dissertation

that it is possible to use Java reflection to invoke arbitrary functions in otherapplications [76]. For example, Cellebrite sells products for phone backup,restoration and data transfer in addition to phone forensics. These wouldhave the ability to write data to the phone as well as read it. An investigationcould be conducted to see if the application has been reused between thesedifferent products, such that code for writing data is also present in theapplication uploaded by the forensics tool. If this is so, and an anti-forensicsmodule could call that code, it would be possible to make it look like theforensics tool intentionally destroyed evidence. Even if no such extraneousfunctionality is present, simply calling legitimate forensic functions is anunexpected order might be enough to confuse the analysis tool and ruin anydata extraction.In order to decompile these applications, they must first be captured. Initialexperiments with Cellebrite suggests that this is very easy. The deletionis triggered by the external Cellebrite tool, not internally from the uploadedapplication itself. To prevent the application from being deleted at the end ofan extraction, simply unplug the USB cable between the Cellebrite tool andthe phone before extraction is complete. The extraction will be aborted, butthe application will still be running. The application could then be downloadedto a PC by connecting to the phone using a standard USB debugconnection.The legality of this procedure would depend on the specific licence forthe forensic tool and its uploaded application, and the legal provisions foracademic reverse engineering in the jurisdiction where the research is takingplace.7.2 Detection of forensics toolsThe triggers used to detect the presence of a forensics tool currently use thename of the application uploaded to the phone, which would be easy for thetool vendor to change in the future.More sophisticated triggers are possible. Two are immediately apparentfrom the logs of Cellebrite and XRY behaviour in appendices B.1 and B.2:55