dissertation

The standard UNIX utility su allows a user to change their user ID, andthus gain root access. It is available in the user’s search path 3 by default inCyanogenMod. If moved outside the standard search path, or renamed, itwould still be available to a user who knows where to find it (or a sufficientlythorough forensic analyst), but unavailable to automatic tools which expectit to be in the default location.Removing the su application completely still leaves the alternate recoveryimage. Using this, a complete new operating system can be installed on thedevice. Whether any user data survives this operation depends on the exactinstallation process. For example, using ClockworkMod to upgrade fromCyanogenMod 7.1 to CyanogenMod 7.2 preserves all user data. For antiforensicspurposes, it would be recommended to modify the recovery imageto require wiping all data before installing a new operating system.For maximum protection against forensic examination, the recovery imageshould be reverted to the standard Android one. There would then be nointentional ways to gain root access, which would place a forensic investigatorin the same position as a hacker with a newly released phone, trying to getan alternative operating system installed. However, to cater to the enthusiastmarket, many phone manufacturers began to include supported ways ofunlocking the bootloader in 2011 [72]. This means that the investigator caneasily install their own recovery image and use that to install an operatingsystem granting root access with minimum alterations to the data alreadypresent on the device. The question would remain of how acceptable such aprocedure would be to a court, since it involves substantial modification ofthe device.7.5 SEAndroidStandard Android uses just the traditional UNIX discretionary access controlmechanism, which allows the superuser (root) to override any restrictions.When the phone is rooted, the user is allowed to install modified versions of3 A list of directories where the system automatically looks for programs when the usergives the name of a program to execute.58