Hands-on Android Forensics using ADB for analyzing SMS, calls, contacts, WhatsApp, Location Data (en)

Android Forensics on Ubuntu Using ADB

What is Android Forensics?

Android forensics is a digital investigation process conducted on Android devices to collect, analyze, and preserve digital evidence. This evidence can include SMS, call logs, contacts, location data, browsing history, and much more. The aim is to uncover activities that occurred on the device, whether for legal purposes, internal investigations, or data recovery.

Why Use Ubuntu and ADB?

• Ubuntu: As a popular Linux distribution, Ubuntu provides a flexible and powerful environment for forensic analysis. Many forensic tools are available for Ubuntu.
• ADB (Android Debug Bridge): This is a versatile tool provided by Google to communicate with Android devices. With ADB, we can perform various actions, including copying files, executing shell commands, and debugging applications.

Basic Steps for Android Forensics Using ADB

1. Preparation:

• Enable USB Debugging: On the Android device, enable the "USB Debugging" option in the developer menu.
• Install ADB: Download and install the ADB package on your Ubuntu system. You can use pre-built packages or build it from source.
• Connect the Device: Connect the Android device to the computer using a USB cable.

2. Creating a Backup:

• Full Backup:

adb backup -f backup.ab

• Selective Backup:

adb backup -f backup.ab com.whatsapp

• Extracting Backup:

adb restore backup.ab

3. Accessing the Shell:

• Access Shell:

adb shell

• Navigate the File System: Use commands like `cd`, `ls`, and `cat` to explore the device's file system.

4. Analyzing Data:

• SMS: SMS data is usually stored in an SQLite database. Use the `sqlite3` command to access and query the database.
• Calls: Call logs are also stored in a database. You can use similar commands to analyze it.
• Contacts: Contacts are typically stored in vCard format.
• WhatsApp: WhatsApp data varies depending on the version. You will need to locate the correct directory and use specific tools to extract the data.
• Location Data: Location data is often stored in log files or within map applications. You can use specialized forensic analysis tools to extract and analyze location data.

Example of SMS Analysis with ADB

# Access shell
adb shell

# Navigate to the SMS database directory (adjust for your device)
cd /data/data/com.android.providers.telephony/databases

# Open the SMS database
sqlite3 mmssms.db

# Query to display all SMS
.tables
SELECT * FROM sms;

Additional Forensic Tools

• SQLite Browser: For visualization and analysis of SQLite databases.
• Autopsy: A powerful open-source forensic tool for analyzing various types of data.
• The Sleuth Kit: A popular forensic toolkit with various features.

Important to Remember:

• Access Permissions: Ensure you have the necessary permissions to access the device and its data.
• Legal: Always comply with applicable laws related to digital forensics.
• Documentation: Document every step you take during the investigation process.
• Caution: Avoid altering data on the device, as this can compromise the evidence.

Conclusion

Android forensics using ADB on Ubuntu is an effective technique for analyzing various types of data on Android devices. With a good understanding of the Android operating system and forensic tools, you can conduct comprehensive and accurate investigations.

Note: This guide provides an overview. The exact procedures may vary depending on the Android version, device, and types of data you wish to analyze.

Interesting Links

• Forensic: IT