Utilize ALEAPP to analyze Android device artifacts, reconstructing a victim's financial details, movements, and communication patterns.
We're currently in the midst of a murder investigation, and we've obtained the victim's phone as a key piece of evidence. After conducting interviews with witnesses and those in the victim's inner circle, your objective is to meticulously analyze the information we've gathered and diligently trace the evidence to piece together the sequence of events leading up to the incident.
In this lab, we delve into the forensic analysis of a crucial piece of evidence—an Android phone belonging to a victim in a murder investigation. The case is complex, involving financial debts, suspicious communication patterns, and last-known movements. Our goal is to reconstruct the victim’s activities leading up to the incident by carefully analyzing artifacts extracted from the device. This involves leveraging advanced forensic tools and techniques to uncover insights buried within the phone's logs, messages, and application data.
The lab challenges investigators to piece together vital clues, ranging from financial interactions and suspicious messages to GPS locations and chat conversations. Each artifact analyzed provides a puzzle piece that contributes to understanding the victim's behavior, their social interactions, and potential motivations behind the events. To achieve this, we will use tools like ALEAPP, a powerful forensic utility tailored for Android artifacts, alongside other analysis techniques to extract and interpret key data from the victim's phone.
As we progress, the walkthrough will explore the importance of various digital artifacts, such as SMS messages, contacts, chat logs, and GPS data, while demonstrating how to correlate these findings to create a coherent narrative. This lab emphasizes the practical application of mobile forensics in solving real-world cases, showcasing the critical role of digital evidence in uncovering the truth.
To solve this task, we begin by understanding the significance of Android systems and the role of logs in forensic analysis. Android devices are built on a robust ecosystem where user interactions, application usage, and system events are logged and stored in various files. These logs, along with database entries and other system artifacts, are instrumental for forensic investigators as they allow the reconstruction of user activity and the timeline of events.
In this investigation, we utilized the Android Logs, Events, and Protobuf Parser (ALEAPP), a forensic tool designed specifically for parsing Android file systems. ALEAPP is capable of analyzing Android artifacts such as application data, user activities, and system logs. This tool is particularly useful in reconstructing a device’s state and understanding the behavior of its user. By directing ALEAPP to the extracted file system of the victim's phone, we configured it to extract and process data from all available modules, including accounts, notifications, app interactions, and installed applications.
The output generated by ALEAPP provides a detailed and categorized report that facilitates our forensic analysis.
Through ALEAPP's output, we examined the details of installed applications on the victim’s phone. Installed apps on Android devices are not only identified by their display names but also by unique bundle IDs, which specify their package name in the Android ecosystem. Additionally, for forensic accuracy, each application version can be verified using its SHA-256 hash—a cryptographic representation that ensures the integrity of the application data.
Among the list of applications installed on the victim’s phone, we identified one of particular interest—a trading application with the bundle ID com.ticno.olymptrade.
This aligns with the narrative that the victim was involved in trading activities. Further analysis of the application metadata revealed the SHA-256 hash associated with this application version: 4f168a772350f283a1c49e78c1548d7c2c6c05106d8b9feb825fdc3466e9df3c. This cryptographic hash serves as a unique identifier, ensuring that no modifications have been made to the application binary since its installation.