First and foremost, we are only going to look at EXT4.
is the most commonly used Linux file system on Android devices.
Could there be others?
Absolutely.
It's open-source.
But just like when we look at iOS,
you could have APFS or HFS plus.
Chances are good it's going to be APFS.
With Android, what is amazing is EXT4 is mountable by most media
forensic tools, meaning if you're using X-rays,
FTK, NKs, autopsy, EXT4 is something
that can mount in those tools.
At a previous lab that I worked in,
we had multiple keyword searches we had
to run in foreign languages.
We loaded every single phone into NKs
so we could keyword search those.
Now, I don't personally think that those tools that I
mentioned are good at smartphone forensics
when compared to Cellebrite, to Magnet, to Oxygen.
But they will get you access to the file system.
A good example of this--
I'm going to switch to the VM to show you--
is we can use FTK Imager.
And let me just move this screen around just a little bit.
If your Windows ever overlap like mine are right now,
what you can do is you can right click and unlock.
And then when you move them to a place where you like it,
right click and lock it again if it's bothering you.
I'm going to click on FTK Imager,
and I just want to show you how important this
is because if you get an extraction
you need to open it before you give that phone back.
So what I'm going to do here is I'm
going to click on this plus, and I'm
going to add the lab from yesterday.
So I'm going to say, I want to add an image file.
In the path, I'm going to point it to Lab 1.1,
to the ZIP, and Finish.
Now, this is not very exciting, but how long
did that just take?
30 seconds?
I go in.
I want to go to data, data.
I want to click on something.
I want to make sure the database is not encrypted.
How I know it's not encrypted?
I can read SQLite format 3.
If I keep looking through this, I will see my data is good.
EXT4 will be mountable by any of these tools.
Always do a quick look like this to make sure
that you don't have encrypted data
before you give the phone back.
I chose FTK Imager just because it's fast.
I used to use Autopsy as the example
because it's another open-source tool.
But it takes longer because it wants to do some processing.
So both of them are quick.
FTK Imager's super fast.