In this slide here, I first had just blue and gold.
I'm a West Virginia Mountaineer, so blue and gold
is my life there.
And then I realized your books are printed in black and white,
so that was a terrible idea by my part.
So I put circles around it.
These circles in blue and gold represent
places malware can hide.
And I realize malware is going to be covered in Section 4.
However, I know what's going to happen.
You will have an Android arrive to your lab.
And you'll think, oh, my gosh.
It has malware on it.
Let me go to the Android section.
So you have this slide here, and then you
have a slide at the end of this section
giving you hints on what to do if you have malware.
This is going to be covered heavily in Section 4.
Now, for these parts that are circled here,
when you do your lab in Section 4,
I'm going to tell you, please go back to Section 2
and review slide 50.
Cache is commonly were anything downloaded may hit.
So if it doesn't hit the Downloads directory
on the device, Cache is a great place to look for it.
Now, where you have to be careful with cache--
and this is something I'm not sure
if it's garbage collection that's clearing cache quickly.
But a lot of devices I've examined recently
don't have much data at all in that cache partition.
So you may have luck.
You may not.
Also, you're going to find that most of the apps
have their own cache directories.
And it seems like the databases are being stored there instead.
Everything's under Data.
All installed applications, as long
as they are user data user level--
so non-kernel level applications will
go into that app directory, even if it's malware.
If malware installs itself correctly,
it will live in apps.
It's very difficult to find, though.
If its kernel-level malware, which
is extremely dangerous and really robust,
it would be under System app, which
means if you wipe that phone, that malware still lives there.
That's very frightening.
Under Media, under System, you may find also
traces of malware.
Now, under USERDATA media, or under MNT/NONAME,
this is where, if you have malware on the device
and it's stealing your information,
it will package it all up-- most likely encrypt it--
it will store itself temporarily in one of these two locations,
from what I've seen, before it exfils.
And we'll talk more about exfils,
which is the transfer of your personal information
to the cloud, or a server, or something else.
But what I want to focus on at this point
is, what do you need to know forensically?
What do you care about?
On your cheat sheet, you will notice if it says,
like, USERDATA, CACHE, MNT, NONAME, or MEDIA.
So we lump those together.
It could be in MEDIA or in MNT/NONAME,
depending removable SD card or internal emulated.
And then you're going to dive in.