Android and Wireless Data-Extraction Using Wi-Fi
Total Page:16
File Type:pdf, Size:1020Kb
Android and Wireless data-extraction using Wi-Fi Bert Busstra N-A. Le-Khac, M-Tahar Kechadi School of Computer Science & Informatics School of Computer Science & Informatics University College Dublin University College Dublin Dublin 4, Ireland Dublin 4, Ireland [email protected] {an.lekhac, tahar.kechadi}@ucd.ie Abstract—Today, mobile phones are very popular, fast growing To investigate a mobile device an investigator needs to technology. Mobile phones of the present day are more and more interact with the device directly. The examiner must be like small computers. The so-called "smartphones" contain a sufficiently trained to examine the device. He has to think wealth of information each. This information has been proven to before he acts, because he must know exactly what effects his be very useful in crime investigations, because relevant evidence actions have on the data, and he must be prepared to prove it. If can be found in data retrieved from mobile phones used by criminals. In traditional methods, the data from mobile phones the examiner did change the data, he must be prepared to can be extracted using an USB-cable. However, for some reason explain why it was necessary and what data has changed. For this USB-cable connection cannot be made, the data should be this reason the examiner should document every action taken. extracted in an alternative way. In this paper, we study the In a traditional way, the data from mobile devices can be possibility of extracting data from mobile devices using a Wi-Fi extracted using an USB-cable. Most Android devices can be connection. We describe our approach on mobile devices connected to a personal computer by using an USB-connection. containing the Android Operating System. Through our Using this USB-connection the content of an Android device experiments, we also give recommendation on which application can be examined. During forensic investigations, software- and protocol can be used best to retrieve data. packages, like XRY [3] or UFED [4], can be used to acquire Index Terms—Android, Wireless data extraction, network data from the device. protocols, SSHDroid, rsync. Indeed, when a device is “rooted” [5] full access to the file- system can also be gained. In that case more information can I. INTRODUCTION be retrieved from the device. Basically, Android rooting is the process which allows the users of Android-devices to gain Today, almost every citizen has a mobile phone. According privileged control (known as “root access”) within the to Central Bureau of Statistics (CBS) (Statistics Netherlands) Android's subsystem. Besides, Android Debug Bridge (ADB) Mobile Internet use continues to grow. It also states in a press [6] is a versatile command line tool that lets you communicate release that: (i) 60% internet users go online with mobiles; (ii) with an emulator-instance or connected Android-powered Young people use mobiles most; (iii) Mobile phone most device. Using the ADB tool combined with root-access, the popular; (iv) Used for communication, news and fun [1]. examiner can even make physical dumps from the partitions Basically, mobile devices contain a wealth of information each. found on the device, using the UNIX “convert and copy file” This information has been proven to be very useful in crime commands such as “dd”. In this case all information can be investigations, because relevant evidence can be found in data retrieved for later analysis. retrieved from mobile phones used by criminals. For instance However, while conducting an investigation on an Android evidence might be extracted from: Address books, SMS/MMS, device, it may happen that it is not possible to retrieve data Call-history, Twitter, web browsing cache, E-mail, Social from it using an USB-connection. Reasons for these might be a media apps like Facebook, Instant messaging such as failing cable or a dirty connector. In these cases an examiner Whatsapp, Viber, Skype, etc. will only investigate the external memory-card if it’s available As a consequence, the investigators investigate mobile in the device. However, not all devices come with external devices on a regularly basis, because the data found on those memory. Sometimes the device only contains internal (in- devices might contain crime evidence. Besides, one of the build) memory. The contents of this memory can normally major operating systems found on these mobile devices is only be extracted using a USB cable-connection. At that point Android. According to the International Data Corporation there should be other methods to acquire data from the in-build (IDC) Worldwide Quarterly Mobile Phone Tracker, total memory storage. Android smartphone shipments worldwide reached 136.0 In this paper, we investigate the feasibility in making a million units, accounting for 75.0% of the 181.1 million connection to the Android file-system using wireless smartphones shipped in third quarter of 2012 [2]. It is no networking (Wi-Fi). There is very little research in literature surprise that most mobile devices onto which digital evidence that focus on this approach. There are some tools such as is conducted these days is an Android device. Therefore, we MOBILEdit Forensic [7] which also support to extract data only focus on Android devices in this paper. from mobile devices using Wi-Fi. However their approach is not disclosed. In our approach, we aim to study simple, efficient method to use Wi-Fi to extract data from Android use of the smartphone’s Wi-Fi or Bluetooth interfaces. mobile devices. Indeed, by performing different experiments However they also use USB cable-connection in their solution. with our method, we also try to answer the following To the best of my knowledge there has been no research on questions: (i) Is data extraction from an Android-device using Wi-Fi for retrieving data from mobile devices, in possible using Wi-Fi? If so, will it be a good alternative for particular from Android devices, in the context of a forensic using an USB-connection with the adb-toolset? (ii) Can we setting. An USB cable-connection looks like the most extract all data as we do as with USB, like extracting deleted commonly technique among forensic software that is used for data? (iii) Which network-protocols and free applications can retrieving data from mobile devices. Despite MOBILedit be used and which is the best? (iv) Will the file-system of the Forensic [5] allows to use Wi-Fi connection to extract data, its Android target-device remain untouched? (v) Will the file protocols are not disclosed and it is moreover not free [14]. attributes be preserved during file-transfer? (vi) Will the given solution work on different versions of the Android? III. ADOPTED APPROACH The rest of this paper is organised as follows. In Section II, In this section, we describe our approach for using Wi-Fi to we present the background where we review related work in extract data from Android mobile devices. In our method, we this context. Section III describes our approach of extracting firstly investigate on different network protocols which allow data using Wi-Fi connection. We show our experiments in us to connect to mobile devices using Wi-Fi and to extract Section IV. We also discuss and analysing on testing results in relevant data. Next, as we have to install apps on target this section. Finally, we conclude in Section V. devices, we should look at the impact of installing apps on an Android device in the context of preserving artefacts in this II. BACKGROUND device. We also describe our user-interactive script for using A lot is written about Android devices in general but less commands of extracting files and directories from an Android on the forensic aspects of retrieving data from the Android device using Wi-Fi. devices. On the subject of forensic examination on Android Examining the Android devices, we discovered that there devices, [5] describes several Android Forensic Techniques to was no available option for a user to remotely connect to the acquire data from an Android device by a logical or physical Android file-system using Wi-Fi. When an Android device is way using an USB cable-connection. Indeed, the author shows purchased it does not come with functionality to access the file- that to gain access to the data on the file-system of the system remotely, to back-up user’s data for example. Based on Android-device, the developer menu-option: "USB-debugging" this fact, we concluded that to acquire data from an Android must be enabled in the settings-menu of the device. If the device using Wi-Fi, an app should be installed on the device access to the settings-menu is blocked, it is nearly impossible first to make the wireless communication possible. This app to gain access to the devices memory. In most cases an includes network protocols to connect to target device and to investigator needs unlimited access to the user-interface of the retrieve data for further examination. Android-device to adjust some options in the settings-menu. A. Protocols Beside [5] also explains the installation and usage of the Android Software Development Kit (SDK) [8] on the In our approach, we investigate on different protocols that investigating computer. can be listed as: Rsync [15], HTTP-WebDAV [16], SSH [17], In [9], author has focused on evaluating the efficiency of etc. Basically, we look at simple, popular protocols that are software tools that support the extraction of information stored integrated in most networking apps. on Android devices. Author also describes the architecture of 1) Rsync: Rsync can be used to sync data across a network, Android systems as well as methods for data extraction.