dissertation

5.4.3 Rejecting installation of forensics toolsThe phone will be reinstalled using a modified CyanogenMod 7.2 operatingsystem. The only difference from the standard code will be the modificationsto the package manager for rejecting installation of applications named“com.client.appA” or “example.helloandroid”. Extractions of the contactlist will be performed using Cellebrite and XRY, and the extraction resultcompared to that from an unmodified CyanogenMod.Cellebrite completely failed to perform the extraction, instead presentingthe error message in figure 5.8 to the user.Figure 5.8: Error from Cellebrite when installation was rejectedXRY completed the extraction. However, the summary (figure 5.9a) reportsthat an error has occurred and that the extraction was incomplete. Anerror was also reported in the log (figure 5.9b), but this was not particularlyclear on what went wrong and what the consequences were. The reportwas missing the sections “Device/App Usage”, “Contacts” and “Web/Bookmarks”.5.4.4 Hardcoded false contact listThe phone will be reinstalled using a standard CyanogenMod 7.2 operatingsystem. Using the built-in contact list application, two contacts will be enteredinto the phone contact list (see figure 5.10). Extractions of the contactlist will be performed using Cellebrite and XRY, and both should extract38