dissertation

and which part of the existing program logic handled the query. The sourcecode is in appendix C.2.5.1.1 CellebriteCellebrite uses the content provider in all observed cases. It starts by makingseven queries to the raw contacts and settings modules, collecting generalinformation such as the number of contacts and whether contacts are markedas deleted. It then goes through the raw contacts module, querying forinformation on each contact. For each contact, nine queries are made fordifferent kinds of information associated with it (name, phone number, e-mail address, etc.). The full log is in appendix B.1. One of the kinds ofinformation, “dispatch v2”, is not documented in the Android developers’manual and no such query has been seen to return information. Its purposeis therefore currently unknown. The extracted contact list, seen in figure 5.1,matched that entered and seen in the phone’s built-in contact list application.Figure 5.1: Contacts extracted by Cellebrite from an unmodified phone5.1.2 XRYXRY was also observed to use the content provider in all cases. It makesonly two queries in total, retrieving an entire data module with each query.28