Some considerations for you-- so on the left,
I'm going to talk considerations.
On the right, what I recommend you try.
If the device is locked, you are not
going to know if USB debugging is enabled.
I worked a case.
I was supporting Army CID, and I don't
know if you remember this, but the person
who tried to bomb Times Square, he drove down from Connecticut,
left his car in Times Square with everything in it.
It was supposed to detonate.
It smoked.
So all of his GPS devices, cell phones, computers
were left in that Jeep because it was supposed to explode,
and nothing would be feasible to look at.
USB debugging was enabled on his Android.
We tried anyway.
This is where, do not assume that it's not enabled.
We were able to get a full physical extraction
of that device because, at the time,
physical was possible all because that user had
USB debugging enabled.
When I say, is the device unlocked?
Some people are like, how do you not know if it's unlocked
or not?
Another story-- I worked with a guy.
Unfortunately, he had a stroke very young.
At the hospital, one of my teammates was talking.
They wanted to get his in case of emergency.
And they kept saying, his device is locked.
His device is locked.
All you had to do was slide the screen to unlock it.
It wasn't locked.
So that's something else to consider.
If it is locked, what can you see on the screen?
Can you see pictures of dogs, or children,
or anything that may give you a clue of what that password is?
Do you have other devices?
So if you have access to my Mac, I
guarantee my key chain has something in it that
will give you a clue as to maybe what kind of password
I'm using on my iPhone or my PC.
So just keep that in mind.
Similar devices will help.
If you can get access to it, are you willing to root it?
If you're willing to root it during root processing,
it's going to take that device and turn it off.
So you have to remember this.
It is going to reboot during root,
which means you must have that passcode to get back in.
You're also going to need the passcode to root it
and then to enable some of the developer settings,
so it's important to consider that.
Do you care about your forensic footprint?
Most people who do covert operations,
this is what's going to impact you.
So if you're afraid that someone will do counter forensics
and know you touched that device, be very careful--
very, very careful.
Remember, the smallest footprint is
going to be the full file system access, the ADB backup.
When you start doing logical or physical,
that's where you're actually installing stuff
onto the device temporarily, and every contact leaves a trace.
And then the final thing is, why can you not get in?
So if you email me and say, Heather,
I have a locked Android.
Help me.
My first question to you is going to be,
what is the manufacturer?
And do you know which OS version of Android is running on that?
If you don't, that's OK, but you should
be able to look at the handset.
What I would do is Google that handset and understand,
is it file-based encryption or full-disk encryption?
If it is full-disk encryption, there is hope.
You could do all different kinds of things with it.
You should try the advanced extractions in UFED.
It it's file-based encryption, if USB debugging is enabled,
you could still use Qualcomm Live, Kirin Live, MTK Live
to get a full file system extraction.
Don't quit.
Give it a shot.
So my recommended steps, if you can--
and, obviously, physical would work
for full-disk-encrypted devices, file system
for file-based encryption.
You could also get a file system or a full file system
with full disk.
But obviously, physical is supported.
You should go for it.
Your backup is going to be the tiniest footprint.
Then advanced logical backup--
remember the SIM card and SD card.
Remember those generic Android methods-- the Qualcomm Live,
the other options.
All of those will help you.
If everything is still not working--
and this is something that's always a huge joke--
did you change the cable?
And I was co-teaching this class once.
And I literally lectured on this slide,
did you try a different cable?
I go to the back of the classroom
while the other instructor was teaching and, for three hours,
tried to acquire my device.
I swapped the cable, and it worked.
So I don't even listen to my own advice half the time.
And then also, if the phone has rebooted,
make sure USB debugging is still enabled, and then
consider the final thing.
Are you willing to root it?
Remember, root could ruin all of the data.
Root could wipe some of the data.
In your forensic challenge, Grace apps first device,
I mentioned we tried APK downgrade.
That was the second to last step we tried.
We tried to root that device, and we lost all the user data.
So it does happen.
Be careful.
Keep your eye on it, but understand the risks.
But also, don't be afraid to take them
if you are allowed to.