dissertation

7.3 EncryptionStarting with version 3.0 (also known as “Honeycomb”), Android implementsfull-disk encryption using the Linux standard “dm-crypt” system [28]. SinceAndroid series 3 was only available for tablets [14], encryption functionalitywas not available for smartphones until the release of Android 4.0 (“Ice CreamSandwich”) in October of 2011 [70]. No academic publications of the forensicsconsequences of this encryption have been found.According to the documentation for the encryption feature [12], encryptionrequires a boot-time password and a screen lock password, which haveto be identical. This password would probably be simple, since it needs tobe entered frequently on a device not intended for quick, accurate input oflong strings of characters. Since it is entered frequently, it might also bevulnerable to touch-screen attacks such as fingerprint smudge recognition[45].Using encryption may increase the viability of anti-forensic applications.If an analyst knows they will need a password to boot the phone, they maybe forced to leave it running instead of turning it off in order to removecomponents for separate analysis (such as the SIM card). This would increasethe relevance of anti-forensics for SIM contacts and SMS messages.7.4 UnrootingCurrent systems for rooting Android phones are permanent, in that theyallow unrestricted root access after they have been installed. However, thereis no technical reason why this has to be so. Since forensic tools can takeadvantage of root access to make logical or physical copies of the phone’smemory, removing this access would force these tools to use the contentprovider interfaces, which can have anti-forensic modifications.After modifying the operating system not to grant root access automatically,this root access can be made more or less difficult to recover, dependingon the user’s needs. More difficulty makes the device more safe from forensicexamination, but harder for the user to modify further.57