dissertation

and interpretation of raw data may be impossible due to formats being undocumented.Therefore, phone forensics is mostly performed by letting thephone run its software and having the forensics tools ask that software forinformation.This means that the forensics tools trust the phone software to returnthe correct results. In particular, both Cellebrite and XRY use the standardcontent provider interfaces to retrieve personal data from Android phones.Both tools can also perform logical acquisitions of the phone’s entire memory,thereby bypassing the high-level phone software and only trusting the phone’sfile system driver to return the correct files. However, using that mode ofacquisition requires that the tool or the analyst perform data interpretationthemselves, without the help of the phone software. Both tools also use standardmethods of installing software, thereby trusting the package manager toinstall that software correctly. These high-level software packages, in turn,trust the lower levels to function correctly. Therefore, the forensics tools alsotrust, by extension, all lower levels of the Android stack, including the Dalvikvirtual machine, the Linux kernel and the hardware.Cellebrite and XRY place slightly different levels of trust in differentcomponents of the Android phone. When the phone refused to install theforensics application, Cellebrite refused to run and presented an error messageto the analyst, while XRY partially completed the extraction, reporteda partial error, and produced a report containing very little data. Cellebritewas also more time-sensitive, with a ten second delay for each query beingenough to cause errors. XRY, in contrast, did not report any errors evenafter six hours, and completed the extraction successfully if left alone forthat time.6.2 ModificationAny component of a system under forensic analysis that is trusted by oneparty is a point of attack for their opponent. Since the content providersand package manager are trusted by Cellebrite and XRY, they are naturaltargets for anti-forensics.50