Eredità digitale sugli smartphone: cosa resta di noi nei dispositiv...

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

EREDITÀ DIGITALE SUGLI
SMARTPHONE: COSA RESTA DI NOI
NEI DISPOSITIVI MOBILI
Trento
9 Dicembre 2025

EREDITA’ DIGITALE
▪ Parleremo di smartphone
▪ In realtà l’eredità digitale è molto di più
▪ Account Cloud
▪ Computer
▪ Dis...

MOBILE FORENSICS
▪ Mobile Forensics
▪ Data-at-rest encryption on mobile devices
▪ Data extraction from Mobile Devices
▪ Bu...

MOBILE FORENSICS AND ENCRYPTION
▪ In the pre-smartphone era, mobile devices
lacked robust encryption mechanisms, leaving
u...

SAMSUNG GT-I9300
(LOCKED UNKNOWN CODE)

WIKO FEVER
(LOCKED UNKNOWN CODE)

SAMSUNG SM-G920F
(LOCKED UNKNOWN CODE)

SAMSUNG SM-G355H
(LOCKED UNKNOWN CODE)

NOKIA LUMIA 620 (RM-846)
(LOCKED UNKNOWN CODE)
This solution depends on the charge level of the battery, therefore
most of...

SAMSUNG SM-J500FN
(LOCKED UNKNOWN CODE)
An interesting feature of the Qualcomm chipset is that on many boot
failures the c...

HUAWEI EVA-L09
(LOCKED UNKNOWN CODE)

SAMSUNG SM-J510FN
(LOCKED UNKNOWN CODE)

BRIONVEGA N7010

JTAG

CHIP OFF

CHIP OFF

ANDROID ENCRYPTION (SIMPLIFIED)
https://source.android.com/docs/security/features/encryption
▪ Encryption is the process o...

ANDROID ENCRYPTION (SIMPLIFIED)
https://source.android.com/docs/security/features/encryption/file-based
▪ File-based encry...

ANDROID FBE AND MOBILE FORENSICS
▪ Old “physical” methods are not viable
▪ Each file has its own encryption key, so it imp...

ANDROID AFU VS BFU
BFU = Before First Unlock
▪ When a device is restarted, only device-encrypted files are decrypted
AFU =...

IOS ENCRYPTION (SIMPLIFIED)
https://help.apple.com/pdf/security/en_US/apple-platform-security-guide.pdf
▪ Apple uses a tec...

IOS ENCRYPTION (SIMPLIFIED)
▪ Data Protection is implemented by constructing and
managing a hierarchy of keys and builds o...

IOS ENCRYPTION (SIMPLIFIED)
▪ When a new file is created on devices supporting Data Protection, it’s assigned a class by
t...

IOS AFU VS BFU
BFU = Before First Unlock
When a device is restarted, only Class D files are decrypted
AFU = After First Un...

MOBILE FORENSICS TOOLS
Mobile Forensics Tools have capabilities to extract data on devices in AFU
state and to crack the p...

CELLEBRITE INSEYETS
https://cellebrite.com/wp-content/uploads/partner_summit_videos/APAC+Partner+Summit+2024+Day+1+May+8th...

CELLEBRITE INSEYETS
https://cellebrite.com/wp-content/uploads/partner_summit_videos/APAC+Partner+Summit+2024+Day+1+May+8th...

CELLEBRITE INSEYETS
https://cellebrite.com/wp-content/uploads/partner_summit_videos/APAC+Partner+Summit+2024+Day+1+May+8th...

CELLEBRITE INSEYETS
https://cellebrite.com/wp-content/uploads/partner_summit_videos/APAC+Partner+Summit+2024+Day+1+May+8th...

MAGNET GRAYKEY
https://cellebrite.com/wp-content/uploads/partner_summit_videos/APAC+Partner+Summit+2024+Day+1+May+8th.pdf

UFADE (WINDOWS/MAC)
https://github.com/prosch88/UFADE

ILEAPP
https://github.com/abrignoni/iLEAPP

ARTEX
https://doubleblak.com/

ANDROID TRIAGE (MAC/LINUX)
https://github.com/RealityNet/android_triage

ALEX (WINDOWS/MAC)
https://github.com/prosch88/ALEX

ILEAPP
https://github.com/abrignoni/iLEAPP

BUILDING THE USER PATTERN OF LIFE
▪ Some of the most commonly analysed artifacts
▪ Installed and uninstalled applications
...

INSTALLED AND UNINSTALLED APPLICATIONS

WI-FI NETWORKS

WI-FI NETWORKS

BLUETOOTH DEVICES

DEVICE AND APPLICATION USAGE
▪ Power Log
▪ Retention is between 3 and 7 days
▪ Battery Level
▪ Camera Use
▪ Buttons (Press...

BATTERY LEVEL

CAMERA USE

BUTTONS (PRESSED/RELEASED)

PLUGGED / UNPLUGGED

TORCH ON/OFF

DEVICE AND APPLICATION USAGE
▪ knowledgeC.db (up to iOS 16)
▪ Retention is 28 days
▪ Device locked/unlocked
▪ App “in focu...

DEVICE LOCKED/UNLOCKED

APP IN FOCUS

SCREEN BACKLIGHT (ON/OFF)

BLUETOOTH CONNECTIONS

MEDIA PLAYING

DEVICE AND APPLICATION USAGE
▪ Biome
▪ Retention is 28 days
▪ The new knowledgeC.db, introduced in iOS 15
▪ More than 200 ...

BIOME TEXT INPUT SESSION

WI-FI CONNECTIONS

GEOLOCATION
▪ cache.sqlite
▪ iOS Location Services Cache
▪ All location requests lead to an entry in this database
▪ Reten...

CACHED LOCATIONS

CACHED LOCATIONS
https://github.com/AXYS-Cyber/iCatch

GEOLOCATION
▪ Local.sqlite / Cloud-V2.sqlite
▪ Significant/Frequent Locations
▪ Vehicle Locations
▪ Retention is unknown (...

FREQUENT LOCATIONS

FREQUENT LOCATIONS

VEHICLE LOCATION

HEALTH
healthdb_secure.sqlite
Unlimited retention
Steps
Heart rate
Achievements
Workouts
Locations

PASSWORDS AND TOKENS
Keychain
Any app can store
 Password
 Encryption keys
 Access tokens
For example, Signal stores th...

APPLICATION DATA

RISKS FOR USERS
▪ A stolen/lost device can expose a lot of information about
yourself and/or your company
▪ Where you live...

APPLY: NEXT WEEK
On any personal device (smartphones/tablets)
 Verify that you are using a passcode
 Use long alphanumer...

APPLY: IN THE FIRST THREE MONTHS (PROTECT)
Evaluate usage of advanced protection mechanisms
 For Android devices, it depe...

APPLY: IN THE FIRST THREE MONTHS (TEST)
Test what you have learned today with test images
Various test images are freely a...

APPLY: WITHIN SIX MONTHS (VALIDATE)
Acquire your phone with free/opensource tools
 UFADE for iOS
 Android Triage and Avi...

Eredità digitale sugli smartphone: cosa resta di noi nei dispositivi mobili

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1009439 views
Storytelling For The Web: Integrate... by Chiara Aliotta 916874 views
Artificial Intelligence, Data and C... by OECD Directorate ... 815625 views
How to Leverage AI to Boost Employe... by SocialHRCamp 340314 views
2024 State of Marketing Report – by... by Marius Sescu 194495 views
Everything You Need To Know About C... by Expeed Software 217939 views

View on Slideshare

1 of 75 Ad

View on Slideshare

1 of 75 Ad