If you are lucky enough to get a physical acquisition,
let's take a look at what we're going to see here.
So the first thing, we can see we have an image.
It's called blk0_mmcblk0.bin.
When we look down, we have Google Drive.
Great.
That's going to give us a clue.
Here, we see goodbyefelicia11@gmail.com.
We have CACHE, EFS, HIDDEN, PERSDATA,
SYSTEM data, USERDATA.
The fact that we were able to pull USERDATA means what?
So when we look at this, and we see USERDATA,
that means we had root access or temporary root
access to that device.
Otherwise, you would not get that USERDATA partition.
I am going to break down in a slide coming up
what you care about in each of these partitions.
What Lee and I do not want is for you to sit here and go file
by file on an Android.
That is our horrible job.
We do that, along with Mattia and other researchers
in the field so that you have a cheat sheet that guides you
mostly along the way.
Now is it perfect?
No.
We don't know what every single file on an Android means.
They're all different.
Every OS is different.
But we found key artifacts that you care about,
and they are all provided in your cheat sheet.
When you look at this reconstructed file system,
depending on the tool you use, you
may find where some of those partitions are compressed.
Some of them may not be named.
So you may have to dig to find which one is the user data.
Typically, the user data will have the most files.
Make sure you check and see, did it acquire the SD card
if there is one present?
Did it acquire the SIM card?
Chances are good that it didn't.
And when you look right here, we don't see the traces
of the SD card or the SIM card.
You will have access to deleted data,
but you may have to carve for it.
So remember, Android is going to use garbage collection,
which is going to go through that entire device
and clean everything up in addition to database vacuuming.
So many of these things are going to occur.
If you cannot get an extraction, Cellebrite Premium supports
Android, and GrayKey also supports Android at this time.
Now, the issue with this is you may have to be law enforcement
to get access to it.