SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsre-mobile-forensics

re-mobile-forensics

Data & analytics

View repository

Updated 10-15 21:34

About this skill

Mobile device forensics

When to use / when not to use

  • Use: data extraction from device backup/image, app data forensics, deleted recovery, timeline reconstruction
  • Use: parsing app data on-disk paths (database/preferences/cache) — app structure understanding pairs with [[re-mobile]]
  • Use: point-in-time comparison forensics (data changes before/after backup / deleted record comparison)
  • Use: lightweight targeted extraction (single-app single-table data — direct run-as/single-app backup, no need for full extraction)
  • Use: recoverability assessment of deleted data (determine first before acting, avoid ineffective time consumption)
  • Use: when the device is offline/damaged (backup files can still be parsed — backup parsing does not depend on the device being online)
  • Do not use: app reverse engineering analysis ([[re-mobile]]); general file system analysis ([[re-disk-forensics]]); dynamic extraction from running processes ([[re-frida]])
  • Do not use: cloud backup/cloud sync data (Google/iCloud cloud side is not this skill, forensic scope requires separate authorization)
  • Do not use: unauthorized devices (red line: authorized devices only; device isolation and preservation principles see [[gotchas]])

Tool preparation

adb (Android device interface)

  • Linux: apt install adb / dnf install android-tools；macOS: brew install android-platform-tools; Windows: official platform tools
  • Verify: adb --version；adb devices requires device with USB debugging enabled and authorized (confirm via on-screen popup)

libimobiledevice (iOS device interface)

  • Linux: apt install libimobiledevice-utils；macOS: brew install libimobiledevice; Windows: official build
  • Verify: idevice_id -l(list devices)

Backup parsing tools

  • Android: abe（Android Backup Extractor，Java jar，GitHub nelenkov/android-backup-extractor：java -jar abe.jar unpack backup.ab backup.tar) or equivalent python script; verify: java -jar abe.jar --help(requires Java, installation see [[re-java]])
  • iOS: idevicebackup2 + manifest parsing (see step 2)
  • sqlite3 (database reading — Linux: apt install sqlite3；macOS: brew install sqlite3; Windows: official build); verify: sqlite3 --version
  • foremost (data carving — Linux: apt install foremost；macOS: brew install foremost); verify: foremost -h
  • python3 (parsing script): installation see [[re-python]] tool preparation

Procedure steps

Execute in order; device operations follow authorization boundaries (red line: authorized devices only). Forensic sequence: isolation (network disconnection/airplane mode) → record device state (version/unlock/encryption/network) → read-only extraction first → archive artifacts. Archive artifacts at each step (path + sha256, see [[re-triage]]); remote wipe and preservation details see [[gotchas]].

  1. Android extraction：

    adb backup -f backup.ab -all        # 全量备份（应用需允许备份）
adb backup -f app.ab -apk -noobb com.target.app   # 单应用备份（按包名）
adb shell run-as com.target.app ls data   # 应用沙箱（debuggable 应用）
# root 设备：dd 镜像关键分区 / adb pull /data 直接提取
    • Backup feasibility pre-check:adb shell bmgr list transports(confirm system backup service is available; no output/error → adb backup unavailable, switch path)
    • Device state record: version (adb shell getprop ro.build.version.release) + encryption/unlock state (affects subsequent parsing path)
    • adb backup current status: officially deprecated since Android 12, app data of targetSDK 31+ is no longer exported (only valid for targetSDK<31 or debuggable apps, Play Store new apps basically unavailable) — when invalid, switch to root/image extraction (criteria see [[decision-tree]])
    • ab format: magic number ANDROID BACKUP + version/flag bytes (compression/encryption bits) + optional AES-256-CBC encryption parameters + tar (may be deflate-compressed) payload
    • Backup parsing: ab header → unpack tar (encrypted backups require the backup password; if no password, mark as non-extractable); first use file backup.ab to verify magic number and size
    • Artifact storage: separate directory + name containing device identifier/time (to prevent confusion across multiple devices)
    • Parsing combination routine:abe unpack backup.ab backup.tar(the encrypted backup password is the trailing positional argument:abe unpack backup.ab backup.tar <密码>, or set the ABE_PASSWD environment variable) → tar tf list contents → sqlite3/plist analysis
    • App sandbox:run-as(debuggable)/read directly on rooted devices;allowBackup=false 's app backup is empty and has no warning (see gotcha 2)
    • run-as binary-safe pull:adb exec-out run-as com.target.app cat files/x.db > x.db(exec-out does not perform terminal escaping)
    • root image note: first check the partition table (adb shell ls /dev/block/by-name/ or cat /proc/partitions) then dd the target partition; image artifacts are large, confirm disk space first
    • Hardware Keystore keys cannot be exported via backup (bound to device hardware; note the limitation)
    • Database extraction → sqlite3 (SQLite page structure method in [[re-disk-forensics]])

  2. iOS extraction：

    idevicebackup2 backup ./backup_dir
# 备份结构：Manifest.plist（元数据）+ Manifest.db（文件索引）+ 按 fileID 分目录的文件
    • Backup structure: Manifest.db (SQLite file index: domain/relative path → fileID, iOS 10+; earlier versions use Manifest.mbdb), Manifest.plist (backup metadata: IsEncrypted/BackupKeyBag/ManifestKey/device info), Info.plist (device info), Status.plist (backup status), files named by fileID (fileID = SHA1(domain + "-" + relativePath), derived from the path and unrelated to content; see [[gotchas]] parsing pitfalls)
    • First connection requires device-side trust (Settings > General > Device Management/Trust This Computer) — when untrusted, idevice_id produces no output
    • Encrypted backup determination: read the IsEncrypted key of Manifest.plist (even in encrypted backups Manifest.plist can still be read in plaintext; the key material BackupKeyBag/ManifestKey is in it); what is encrypted is Manifest.db and the contents of each file — the backup password is required for decryption (if no password, mark as non-extractable)
    • Keychain data is in keychain-backup.plist and likewise requires the backup password for decryption (the key is derived from the password; tools differ greatly, operate according to the actual tool documentation)
    • App data paths: Library/Preferences (plist preferences), Documents (user data), Caches (cache), Library/Application Support (common location for databases) — for understanding app structure see [[re-mobile]]
    • Extraction priority: databases > preferences > cache (cache may contain remnants of deleted content)
    • Backup integrity verification: check item by item against the Manifest.db index — the fileID file corresponding to each domain/relative path actually exists; when the index and files are inconsistent, note it
    • Choosing between backup and live extraction: backup preferred (does not touch the device, good evidence integrity); when the latest state is needed, perform live extraction and record the operation time
    • When a local backup already exists, directly parse the default directory:~/Library/Application Support/MobileSync/Backup(each device has its own subdirectory; verify the UDID to prevent mixing up devices)

  3. Deletion recovery and timeline：

    • SQLite deletion records: freelist pages/WAL not-yet-checkpointed pages/unallocated page remnants — first confirm journal_mode (WAL/delete/journal), then choose the recovery path; for the method see [[re-disk-forensics]] database file format
    • Data carving: foremost recovers files by file signature from unallocated space (images/archives/database pages); by default it covers common signatures (jpg/png/zip); for custom types use a configuration file (-c); verify recovered items with magic/readability ([[re-triage]] preliminary triage)
    • Note for encrypted devices: under Android FBE/full-disk encryption, unallocated pages are ciphertext, so carving is ineffective—prioritize the backup/already-decrypted file paths in the image (see Pitfall 8)
    • Timeline reconstruction: file timestamps + database record times (normalize to UTC first, annotate device time zone—Pitfall 4) + Status.plist backup time point (supporting evidence)
    • Cross-validate recovered data: when the same record appears in multiple databases (e.g., chat database + index database), cross-compare to increase credibility
    • Output: timeline table (time/action/source) + recovered data (archived by app/data type); for timeline evidence grading see [[decision-tree]]

  4. Evidence Integration and Delivery：

    • Summary: timeline table + extract inventory (source/extraction method/credibility for each type of data) + method record
    • Deliver conclusions in the review format per [[re-analyze/analysis-contract]] (conclusion/evidence/confidence); deletion recovery carries a "partial recovery" qualification

Cross-Domain Joint

  • [[re-forensics]] gateway: this skill belongs here
  • [[re-disk-forensics]]: SQLite structure/WAL/deletion recovery methods
  • [[re-mobile]]: understanding App structure (sandbox paths/data structures)
  • [[re-frida]]: runtime dynamic extraction (this skill is on the static/backup side; the two are complementary)
  • [[re-triage]]: preliminary triage of artifacts (type/magic/hash)
  • [[re-mem-forensics]]: interface with device memory dump analysis (rooted devices can dump memory)
  • [[re-analyze/analysis-contract]]: conclusion delivery format

Common Pitfalls and Traps

  • Encrypted backup without key: symptom—backup cannot be parsed; cause—AES encryption; countermeasure—if there is no password, mark as not extractable, do not brute-force crack (authorization boundary)
  • ADB backup permission restrictions: symptom—backup is empty; cause—app does not declare allowBackup or targetSDK≥31 (Android 12+); countermeasure—switch to root/image extraction and annotate path limitations
  • iOS hash path confusion: symptom—file cannot be found; cause—backup files are organized into two-level directories by fileID (a SHA1 derived from the path, not a content hash) (first two characters of fileID/full fileID), not by original name; countermeasure—first parse the domain/relative path ↔ fileID mapping in Manifest.db, then locate the file
  • Timeline time zone: symptom—times are misaligned; cause—device time zone is inconsistent with the forensic time zone; countermeasure—record uniformly in UTC and annotate the device time zone
  • Sandbox boundary: symptom—cannot obtain the target data; cause—no root/not jailbroken; countermeasure—deliver according to the extractable scope (qualified conclusion), do not exceed authorization
  • Device connected to the network is remotely wiped: symptom—data disappears/changes during extraction; cause—device network connectivity triggers remote wipe/sync overwrite; countermeasure—isolate first (airplane mode/network disconnected), then connect to power to prevent automatic shutdown
  • Backup corrupted midway: Symptoms — backup file incomplete/parse errors; Cause — operation interrupted (cable/lock screen/insufficient space); Countermeasure — before retrying, confirm space and connection are stable, archive the artifact's sha256; for corrupted backups, proceed with carving as unallocated data
  • Missing integrity verification: Symptoms — extracted data is tampered with/incomplete without knowledge; Cause — no verification performed; Countermeasure — archive the artifact's sha256, for image-type artifacts verify the partition digest (if no digest, note that verification is impossible)
  • FBE/full-disk encryption: Symptoms — what carving recovers is ciphertext; Cause — device has file-based/full-disk encryption enabled (default on modern Android); Countermeasure — prioritize paths to already-decrypted files within backups/images, note encryption limitations
  • Lock screen/authorization status: Symptoms —adb devices shows unauthorized/offline; Cause — lock screen not unlocked/USB debugging authorization expired; Countermeasure — unlock first (within authorized scope) then connect, record authorization status
  • adb multi-device ambiguity: Symptoms — command errors/operating on the wrong device; Cause — multiple devices connected without specifying serial number; Countermeasure —adb devices confirm the serial number, add to the command -s <serial>
  • Deleted-recovery misjudgment: Symptoms — the "deleted" records recovered are actually redundant copies retained by the app; Cause — the app stores them in multiple places; Countermeasure — use "absent in backup + present in image" as the deletion criterion (cross-validation)
  • Backup password forgotten: Symptoms — there is a password-protected backup but the password is lost; Cause — the password was not recorded alongside the backup; Countermeasure — record the password source immediately at extraction time (within authorized scope), note it if unrecoverable
  • Backup format version differences: Symptoms — the parsing tool reports a format error; Cause — differences between old and new Android/iOS backup formats; Countermeasure — use a toolchain matching the system version, note the version
  • For scenario branches and extraction path selection see [[decision-tree]]; for boundaries and counterexamples see [[gotchas]]