dissertation

Android is an open system, with specifications and source code freelyavailable. Several projects use that source code to build community distributionsof Android which can be installed on many different models ofphones. The installation requires that the phone be rooted, which is possibleto do on many phones and popular among technologically sophisticated customers.Step-by-step guides available on the Internet describe how to rootphones and install community distributions of Android.These community distributions depend upon contributions of code fromthe general public. They therefore make it easy to modify their code andinstall the modified versions. While programming skills are a prerequisite,this dissertation has shown that it is possible to modify and replace contentproviders and the package manager.6.3 DetectionBehaviour that is repeated is grounds for identification. If that behaviouris not the same as that produced by regular use, it is grounds for anomalydetection. Cellebrite and XRY provide both. Every time the behaviour ofeither was observed, each used the same name its uploaded application, andthat application queried the content providers in the same way. They bothalso require the phone to be in USB debugging mode, which is unlikely to bethe case for a phone in regular use.The experiments performed here have shown that it is possible to distinguishbetween normal use and forensic analysis by looking at whether USBdebugging is enabled, and that it is possible to distinguish between differentforensics tools by looking at the names of their applications.6.4 RevertingMost phone anti-forensics is concerned with overwriting or deleting information.While this hopefully makes the data completely unavailable to theforensic analyst, it also makes it unavailable to the legitimate user if the51