<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-mobile-device-forensics
description: >-
  Mobile device forensic acquisition and analysis using Andriller, MVT,
  libimobiledevice, and adb. Covers logical and physical extraction of
  Android and iOS devices, app data parsing, communication artifact
  recovery, and geolocation timeline reconstruction for incident
  response and legal investigations.
domain: cybersecurity
subdomain: digital-forensics
tags:
  - mobile-forensics
  - android
  - ios
  - adb
  - mvt
  - libimobiledevice
  - andriller
  - cellebrite
  - logical-extraction
  - physical-extraction
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1437", "T1421", "T1430"]
  nist-csf: ["RS.AN-1", "RS.AN-3"]
  frameworks: ["NIST SP 800-101r1", "SWGDE Mobile Forensics", "ISO 27037"]
---

# Performing Mobile Device Forensics

## Overview

Mobile device forensics involves the acquisition, preservation, and
analysis of data stored on smartphones and tablets. This skill covers
Android and iOS extraction methods ranging from logical (backup-based) to
physical (chip-off), application artifact parsing, deleted data recovery,
and timeline correlation using open-source tooling.

## Prerequisites

- Linux forensic workstation (SIFT, Tsurugi, or Ubuntu 22.04+)
- `adb`, `libimobiledevice`, `mvt`, `andriller`, `ALEAPP`, `iLEAPP`
- Faraday bag for device isolation during transport
- USB data cables (Lightning, USB-C, Micro-USB)
- Device PIN/passcode or consent/warrant for unlock

```bash
sudo apt install adb libimobiledevice-utils ideviceinstaller
pip install mvt andriller aleapp ileapp
```

## Key Concepts

### Extraction Levels

| Level | Method | Data Access | Root Required | Court Admissibility |
|-------|--------|-------------|---------------|---------------------|
| Manual | Screenshots / notes | Visible UI only | No | Low |
| Logical | Backup / adb pull | User data, app DBs | No | Medium |
| File System | Agent-based / root | Full FS including deleted | Yes | High |
| Physical | Chip-off / JTAG / EDL | Raw NAND / eMMC | N/A | Highest |
| Cloud | API / token extraction | Synced data | No | Medium |

### Android Evidence Locations

```
/data/data/<package>/databases/     # App SQLite databases
/data/data/<package>/shared_prefs/  # App preferences XML
/sdcard/DCIM/                       # Camera photos/videos
/data/system/gesture.key            # Lock pattern hash
/data/misc/wifi/WifiConfigStore.xml # Saved WiFi networks
/data/user_de/0/com.android.providers.contacts/databases/
```

### iOS Evidence Locations

```
/private/var/mobile/Library/SMS/sms.db           # iMessage / SMS
/private/var/mobile/Library/CallHistoryDB/        # Call logs
/private/var/mobile/Media/DCIM/                   # Photos
/private/var/mobile/Library/Safari/History.db      # Safari history
/private/var/wireless/Library/Databases/CellularUsage.db
```

## Workflow

### Step 1: Device Isolation and Documentation

```bash
# Place device in Faraday bag to prevent remote wipe
# Document device state: screen on/off, battery level, damage

# Record device identifiers
adb devices -l                        # Android — serial, model
idevice_id -l                         # iOS — UDID
ideviceinfo -k ProductType            # iOS — device model
ideviceinfo -k ProductVersion         # iOS — OS version

# Photograph device front, back, IMEI label
adb shell getprop ro.serialno         # Android serial
adb shell getprop ro.product.model    # Android model
adb shell getprop gsm.sim.operator.alpha  # Carrier
```

### Step 2: Android Logical Extraction

```bash
# ADB backup (legacy but still useful < Android 12)
adb backup -apk -shared -all -f android_backup.ab

# Convert AB to tar for analysis
java -jar abe.jar unpack android_backup.ab backup.tar

# Direct file pull (requires USB debugging)
adb pull /sdcard/ ./sdcard_extract/
adb pull /data/data/com.whatsapp/ ./whatsapp_extract/

# Package list for installed apps
adb shell pm list packages -f > installed_apps.txt

# Dumpsys for runtime state
adb shell dumpsys battery > battery_state.txt
adb shell dumpsys location > location_state.txt
adb shell dumpsys notification > notifications.txt
```

### Step 3: iOS Logical Extraction

```bash
# Create unencrypted iTunes-style backup
idevicebackup2 backup --full ./ios_backup/

# For encrypted backups (preserves health, keychain data)
idevicebackup2 backup --full -p ./ios_encrypted_backup/

# Extract crash logs
idevicecrashreport -e ./crash_logs/

# Syslog capture
idevicesyslog > syslog_capture.txt &
```

### Step 4: Parse Extracted Data with ALEAPP / iLEAPP

```bash
# Android — ALEAPP (Android Logs Events And Protobuf Parser)
python -m aleapp -t tar -i backup.tar -o ./aleapp_report/

# iOS — iLEAPP (iOS Logs Events And Plists Parser)
python -m ileapp -t tar -i ios_backup.tar -o ./ileapp_report/

# Andriller — Android logical extraction + analysis
andriller --input ./android_backup/ --output ./andriller_report/
```

### Step 5: MVT — Mobile Verification Toolkit (Spyware Detection)

```bash
# Check Android backup for known spyware indicators (Pegasus, Predator)
mvt-android check-backup --output ./mvt_android/ ./android_backup/

# Check iOS backup for compromise indicators
mvt-ios check-backup --output ./mvt_ios/ ./ios_backup/

# Check iOS filesystem dump
mvt-ios check-fs --output ./mvt_ios_fs/ ./ios_fs_dump/

# Use custom IOC file
mvt-ios check-backup --iocs pegasus_iocs.stix2 \
  --output ./mvt_custom/ ./ios_backup/
```

### Step 6: Communication and Location Timeline

```bash
# Extract SMS/MMS database (Android)
adb pull /data/data/com.android.providers.telephony/databases/mmssms.db .
sqlite3 mmssms.db "SELECT date, address, body FROM sms ORDER BY date;"

# Extract call logs (Android)
adb pull /data/data/com.android.providers.contacts/databases/calllog.db .
sqlite3 calllog.db "SELECT date, number, duration, type FROM calls ORDER BY date;"

# GPS / location history
sqlite3 CellularUsage.db "SELECT * FROM ZLOCATION ORDER BY ZTIMESTAMP;"

# WhatsApp message extraction
sqlite3 msgstore.db "SELECT timestamp, key_remote_jid, data FROM messages ORDER BY timestamp;"
```

## Detection

```yaml
title: Mobile Device Forensics Detection
id: a10a8b76-6fad-4a86-918f-4c398244a8e3
status: experimental
description: Detects suspicious activity related to performing mobile device forensics techniques in digital forensics context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*mobile*"
  condition: selection
level: medium
tags:
  - attack.t1437
  - attack.t1421
  - attack.t1430
  - attack.collection
falsepositives:
  - Forensic investigation tools used by authorized incident response team
```

## Verification

- [ ] Device isolated in Faraday bag before extraction
- [ ] Device identifiers documented (IMEI, serial, model, OS version)
- [ ] Extraction method appropriate to authorization level
- [ ] All extracted data hashed for integrity verification
- [ ] MVT scan completed for spyware indicators
- [ ] Communication artifacts parsed and timeline generated
- [ ] Chain of custody form completed

## References

- [NIST SP 800-101r1 — Mobile Device Forensics](https://csrc.nist.gov/pubs/sp/800/101/r1/final)
- [MVT — Mobile Verification Toolkit](https://github.com/mvt-project/mvt)
- [ALEAPP — Android Logs Events And Protobuf Parser](https://github.com/abrignoni/ALEAPP)
- [iLEAPP — iOS Logs Events And Plists Parser](https://github.com/abrignoni/iLEAPP)
- [libimobiledevice](https://libimobiledevice.org/)
- [Andriller — Android Forensic Tools](https://github.com/den4uk/andriller)
