Open Source Android Digital Forensics Application

For some time now, I've spent most of my R&D time on Android Forensics. Gartner predicts that Android will be the #2 smart phone platform by 2012, exceeding the iPhone and leaving only Nokia/Symbia in front. With an estimated 95 million devices on the market by that time, forensic examiners will inevitably begin to run across them (if you have not already).

The techniques we've developed will provide a full forensic image of supported Android devices. With the introduction of a new file system (YAFFS2) and a host of other new challenges, our community has considerable work to do to more deeply understand the device.

In an effort to give back to the community, we have released our logical Android Forensic application as open source. You can download it on Google Code and additional details are on my blog.

Application Architecture

The application was developed with a generic architecture which will allow other programmers to easily add support for new applications and data sources. Currently, we pull the following information in CSV files on the SD Card:

• Browser history
• Call logs
• Contact Methods (email, phones, etc.)
• Organizations (companies that contacts are in)
• People (the individual people)
• SMS

While security on Android phone is pretty decent, applications can (and do) share data. We take advantage of this sharing (via ContentProviders) and extract the data for forensic purposes.

Browser History Example

However, we have found ways to extract far more information. Take, for example, the browser. Currently, it exposes the visited websites via a ContentProvider. By querying the application's Content Provider, we can now supply the devices web history. We are confident that significantly more information can be extracted from the device. As such, we hope that this release will forensics folks who have Java experience to join our project. Also, since we have released the code under GPLv3, you not only have full access to the source code but if large commerical entities use our code, they are legally bound to provide their enhancements back to the project (for a recent ruling on this, see A Big Victory for F/OSS: Jacobsen v. Katzer is Settled).

How to install

If you have an Android device (or run the emulator from the SDK), you can install the application (an .apk file). To do this, you can either download the application online and install directly however you need to enable the Settings -> Application Settings -> Unknown sources option (until we sign the .apk which we hope to do soon).

An alternate method (and my preference) is to install using the Android Debug Bridge (adb). To do this, you must first install the Android SDK on your workstation. For Windows, you need to install the USB drivers and on Linux you must tweak udev but there are plenty of online tutorials about this. You also need to enable USB Debugging on the phone, which you can do under Settings -> Application Settings -> Development -> USB Debugging.

Download the AndroidForensics.apk from Google Code and save it to c:\af. Connect the Android device to your computer via USB and do the following from a cmd prompt:

List devices

C:\af>adb devices
List of devices attached
HT91YGZ08111 device

Install application

C:\af>adb install AndroidForensics.apk
419 KB/s (20138 bytes in 0.046s)
pkg: /data/local/tmp/AndroidForensics.apk
Success

On phone, run viaForensics application and click capture

You will receive a message when the application completes

Copy CSV files to computer

C:\af>adb pull /sdcard/forensics c:\af
pull: building file list...
pull: /sdcard/forensics/20100225.0915.SMS.csv -> c:\af/20100225.0915.SMS.csv
pull: /sdcard/forensics/20100225.0915.People.csv -> c:\af/20100225.0915.People.csv
pull: /sdcard/forensics/20100225.0915.Organizations.csv -> c:\af/20100225.0915.Organizations.csv
pull: /sdcard/forensics/20100225.0915.ContactMethods.csv -> c:\af/20100225.0915.ContactMethods.csv
pull: /sdcard/forensics/20100225.0915.CallLogCalls.csv -> c:\af/20100225.0915.CallLogCalls.csv
pull: /sdcard/forensics/20100225.0915.Browser.csv -> c:\af/20100225.0915.Browser.csv
6 files pulled. 0 files skipped.
30 KB/s (38729 bytes in 1.249s)

Conclusion

We have considerably more work to do on the application but it has been tested on the G1, T-Mobile myTouch, Motorola Droid and a number of Android virtual devices. We hope the community will not only find this application useful but that they will join us in expanding the functionality.

Andrew Hoog is a computer scientist, certified forensic analyst (GCFA and CCE), computer and mobile forensics researcher, former adjunct professor (assembly language) and owner of viaForensics, an innovative computer and mobile forensic firm. He divides his energies between investigations, research and training about the computer and mobile forensic discipline. He writes computer/mobile forensic how-to guides, is interviewed on radio programs and lectures and trains both corporations and law enforcement agencies. As the foremost expert in Android Forensics, he leads expert level training courses, speaks frequently at conferences and is writing a book on Android forensics.