dissertation

The two modules are raw contacts and data. It is possible for XRY tointerpret this data using information found in the Android API referencemanual [4]. The full log is in appendix B.2. The extracted contact list, seenin figure 5.2, matched that entered and seen in the phone’s built-in contactlist application.Figure 5.2: Contacts extracted by XRY from an unmodified phone5.2 TriggeringPrevious work has triggered anti-forensic behaviour either on finding logentries relating to the installation of forensics tools or on connection of aUSB cable. Reading logs requires waiting for the log messages to show up andthen spending effort reading and interpreting them, while USB connectionsare frequent in everyday use.One attribute common to all examined forensics tools is that they requirethe phone to be set to USB debug mode. This lets the tool control the phoneand e.g. install applications. Setting the phone to debug mode requiresgoing deep into the settings menu and acknowledging a warning that “USBdebugging is intended for development purposes only” (see figure 5.3). Italso removes the possibility to use the phone as a USB memory and transferfiles to and from it using standard file management tools. The fact thatactivating debug mode removes these normal and desirable features suggeststhat most users will not have debug mode activated. If so, triggering antiforensicbehaviour upon activation of USB debugging will have a lower falsepositive rate than triggering on all USB connections.A stand-alone application will be built to be a receiver for the intentbroadcast when the USB state of the phone is changed. Using the extrainformation contained in the intent, the program determines whether the29