dissertation

the phone is in USB debugging mode, and in 5.4b it is not. Both images containmostly raw information, so the processed information indicating USBconnection and debugger state 1 has been indicated with outlines. They aredifferent and match the physical actions performed, so the program can distinguishbetween the different cases.(a) USB connected, debugging on(b) USB connected, debugging offFigure 5.4: Screenshots of USBMonitor output5.4.2 Response delaysThe phone will be reinstalled using a modified CyanogenMod 7.2 operatingsystem. The only modification from default will be the insertion of a delayinto each query of the contact list provider. Extractions of the contact listwill be performed using Cellebrite and XRY, and the delay increased untilthe tools present errors instead of performing successful extractions.Cellebrite has a low tolerance for response delays. It accepts a delay offive seconds at each call to query(), but ten seconds is enough to make it1 The debugger is indicated by its name “ADB”, which stands for “Android DebugBridge” [13].36