M 143: Forensic Acquisition from Android (15 pts extra)

What You Need for This Project

A computer with Android Studio and an emulator installed, with root access, which you prepared in a previous project.

Purpose

To collect data from an Android emulator and analyze it with Autopsy.

Start your Emulator

Start your emulator, as shown below.

Putting Evidence on the Phone

The steps depend on your operating system. Follow the appropriate instructions below.

Mac Users
Open a new Terminal window and execute these commands:
cd cat .emulator_console_auth_token
Carefully highlight and copy your auth_token, as shown below.
Execute these commands, inserting the correct auth token in the second one:
nc localhost 5554 auth k5EPEBUt7Gf3NQ9v sms send 1112223333 "HELLO, PHONE!"

Windows Users
In a Web browser, go to
https://nmap.org/download
Download Nmap and install it.
Execute these commands. If it asks for an auth token, follow the instructions on your screen to find it.
ncat 127.0.0.1 5554 sms send 1112223333 "HELLO, PHONE!"

On your emulator, open Messages.

Click Agree.

You received the SMS. Reply, as shown below.

In your Terminal or Command Prompt, execute this command:

gsm call 11122233333

Your phone rings. Answer the call, as shown below.

After a few seconds, hang up.

In your Terminal or Command Prompt, press Ctrl+C to terminate the netcat connection.

Opening a Root Shell

In a Command Prompt or Terminal, execute these commands:

adb shell
su

You get a root shell, as shown below.

Collecting User Data

All the user data, including SMS and phone calls, is in the /data directory.

In your root shell, execute this command:

tar --exclude=android_image.tar.gz \
 -cvzf /sdcard/Download/android_image.tar.gz /data

A lot of filenames scroll by.

When it's done, you see a # prompt, as shown below.

Execute these commands to exit the shell and download the captured data, as shown below:

exit
exit
cd
cd Downloads
adb pull /sdcard/Download/android_image.tar.gz

Launch your Windows Analysis Machine

Launch the Windows machine you use, with Autopsy on it.

Installing 7-Zip

On your Windows analysis machine, if you don't have 7-Zip, get it here:

https://7-zip.org

Unzipping the Data

Put the android_image.tar.gz file on your Windows desktop.

Mac M1 Users
You cannot copy and paste files from the host to the Windows guest, as of March 2023, because VMware 13 doesn't fully implement VMware Tools.
You can use PowerShell's "scp" command, however, using the IP address of your Mac, and your Mac's username and password, with a command like this:
scp username@ip_of_mac:/Users/username/Downloads/android_image.tar.gz .

If you don't have 7-Zip on your Windows machine, get it here:

https://7-zip.org/

Right-click the android_image.tar.gz file and click 7-Zip, "Extract Here".

A android_image.tar file appears on your desktop.

Right-click the android_image.tar file and click 7-Zip, "Extract Here".

A data folder appears on your desktop.

If 7-Zip shows some messages saying "Can not create symbolic link", just ignore them and click Close.

Analyzing the Android Data with Autopsy

Launch Autopsy.

Creating a New Case

From the Autopsy menu bar, click the "New Case" button.

Enter a Case Name of Android.

Click the Next button.

Click the Finish button.

Importing the Android Data

In the Add Data Source box:

At step 1: "Select Host", click the Next button.
At step 2: "Select Data Source Type", click "Logical Files". Click the Next button.
At step 3: "Select Data Source", click the Add button. Navigate to your desktop. Click the data folder and click Select. Click the Next button.
At step 4: "Configure Ingest", clear all the boxes except "Android Analyzer (aLEAPP)", as shown below. Click the Next button.

At step 5: "Add Data Source", click the Finish button.

Examining the Evidence

In the left pane of Autopsy, in the "Data Artifacts" section, useful data from Android appears, including Phone calls, Messages, and Web searches, as shown below.

M 143.1: Phone Source (15 pts)
Find the text covered by a green box in the image below. That's the flag.

Sources

https://resources.infosecinstitute.com/topic/android-forensic-logical-acquisition/

http://sleuthkit.org/autopsy/docs/user-docs/4.18.0/aleapp_page.html

Posted 10-7-22
Mac M1 file transfer tip added 3-13-23
Flag number corrected 7-1-23