<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-mobile-forensics
description: >-
  Mobile device forensic acquisition and analysis for iOS and Android including
  logical and file system extraction, SQLite database parsing, app artifact
  analysis, location data extraction, communication records, and deleted data
  recovery using Autopsy, ALEAPP, iLEAPP, and ADB.
domain: cybersecurity
subdomain: digital-forensics
tags:
  - mobile-forensics
  - ios
  - android
  - aleapp
  - ileapp
  - adb
  - sqlite
  - app-artifacts
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1437", "T1421", "T1636"]
  nist-csf: ["RS.AN-3"]
  frameworks: ["NIST SP 800-101r1"]
---

# Performing Mobile Forensics

## Overview

Mobile forensics extracts and analyzes data from smartphones and tablets.
This skill covers acquisition methods (logical, file system, physical),
iOS and Android artifact locations, SQLite database analysis, app-specific
artifact parsing, location history extraction, and automated analysis with
ALEAPP (Android) and iLEAPP (iOS).

## Prerequisites

- ADB (Android Debug Bridge) for Android extraction
- `libimobiledevice` for iOS logical acquisition
- ALEAPP, iLEAPP for automated artifact parsing
- Python 3.10+ with `sqlite3`
- Autopsy with mobile modules

```bash
pip install aleapp ileapp
sudo apt install adb libimobiledevice-utils
```

## Key Concepts

### Acquisition Types

| Type | Method | Data Access | Tool |
|------|--------|-------------|------|
| Logical | Backup API | User data, app data | ADB backup, iTunes backup |
| File System | Agent/root | Full file system | TWRP, checkra1n |
| Physical | Chip-off/JTAG | Raw flash | Cellebrite, specialized HW |
| Cloud | API/credentials | Synced data | elcomsoft, manual download |

### Android Key Artifact Locations

```
/data/data/<package>/           — App private data
/data/data/<package>/databases/ — App SQLite databases
/data/data/<package>/shared_prefs/ — App preferences (XML)
/data/system/users/0/           — User accounts and settings
/data/misc/wifi/                — WiFi configuration
/data/media/0/                  — Internal storage (photos, downloads)
/sdcard/                        — External storage
/data/data/com.android.providers.telephony/databases/mmssms.db — SMS/MMS
/data/data/com.android.providers.contacts/databases/contacts2.db — Contacts
/data/data/com.android.providers.calendar/databases/calendar.db — Calendar
```

### iOS Key Artifact Locations (iTunes Backup)

```
Manifest.db                     — File index for backup
HomeDomain/Library/SMS/sms.db   — iMessage / SMS
AddressBook/AddressBook.sqlitedb — Contacts
HomeDomain/Library/CallHistoryDB/CallHistory.storedata — Call logs
CameraRollDomain/Media/DCIM/    — Photos and videos
RootDomain/Library/Caches/locationd/consolidated.db — Location history
HomeDomain/Library/Safari/History.db — Safari browsing history
```

## Workflow

### Step 1: Android Logical Extraction via ADB

```bash
# Enable USB debugging on device, authorize host

# List connected devices
adb devices

# Full backup (apps + data)
adb backup -apk -shared -all -f android_backup.ab

# Extract specific databases
adb pull /data/data/com.android.providers.telephony/databases/mmssms.db
adb pull /data/data/com.android.providers.contacts/databases/contacts2.db

# File system listing
adb shell ls -la /data/data/
adb shell find /data/data/ -name "*.db" 2>/dev/null

# Screen capture for documentation
adb shell screencap -p /sdcard/screen.png && adb pull /sdcard/screen.png
```

### Step 2: iOS Logical Extraction

```bash
# List connected iOS devices
idevice_id -l

# Create unencrypted backup
idevicebackup2 backup --full ./ios_backup/

# List backup contents
python3 -c "
import sqlite3, os
db = sqlite3.connect('ios_backup/Manifest.db')
for row in db.execute('SELECT relativePath, domain FROM Files LIMIT 50'):
    print(f'{row[1]}: {row[0]}')
"
```

### Step 3: Parse SMS/Call Logs

```python
import sqlite3
import json

def parse_android_sms(db_path: str) -> list[dict]:
    conn = sqlite3.connect(db_path)
    conn.row_factory = sqlite3.Row
    rows = conn.execute("""
        SELECT address, body, date/1000 as timestamp, type, read
        FROM sms ORDER BY date DESC LIMIT 1000
    """).fetchall()
    sms_types = {1: "received", 2: "sent", 3: "draft"}
    return [{
        "address": r["address"],
        "body": r["body"][:200],
        "timestamp": r["timestamp"],
        "type": sms_types.get(r["type"], str(r["type"])),
        "read": bool(r["read"]),
    } for r in rows]
```

### Step 4: Automated Analysis with ALEAPP/iLEAPP

```bash
# ALEAPP — Android Logs Events and Protobuf Parser
aleapp -t tar -i android_extraction.tar -o ./aleapp_output/
aleapp -t directory -i /path/to/extracted/ -o ./aleapp_output/

# iLEAPP — iOS Logs Events and Protobuf Parser
ileapp -t tar -i ios_backup.tar -o ./ileapp_output/
ileapp -t directory -i /path/to/backup/ -o ./ileapp_output/
```

### Step 5: Location Data Extraction

```python
def extract_android_locations(db_path: str) -> list[dict]:
    """Extract location history from Google location cache."""
    conn = sqlite3.connect(db_path)
    conn.row_factory = sqlite3.Row
    rows = conn.execute("""
        SELECT latitude, longitude, accuracy, timestamp
        FROM CachedPosition ORDER BY timestamp DESC LIMIT 500
    """).fetchall()
    return [{"lat": r["latitude"] / 1e7, "lon": r["longitude"] / 1e7,
             "accuracy_m": r["accuracy"], "timestamp": r["timestamp"]} for r in rows]
```

## Detection

```yaml
title: Mobile Forensics Detection
id: 6a5b85b7-abc0-4801-a253-33bc13dc4f87
status: experimental
description: Detects suspicious activity related to performing mobile forensics techniques in digital forensics context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*mobile*"
  condition: selection
level: medium
tags:
  - attack.t1437
  - attack.t1421
  - attack.t1636
  - attack.collection
falsepositives:
  - Forensic investigation tools used by authorized incident response team
```

## Verification

- [ ] Device acquisition method documented with hash verification
- [ ] SMS/MMS database parsed with sender, recipient, timestamp, content
- [ ] Call logs extracted with duration and direction
- [ ] Contacts database correlated with communication records
- [ ] Location data plotted on timeline
- [ ] App-specific databases identified and parsed
- [ ] Deleted records recovery attempted (SQLite freelist pages)

## References

- [NIST SP 800-101r1 — Mobile Device Forensics](https://csrc.nist.gov/pubs/sp/800/101/r1/final)
- [ALEAPP](https://github.com/abrignoni/ALEAPP)
- [iLEAPP](https://github.com/abrignoni/iLEAPP)
- [Android Debug Bridge](https://developer.android.com/tools/adb)
- [libimobiledevice](https://libimobiledevice.org/)
