Android device triage and forensics
You examine a suspect company phone from prepared evidence sets: you preserve the evidence, build a timeline from the bugreport, logs, package and usage records, look for traces of compromise and report the findings.
Level 401 · 18 lessons · 15 practice labs
Lessons
Collecting evidence
- Forensic principles on mobile: integrity, chain of custody, authority
- Acquisition types: logical, file system and backup
- Data collected with adb: bugreport, dumpsys, package list
- Hashing and keeping examination notes
- Device state: the locked phone and the limits of encryption
- Short task: write and carry out an ordered evidence collection plan for the simulated device
System records
- packages.xml and install history: what was installed, when and by whom
- Usage and battery statistics: which app ran when
- dumpsys with a forensic eye: accessibility, device admin, notification listeners
- logcat, dropbox and crash records
- Network records: Wi-Fi history, VPN and data usage
- Short task: find when and from where a suspicious app arrived, using the install records
App data and tools
- App artefacts: messages, browser history, downloads
- Processing an export with ALEAPP and reading the report
- Indicator checks with MVT
- Building a timeline: tying different sources to one clock
- Short task: scan a bugreport against an indicator list and interpret the matches
Capstone
- Capstone: examine suspicious activity on an executive's phone and write the forensic report
Practice labs
- Hash the evidence files and record them: Compute the SHA-256 hash of every file in the prepared evidence set and write it in the examination notes.
- Collect evidence from the simulated device in order: Collect the bugreport, package list and dumpsys output in order of volatility and note each step with its time.
- Write a collection plan and report the gaps: Write a plan stating which data can and cannot be obtained from a locked, encrypted device, and why.
- Find a package's install time and source: Extract the suspicious app's first install time and installer from the packages.xml export.
- Order the apps installed in the last thirty days: Produce a time-ordered list from the install records and mark the non-store ones.
- Tie an install to download and browser traces: Join the link the APK was downloaded from, the download record and the install moment on one timeline.
- Extract enabled accessibility services from dumpsys: Find the enabled services and their packages in the dumpsys output of the evidence set.
- Find the app running at night from usage statistics: Show from usage and battery records the app active while the user slept.
- Find the leak window from Wi-Fi and data usage records: Match network records to app activity and report the time and size of the unusual upload.
- Produce an ALEAPP report and learn its sections: Process the prepared export and find the installed apps section in the report.
- Scan a bugreport against an indicator list with MVT: Run the scan and interpret which record each match comes from.
- Verify tool output by hand: Find two MVT-flagged matches in the raw records and prove one is a false alarm.
- Convert times from three sources to one time zone: Convert log, package record and usage statistic times to UTC and order them.
- Build a timeline for one incident: Order the link click, install, permission grant and first network connection with their evidence sources.
- Write the forensic report for an executive's phone: From the evidence set of a Demirsu Enerji executive's device, deliver a report with findings, timeline, limits and recommendations.
About this course
You examine a suspect company phone from prepared evidence sets: you preserve the evidence, build a timeline from the bugreport, logs, package and usage records, look for traces of compromise and report the findings.
What you will learn
- Collecting evidence
- System records
- App data and tools
- Capstone
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.