dissertation

Figure 5.13: Contact list application showing empty contact list when USBdebugging is onCellebrite will be used to perform an extraction of the phone contactlist. This should contain only the number for Cellebrite technical support.Another extraction will be performed using XRY. This should still show thesame number for Cellebrite technical support. The phone will be disconnectedfrom the USB cable and the contact list inspected using the built-incontact list application. This should also only show the number for Cellebritetechnical support. Thirty seconds should be allowed to pass, and the built-incontact list application opened again. This should now show the two contactsin the real contact list.The Cellebrite extraction report showed only the false contact intendedfor Cellebrite (figure 5.16a). The contact list application on the phone sawthe same information (figure 5.16b), and so did XRY (figure 5.16c). After disconnectingthe phone and waiting thirty seconds, the contact list applicationon the phone saw the two contacts in the real contact list.Beginning a new series of extractions with XRY, the XRY extractionreport showed only the false contact for XRY (figure 5.17a). The built-in42