Digital forensics is a field of great interest for users, developers, CxO, law enforcement agencies, prosecutors, judges, lawyers. Very often the digital evidence analysis has a great impact on prosecutor decisions and people lives. In all the talk made ad SFScon(s) we’re trying to help people understand what is digital forensics and how to do it avoiding the “black box” forensics and increase our awareness. This year we’ll see briefly how to go mobile, acquiring messaging applications data (WhatsApp) in a forensically sound mode with ADB and learn how to do acquisition when no extraction is possible. We’ll show data extraction with the APK Downgrade technique and screenshooting and video registration in case you’re unable to do anything else.

1. © D.S.A. S.r.l. SFSCONF 12-11-2021
Open Source Digital Forensics Labs 103
Open Source digital investigations
Alessandro Farina – forensics@dsa.it

2. Open Source Digital Forensics Labs 103
Mobile forensics on Android with ADB
✓ APK Downgrade (WhatsApp)

3. Open Source Digital Forensics Labs 103
Digital Evidence
«What is digital forensics? Digital forensics is the field of forensic science that is concerned with
retrieving, storing and analyzing electronic data that can be useful in criminal investigations. This
includes information from computers, hard drives, mobile phones and other data storage devices.”
(https://www.nist.gov/digital-evidence)
For Italian Law: genuinità, non ripudiabilità, imputabilità ed integrità
Translation: authenticity, non repudiatability, attributability and integrity

4. Open Source Digital Forensics Labs 103
What is ADB?
The Android Debug Bridge, known as adb is a programming tool used for debugging that are based on
Android using a USB or TCP connection. It consists of a client and server on the host PC, where the server
connects to the daemon on the Android device. It has been available since 2007 and includes various
features, such as a shell and the possibility to make backups.
License:Apache License 2.0
Source code: https://android.googlesource.com/platform/packages/modules/adb/

5. Open Source Digital Forensics Labs 103

6. Open Source Digital Forensics Labs 103
APK Downgrade
Last version -> adb backup -> 1KB file
Legacy version -> adb backup -> approx 130 MB file

7. Open Source Digital Forensics Labs 103
Name Description
devices List all the (android) devices connected to the pc
shell Runs shell commands on the device
pull copy files/dirs from device
reboot You seriously need command description?
install Install an APK on the device
backup Saves data from an app to a local file
ADB commands we’ll use in the lab

8. APK Downgrade – Lab’s Videos
WhatsApp

10. Some useful links
http://www.linuxleo.com/
(very good introduction to DF)
Alessandro Farina
forensics@dsa.it
https://www.autopsy.com/
https://www.caine-live.net/
ELECTRONIC EVIDENCE GUIDE
www.coe.int/cybercrime https://tsurugi-linux.org/index.php