going to get the user databases, though.
You're not going to get a lot of application data
that you would want to parse.
Your extraction will most likely look pretty empty.
Create a backup.
Why not?
It's quick.
It's easy.
It can be free.
But if you already have the UFED,
you could do it within the UFED to make
sure you have a forensically sound wrapper
to just protect yourself.
Extract data in a write-protected state
from the SD card.
Also extract, the SIM card.
Make sure you're leveraging that.
And then leverage additional mechanisms and tools.
And this is the fun part.
Chat capture in UFED--
awesome technology and capability
that's there that a lot of people don't realize.
APK downgrade, many people fear it.
Running ADB commands, taking screenshots--
all of these things exist in the tools.
So on screenshots, I don't mean you sitting there
and photographing the screen.
I mean, leveraging the tool to show you
what's on that screen in that present state.
So these are the recommended steps in order.
So keep that in mind.
We are finally saying, this is what we should do.
I recently wrote a blog.
And I wrote it for iOS and Android.
And I will show that blog to you.
If you go to smarterforensics.com,
you can find it, and it's also in the notes of the book.
But it's referencing different acquisition methods
and what I recommend.
So after I finish this slide, I will show you that blog.
If you have root, attempt physical.
If it's not working, it's probably
because you have a file-based encrypted device.
Physical extraction is only going
to work on full-disk encryption.
If it is file-based encrypted, obtain a full file system.
And again, you could leverage Qualcomm Live or MTK Live
if required.
Do advanced logical extractions.
Now why?
If you're like, why would I do that?
I got a physical.
I got a full file system.
Because remember those identifiers
that we talked about in GSM, CDMA, the phone number?
All those things may only be extracted
during an advanced logical extraction.
Also, just because you have physical access or full file
system does not mean that SD card or SIM card were acquired.
Do those separately.
And then, you still may want to do chat capture,
APK downgrade, and run some of these ADB commands
on things that are not captured during these acquisitions.
But I want to show you my blog.
So I'm going to go out to a browser,
and I'm going to go to smarterforensics.com.
And I wrote a blog a long time ago
called "Adapt, Adjust, and Acquire," and it was from 2019.
So I decided I needed to update this blog.
So at the end of December, I wrote an acquisition blog
and just warned you.
Now, I break it down, for Android acquisition,
additional things you're going to need.
This VM has ADB set up perfectly as you need.
It has Mattia script.
It has all the scripts in the environment.
If you want to replicate what we provide you
on your forensic workstation, you
can follow these steps here.
Tells you the links on how to get it.
And then I walk you through some of the screenshots in UFED
on what I would do-- choose Android Qualcomm, Qualcomm
Live, how to extract it.
I show you ADB devices, which I have just shown you
how to create the backups.
I mention the SD card and SIM card.
And then I show you chat capture.
And then I talk about cloud--
if you have authority, things to do.
And then I do the similar things for iOS,
which we'll wait until Section 3 to talk about.
But all of that is there for you.
If you go to smarterforensics.com,
go to Blog, it's the most recent blog that I've written.