APK Downgrade-- when you go into these different options
here, if you go into the file system or advanced logical,
you're going to see Android Backup APK Downgrade.
When you click on that i, you get this very scary message.
And it says, the Android Backup APK Downgrade method
should be used as a last resort after you
exhaust JTAG and chip-off.
There are very few people in this world
who can remove a chip, put it back on,
so you can do APK downgrade.
I've mentioned this to Cellebrite,
and this terminology is going to be changed and removed.
However, it should still be your last level of effort.
And the reason being is that second paragraph.
What it does is APK Downgrade is going
to take the current version that's running on that device
and downgrade to a previous version of that app
that it knows it could successfully
extract user data from it.
So Android 12 has built-in new restrictions
that prevent certain things from being included in a backup.
If it reverts from a version running an Android
12 to, say, Android 10 where that wasn't a restriction,
we can extract more information forensically.
So yes, it is going through and it's taking this version,
downgrading to this version, extracting it,
and then reverting to the current version.
Every contact leaves a trace.
Imagine what this nightmare could look like.
It's going to look like things were deleted,
things were re-added.
But you have to understand, that's exactly what
is happening.
Keep that in mind.
Look at Grace's device in the forensic challenge
that is on ISO B If you want to see what this looks like.