Fig 6 - uploaded by Nicolas Christin
Content may be subject to copyright.
Source publication
Context in source publication
Context 1
... and the user should exercise caution when accessing a device in this manner. Improper use can easily result in hindering data collection. Similarly, software features like USB negotiation are not as robust as other devices with which the user may be familiar. Using flashing software in VMWare, while possibly desirable, is not possible due to the device not properly negotiating with virtual machine’s virtual USB controller. The Motorola Droid is a Verizon device with screen that slides to the right revealing a full QWERTY keyboard and D-Pad (Directional Pad). In addition to the keyboard the Droid has volume up/down, power and a camera button around the outside edge of the device. The Droid has a build in microSD card, a port for an additional microSD card, and has an ARM Cortex A8 550 mHz processor. It originally shipped with Android 2.0 (DROID). The Droid has a special flash boot mode (shown in Fig. 2) that can be entered by holding the camera button while powering on the device. This special boot mode allows flashing of the device’s recovery partition. Motorola RSD Lite software (Windows only) can facilitate flashing of the recovery partition, but does not accept a bootimg file in it’s native form: an RSD Lite compatible.sbf file containing the bootimg must be created. An .sdf file is comprised 5 of a header with file magic and a count of the parts in the file, each part also contains a header specifying the destination address, flash size, checksum and, of course, the image to flash, in this case the bootimg. Once an .sbf file containing the bootimg has been created the Droid, booted in flash mode, can be attached to a computer running RSD Lite and the device can be flashed with the .sbf file (and thus the contained bootimg). While not strictly required, re-booting the Droid into flash mode while connected the RSD Lite will allow RSD Lite to register a success message. The HTC G1 (shown in Fig. 3) has a Qualcomm MSM7210A 528 mHz processor (ARMv6 instruction set), a full QWERTY keyboard, and an external microSD card port. In addition to the keyboard the G1 has a track ball, and physical volume up/ down, camera, send, home, menu, back, and end/power buttons. One hardware feature germane to collection is that the G1’s has a special HTC USB þ Audio port (ExtUSB) in lieu of the more common microUSB port (HTC products). If the special ExtUSB cable that shipped with the device is not available, a standard miniUSB cable can be used for both recovery and fastboot modes. The G1 employs a boot method called fastboot (shown in Fig. 4). Fastboot requires a fastboot compatible boot loader and a fastboot program on a personal computer. The fastboot program can be compiled from Android Source or pre- compiled versions for Windows, Linux and OSX can conve- niently be obtained via HTC’s developer website (HTC developer center). After booting into fastboot mode and connecting the device to the computer via the special HTC cable or miniUSB, 6 the fastboot program can be used to enumerate devices attached (./fastboot devices) and to flash an image to the device (./fastboot flash recovery bootimg_filename ). Fastboot also allows directly booting to a kernel and ram disk located on a connected computer (./fastboot boot kernel_file- name ramdisk_filename ), which may be slightly preferred over flashing the recovery image as the existing recovery image on the device remains intact. For consistency in the collection process we suggest maintaining a set of recovery images and flashing the recovery image for every collection. The Captivate is part of Samsung’s Galaxy S line of mobile phones, sold by AT&T (shown in Fig. 5). The Captivate has a larger touch screen than the G1 and Droid, but it also has no QWERTY keyboard, in fact it only has 3 edge buttons: power, volume up and volume down. A standard microUSB port can be found at the top of the device behind a plastic sliding cover. In addition to typical internal hardware: 1 GHz ARM Cortex A8, 512 MB of RAM, and 16 GB internal SD card, the Captivate also has a hardware graphics core. Unlike the Droid and the G1 the Captivate employs Samsung’s proprietary RFS (Robust FAT File System) and Samsung’s OneNAND memory (L. Flash and samsung, 2008). This requires Android to load kernel modules to support RFS and makes later analysis more difficult as there is no available software for parsing RFS related data. Instead of using MTD devices, the kernel modules create several STL (Sector Translation Layer) and BML 7 (Block Management Layer) block devices (/dev/block/). A partition table showing typical use of BML devices is shown in Table 3. This type of device compli- cates collection slightly as it is not possible to read from some of the higher-layer STL devices, and collecting all of BML devices, while recommended, is not particularly useful as there is no way to analyze the resulting image. Much like the Droid, the Captivate has a special flash mode (also called download mode, shown in Fig. 6), that can be entered by holding both volume buttons and then connecting the device to a computer for flashing. In this mode the phone can be flashed using an open source tool called Heimdall (Dobell) or the closed source software Odin (Windows only). When using Odin prior to flashing, source files must be placed in a .tar 8 archive. Heimdall does not require files to be packaged as a .tar and is compatible with Windows, Linux and Mac OSX. In addition to the more complex partitioning and file system structure, Samsung devices do not employ the typical bootimg structure in the recovery partition. The recovery image is an initramfs image. Initramfs, available in 2.6.x Linux kernels, is a root file system that is actually embedded into the kernel. The details of creating an image suitable for flashing to a device are slightly more complex than described above, but the same theory applies. The presence of an older Secondary Boot Loader (SBL) will likely not utilize the BML8 recovery partition. Instead the normal boot mode and recovery mode share the same kernel. Unfortunately it is very difficult to tell the version of the SBL without interacting with the device. However the SBL can be flashed. So if after flashing the collection recovery image, if recovery mode is not working as expected, one may assume that an older SBL that does not boot to BML8 is on the device. The SBL can be flashed using Odin or Heimdall (but it requires having an exist SBL that is known to work with the device). Corrupting the SBL will make data collection very difficult because the device will no longer be able to reach download mode, as such flashing the SBL should be a last resort. Note that some devices, such as the Samsung Galaxy Tab (Tablet), require a special cable. Unlike the HTC ExtUSB where a miniUSB cable can serve as a substitute, the 30 pin Galaxy Tab cable that ships with the tablet is the only method of connecting to the device. We have demonstrated a general method for digital forensics collection on Android devices. Through special boot methods enabling the use of custom recovery bootimg, data on Android devices can be collected with very little probability of cor- rupting user data. Use of the recovery bootimg provides a consistent, repeatable method of collecting numerous Android devices without “rooting” the device in normal operating mode. We feel that this recovery bootimg method is both safer and had less impact to data likely to be useful for analysis. Collection recovery images have been created for testing for the devices detailed in Section 6. The collection process involves calculating integrity hashes at the source and destination helping ensure the correctness of the collection. Data contained in the collected images was verified using standard a Linux distribution with MTD and yaffs2 support (see Appendix I). Where possible, we employed the use of a NAND dumping tool which collects more data than typical filesystem copy would collect. While current analysis techniques do not take advantage of this extra information, future techniques may. Most devices transfer data at approximately 4.3 MB/s allowing for full collection to occur in a nominal amount of time. Even though the collection is not atomic, execution is restricted to the recovery partition and other partitions are not altered during collection resulting in an “exact copy” of original contents for all partitions other then the recovery partition. Though no user studies have been performed, we feel that the solution is very approachable and could be adopted by practitioners. When thought of simply as a collection tool, the tool can easily be inspected for correctness. The software installed in collection bootimgs could easily be extended to further aide the practitioner. The menu presented on the screen when a bootimg is executed could have related menu options such as “transfer data” eliminating the need to run./adb shell on the collection computer. Similarly integrity hashes for collected partitions could be displayed on the device screen. By moving this functionality to the device there is less risk of user error, especially if a single computer is used to perform collection of several Android devices. A comprehensive list of boot modes for Android devices, and associated flashing tools, should be created in order to have a reference in place prior to the need for collection on a particular device. Similarly, a comprehensive set of bootimgs supporting all Android devices should be created, maintained and tested. This work is supported in part by CyLab at Carnegie Mellon under grant DAAD19-02-1-0389 from the Army Research Office, and by the National Science Foundation under ITR award CCF-0424422 (Team for Research in Ubiquitous Secure Technology) and IGERT award DGE-0903659 (Usable Privacy and Security), as well as a hardware donation by Google Inc. This appendix is not intended to be a comprehensive method of analysis, but only to ...
Similar publications
Android has become most popular and powerful embedded
operating system. Nowadays, it is used in other electronic items
other than mobile phones like TV, Camera, etc. The purpose of
this study is to find out the difference in performance between
the different methods for developing applications due to an
increasing market for platform independen...
![Figure 1. Poor skin contact. Acceptable [record 427] and Unacceptable...](profile/Jakub-Kuzilek/publication/254019713/figure/fig1/AS:298066281287715@1448075948016/Poor-skin-contact-Acceptable-record-427-and-Unacceptable-record-661-records-in-class_Q320.jpg)
Work presented in this paper was undertaken in response to the PhysioNet/CinC Challenge 2011: Improving the quality of ECGs collected using mobile phones. For the purpose of this challenge we have developed an algorithm that uses five simple rules, detecting the most common distortions of the ECG signal in the out of hospital environment. Using fiv...
Accessibility is a major concern in our society nowadays. However, technology is always one step ahead and new devices appear before we can address the accessibility problems for the older ones. People with disabilities are not the only ones that are being excluded by technologies. Indeed, there is an exponential growth of the elderly population th...
Android that was made by Google and Open Handset Alliance is the open source software toolkit for mobile phone. In a few years, Android will be used by millions of Android mobile phones and other mobile devices, and become the main platform for application developers. In this paper, the integrated login application based on Google's Android platfor...
![Fig. 2. Planning and Design Process in LabVIEW[5]](profile/Zoltan-Balogh-4/publication/282642398/figure/fig6/AS:668449458102275@1536382178214/Planning-and-Design-Process-in-LabVIEW5_Q320.jpg)
![Fig. 3. Android OS Structure [10]](profile/Zoltan-Balogh-4/publication/282642398/figure/fig1/AS:281850242191380@1444209742669/Android-OS-Structure-10_Q320.jpg)
The article presents the issues of creating software for mobile device in the graphical environment LabVIEW from the firm National Instrument. Prototype production is preceded, or fully replaced by the phase, in which using virtual instruments and simulation of real processes shall reveal plenty of errors leading to frequent and costly interference...
Citations
... Similarly this technology can be used to gather the output data from the system and analysed using software. One of the applications using the Bluetooth module is the automation of home devices and controlling via an android application [5], [6], [7]. One of the applications that uses infrared module is the traffic management system [8], [9]. ...
Pulse Detonation Engine has been a point of interest in the propulsion industry for some time and the interest has been rising due to its better output and results. But any system can perform its task efficiently based on the efficiency of its control system. In this paper we have presented a comparative study between multiple control systems- one based on Bluetooth technology, the other based on infrared sensor technology and one based on wired electrical system. For the wireless system, the signal received from either of the media is passed to the various sensors and systems connected through an Arduino board that further controls the solenoid valves and ignition system. Primarily, a control system circuit is developed using Arduino board and different sensors to connect the fuel supply and ignition system. In the next stage, Bluetooth sensors are connected using an android app and then an infrared sensor based system is integrated with the Arduino to control the engine and the performance of the two systems are compared. Whereas for wired system, every sub system is controlled through optical wires including the solenoid valves, the injection system and the sensors.
... The backup files were forensically acquired and analyzed, revealing a range of database files and plist files related to mobile applications. Using the SQLite dB browser to see each database file and examining the data returned gave significant trails of evidence [20]. Forensic analysis on various android phone applications which belonged to the categories like bank and network carrier was performed [21]. ...
________________________________________________________________________________________________________ Abstract: In this paper, a plugin is developed a for our automated digital forensics framework to extract and preserve the evidence from the IOS-based mobile phone application, Olx. This plugin extracts personal details from Olx users, e.g, user name, mobile number, User Location, Country name, State name, City name, Last check-in attempt, Ad Images between different Olx users. While developing the plugin, we identified resources available in IOS-based devices holding key forensics artifacts. We highlighted the poor privacy scheme employed by Olx. This work has shown how the sensitive data posted in the Olx mobile application can easily be reconstructed, and how the traces, as well as the URL links of visual messages, can be used to access the privacy of any Olx user without any critical credential verification. We also employed the anti-forensics method on the Olx IOS application and were able to restore the application from the altered or corrupted database file, which any criminal mind can use to set up or trap someone else. The outcome of this research is a plugin for our digital forensics ready framework software which could be used by law enforcement and regulatory agencies to reconstruct the digital evidence available in the Olx mobile application directories on IOS-based mobile phones.
... To address these limitations, further iterations could involve larger and more diverse participant groups. Moreover, refining the app's optimization for Android devices and addressing connectivity issues should be a priority, ensuring a seamless experience for all users [10]. Conducting user surveys and feedback sessions could offer valuable qualitative insights, guiding ongoing improvements. ...
This paper addresses the critical need for real-time air quality monitoring through the development and implementation of the Air Pendent app and device [4]. Recognizing the escalating concerns surrounding carbon dioxide emissions, climate change, and indoor air quality, our solution integrates cutting-edge technology to empower users with immediate, personalized insights into their surroundings [5]. The challenges of interoperability, sensor accuracy, and community engagement were systematically addressed through experiments involving ten diverse participants. Results revealed high user satisfaction, consistent sensor accuracy, and varying community participation rates. While optimization for Android devices and cross-platform performance enhancements are recommended, the Air Pendent project emerges as a promising tool for fostering environmental awareness and community-driven solutions [6]. This comprehensive and user-centric approach provides a tangible means for individuals to actively engage with and positively impact their immediate environment, positioning the solution as an essential tool for a sustainable future [7].
... As depicted in Figure 1b, the data on the DJI RC exist on two storage media: the internal flash memory and the external SD card. To access and collect data from the internal flash memory, standard data collection methods used for Android smartphones can be applied, as referenced in previous studies [27][28][29]. Acquiring root privileges on the device's kernel is essential to accomplish this. Therefore, we utilized the DJI RC FCC program for this purpose [30]. ...
Drones, also known as unmanned aerial vehicles (UAVs) and sometimes referred to as ‘Mobile IoT’ or ‘Flying IoT’, are widely adopted worldwide, with their market share continuously increasing. While drones are generally harnessed for a wide range of positive applications, recent instances of drones being employed as lethal weapons in conflicts between countries like Russia, Ukraine, Israel, Palestine, and Hamas have demonstrated the potential consequences of their misuse. Such misuse poses a significant threat to cybersecurity and human lives, thereby highlighting the need for research to swiftly and accurately analyze drone-related crimes, identify the responsible pilot, and establish when and what illegal actions were carried out. In contrast to existing research, involving limited data collection and analysis of the drone, our study focused on collecting and rigorously analyzing data without restrictions from the remote controller used to operate the drone. This comprehensive approach allowed us to unveil essential details, including the pilot’s account information, the specific drone used, pairing timestamps, the pilot’s operational location, the drone’s flight path, and the content captured during flights. We developed methodologies and proposed artifacts to reveal these specifics, which were supported by real-world data. Significantly, this study is the pioneering digital forensic investigation of remote controller devices. We meticulously collected and analyzed all internal data, and we even employed reverse engineering to decrypt critical information files. These achievements hold substantial significance. The outcomes of this research are expected to serve as a digital forensic methodology for drone systems, thereby making valuable contributions to numerous investigations.
... With the sophisticated features of smartphones, a lot of stored data could be used as clues for an investigation, for instance location details, phone calls history and text messages [3]. To analyze the data stored in the devices, digital forensic professionals will conduct the analysis with suitable mobile forensic tools. ...
... In the database file, it will have several tables. The default of the database of Android is SQLite, the forensic tool would require integrating the SQLite browser to open the table in the database [3]. After the SQLite browser extracts the table from the database, the normalization of the database is needed for the data visualization to output the data in more readable format or visual data [19]. ...
In the 21th century, digital crimes would be one of the biggest challenges to government and public. Digital crime cases that involve mobile phones are on the rise, resulting in digital forensic analysis tools are on the demand. However, there are limitations in the current mobile forensic tool, such as lack of automation and visualization process, false positives are too high and performance of the analysis is low. This study therefore aims to design, develop and test a tool - MF Visualizer - to visualize the metadata from databases in the Android data partition. The android data partition is chosen as the scope of the project. MF Visualizer follows the mandatory requirements of the forensic tool and is compatible with suitable modules to accomplish the task. The tool is developed by adopting Object-Oriented Software Development Model and using .Net Windows Presentation Foundation (WPF) framework to develop. The findings show that the tools could extract metadata from android data partitions as well as visualize the data in different visualization forms such as Bar Chart, Word Cloud, Map, Pie Chart and the Timeline method. Functionality and users testing results indicate that MF Visualizer has achieved the project objectives. This further indicates that MF Visualizer is a promising tool to be used in a real world scenario with further improvements.
... From a certain point of view, a significant layer of problems associated with the status of AI arose on the basis of combining two phenomena and concepts into a single object: artificial intelligence and a robot. While talking about the legal personality of robots and the status of "electronic persons", most people imagine an anthropomorphic cyborg (android or gynoid), demonstrating "human" characteristics of behaviour and communication (Vidas et al., 2011;Karbab et al., 2018). The most typical characteristics that humans traditionally endow a robot were identified and formulated by the staff of the Roboworld Museum: it looks like a human; mobile and agile enough; able to communicate; possesses "intelligence" 4 . ...
The lack of sufficient legal regulation of relations associated with the use of artificial intelligence and robotics is associated with the conceptual lack of resolution of the basic issues underlying modern models of legal regulation for anything: about the concept and general status of the phenomenon to be settled. With regard to the research topic, this translates into questions about the concept and legal personality of artificial intelligence. These questions represent a kind of logical metaphor: in order to start modeling the legal personality of artificial intelligence, we must first define its concept; and the legal concept of artificial intelligence will be formulated differently depending on whether we consider it as a subject or an object of law. The authors investigate the technical, moral and legal aspects of the problem concerning the status and understanding artificial intelligence, and draw conclusions about the basic conditions for the legal regulation of this area.
... If the validation fails due to unsigned software or for other reasons, the target device does not boot, denying access to the device by malicious users. This makes traditional data acquisition techniques such as the ones suggested by Vidas et al. (2011) unworkable. The Trusted Execution Environment (TEE), which is also heavily used, provides an isolated environment for security critical components in a system, by separating a normal operating system from a much smaller secure operating system, both running on the same hardware device. ...
In modern criminal investigations, mobile devices are seized at every type of crime scene, and the data on those devices often becomes critical evidence in the case. Various mobile forensic techniques have been established and evaluated through research in order to extract possible evidence data from devices over the decades. However, as mobile devices become essential tools for daily life, security and privacy concerns grow, and modern smartphone vendors have implemented multiple types of security protection measures - such as encryption - to guard against unauthorized access to the data on their products. This trend makes forensic acquisition harder than before, and data extraction from those devices for criminal investigation is becoming a more challenging task. Today, mobile forensic research focuses on identifying more invasive techniques, such as bypassing security features, and breaking into target smartphones by exploiting their vulnerabilities. In this paper, we explain the increased encryption and security protection measures in modern mobile devices and their impact on traditional forensic data extraction techniques for law enforcement purposes. We demonstrate that in order to overcome encryption challenges, new mobile forensic methods rely on bypassing the security features and exploiting system vulnerabilities. A new model for forensic acquisition is proposed. The model is supported by a legal framework focused on the usability of digital evidence obtained through vulnerability exploitation.
... Der Vorgang kann dazu führen, dass der Inhalt der Partition, die die Benutzerdaten speichert, gelöscht wird [20]. Sollte es möglich sein ein eigenes Recovery-Bootimage 3 aufzuspielen, kann der Recoverymode 4 für die Datenextraktion genutzt werden [25]. Es wird auch an Methoden geforscht, bei denen es nicht notwendig ist, eigene Software auf das Smartphone aufzuspielen. ...
Zusammenfassung
Auf Smartphones sind viele Daten gespeichert, die im Zuge einer strafrechtlichen Ermittlung von Interesse sein können. Die Mobilfunkforensik ist das Teilgebiet der forensischen Informatik, die die Techniken der forensischen Analyse von Smartphones zusammenfasst. Sie steht vor großen Herausforderungen: der Vielfalt an Smartphoneherstellern, Modellen und Betriebssystemversionen kombiniert mit schnellen technischen Veränderungen, dem verstärkten Schutz der Benutzerdaten und einer Zunahme des Datenumfangs [14]. Weitere erschwerende Faktoren sind die zunehmende Nutzung von Cloud-Diensten und tragbaren, mit dem Smartphone vernetzten Geräten wie Smartwatches [10]. Während die Strafverfolgungsbehörden und Gerichte trotz (oder gar wegen) dieser Faktoren auf allgemein anwendbare, verifizierbare forensische Methoden hinwirken sollten, ist in der Praxis das Gegenteil zu beobachten: Die zunehmende Nutzung von undurchsichtigen ,,Blackbox‘‘-Methoden weniger konkurrierender privater Akteure. Der Beitrag beleuchtet die Ursachen dieser Entwicklung und skizziert mögliche Auswege.
... There is an increasing request for mobile utilisation to sustain our day-to-day events and offer diverse amusement [1]. Android is probably the most popular operating system that millions of smartphones and tablets are using today [2,3], and is increasing by leaps and bounds. Hence, the android phone is one of the most advanced and easiest-to-use tools [4,5,6]. ...
A mobile translator is a mobile application that can be utilised for translating from English to any other dialect, and vice versa. The problem of language difference has hindered effective information communication over the years. There have been difficulties in information communication amid countries over the years. In modern times, language interpreters must understand and speak both the language been translated to and verse-visa. This traditional approach used for solving the problem of language differences has not been productive and favourable. Also, the teaching of different languages can be difficult due to language difference problems. The individual will also have to be taught by a tutor who will incur extra expenses and may not be the most efficient and favourable method. Therefore, the study develops an android phone language converter app in other to make learning and language translation easy and facilitates stress-free communication. The proposed language translation uses Google's real-time translation API natural language processing with Java programming language to develop the application. The most used languages globally (i.e., English, Spanish, Arabic, Hindi, French, and Chinese) were used for the android application translation. This application can be useful for Tourists for communication purposes, thus allowing them to integrate with the local people and access the right information. The system will also be able to evaluate language translation to determine their suitability for everyday conversation; given the fact that it is an android application, one will always be willing to use their phone to learn, compared to having them on a computer or learn from a physical tutor when your phone can be your tutor. The application was evaluated based on the classification time the memory usage, and the battery life all through distinctive use
... Android is defined as an operating system (mobile operating system) that has adopted the Linux operating system and is designed for touchscreen devices such as smartphones and PCs tablet, yet it has been modified (Vidas et al., 2011;Suprianto and Agustina, 2012). Seeing the situation, Google argued that the Android platform should be open and free. ...
Mobile phones can be functionalized in the process of learning using cellular devices and computing systems. The present study aims to (1) develop mobile learning applications and (2) find out student responses in the learning process using m-learning. This research used the 4D model (defining, designing, developing, and disseminating) written by Thiagarajan. Validation used a questionnaire to collect data, while effectiveness was revealed through student responses that took part in m-learning. The results showed 1) the application used in e-learning learning was very valid (> 85%), and 2) research subjects (two classes) provided very positive feedback (> 85%). It means that the mobile learning application developed is feasible to use because it has high validity and is able to increase students' positive responses. This study reveals that mobile learning applications can have a positive impact on student learning outcomes in the future.
