Please enable JavaScript.

Coggle requires JavaScript to display documents.

Digital Forensics - Coggle Diagram

- - - - (Android Pony EXpress )This format facilitates the updates of system components that don’t fit into the standard Android application model
    - - Contains all android apps, native apps or 3rd party. All system config/log, all app generated data
    - - binaries for several important daemons.
    - - Android OS, exclude Google services
      - appex
        
        (Android Pony EXpress )This format facilitates the updates of system components that don’t fit into the standard Android application model
      - app
        
        Android OS pre-installed bloatware apps, often can’t uninstall
      - bin
        
        executable binaries, daemons or bash
      - usr
        
        all system-wide, read-only files installed by (or provided by) the OS
      - res
        
        Resource, e.g., layout, color
      - lib
        
        native libraries
      - framework
        
        App Framework
    - - Resource, e.g., layout, color
  - - - ls 'Pixel 3/data/data/' | grep -i com.android
        
        this command will show the file or directory with "com.android" string
      - Messaging service
        
        com.android.providers.telephony
        
        databases
        
        mmssms.db
        
        Use sqlitebrowser tool to see the database of message
        
        shared_pref
      - Investigating contacts
        
        com.android.providers.contacts
        
        databases
        
        calllog.db
        
        Contains made/received calls along with timestamp and duration
        
        calls
        
        properties
        
        voicemail status
        
        android_metadata
        
        contacts2.db
        
        use sqlitebrowser to access database wheere you can find following information
        
        metadata of each contacts info, e.g., times contacted, last time contacted
        
        contacts info
        fields of contacts
        
        1 more item...
        
        contact group information, e.g., family, friends
        
        raw data is unprocessed data, which contains contacts and data tables
        
        profile.db
      - Investigating calendar service
        
        com.android.providers.calendar
  - - - Google Messages
        
        com.google.android.apps.messaging
        
        apps_log
        
        cache
        
        databases
        
        androidx.work.workdb
        
        ndroidx.work.workdb-shm
        
        google_app_measurement_local.db
        
        growthkit.db
        
        undelivered_messages
        
        Use sqlitebrowser to access databases
        
        files
        
        shared_prefs
      - Google Maps
        
        com.google.android.apps.maps
      - Google Phone Dialer App
        
        com.google.android.dialer
        
        app_phenotype_file
        
        cache
        
        databases
        
        annotated_call_log.db
        
        AND MORE
        
        dialer.db
        
        growthkit.db
        
        suggest_contact_database
        
        phone_lookup_history.db
        
        List phone lookup history
        
        files
        
        shared_prefs
  - - - i. e com.instagram.android
      - com.snapchat.android
      - com.spotify.music
      - com.twitter.android
        
        databases
        
        global.db
        
        persistent_jobs.db
        
        0-scribe.db
        
        use sqlitebrowser to manage databases
        
        files
        
        shared_prefs
        
        app_webview
        
        lib-main
      - com.whatsapp
      - kik.android
- - - - ewfinfo is a utility to show meta data stored in EWF files.
        Source:
    - - Mount an Expert Witness Compression Format (EWF) image file (ext_sd)
        
        ext_sd/ewf1
        
        This path has all the files (.mp4, .jpeg, .dat, .txt)
        
        istat -i raw ext_sd/ewf1 1357829 | head
        
        this command will show the information of video. here offset number of video is used to extract its information
        
        file ext_sd/ewf1
        
        serial number of the file
  - - - Flight Record
        
        To vies the flight Record information
      - Databases
      - Cache Images
        
        Cache Pictures here
        
        Those cache files are not the original files, therefore, those files are mediocre.
      - LOG
        
        MAP
        
        Map related information
      - Packages
      - RECORD_VOICE
      - VideoEditor
      - Videoguide
        
        To view video tutorials
      - visual_guide
      - DJI_Record
        
        Recorded flight videos, Definition of a flight video, TakeOff -> Landed (Not recording until Altitude >0 )
  - - - media/kali/2019-1B01
        
        DCIM
        
        /100MEDIA
        
        Video information (its metadata)
        
        md5sum /media/kali/2019-1B01/DCIM/100MEDIA /*.*
        
        this command will sow hash value of every file in this directory
        
        LOST.DIR
        
        MISK
        
        /THM/100
        
        Shows all the pictures taken
        
        System volume information
  - - - It shows the metadata of a file. All the information, (properties, fil, type, brand, permissions, version etc. )
    - - ewfinfo is a utility to show meta data stored in EWF files.
        Source:
- - - - data-text-lines contains "web page title"
        
        You will get
        
        source IP
        
        Dest. IP
        
        Protocol
        
        Lenth
        
        Other information
    - - (ip.src == xx.xx.xx.xx ) && (ip.dst == xx.xx.xx.xx) && http.request.method == "POST"
        
        If the request is "POST" then you can see it in the info
        
        it will show any MAC address associated with this request
    - - By using MAC address
    - - eth.addr == 00:17:f2:e2:c0:ce && http.cookie contains ""
  - - - Counting the numbers of packets that contain the key word “first”
        
        Tshark -r basic.log –qz io,stat,0,”COUNT(frame) frame” , “data-text-lines contains first”
      - Find a specific packet with a frame number
        
        tshark -r basic.log -Y "frame.number == 6"
      - Find frame numbers if packets have HTTP content
        
        tshark -r basic.log -Y "data-text-lines contains "first""
      - Finding protocol and field name
        
        tshark -G fields | grep -E "http." --color
        
        tshark -G protocols | grep -Ei “\btcp\b" --color
        
        tshark -G fields | grep -E "frame.number" --color
      - Find packet details -V
        
        tshark -r basic.log -Y "frame.number == 6" -V
      - Find lines in packets contain the key word “first” and highlights them
        
        tshark -r basic.log -Y "frame.number == 6" -V | grep -i "first" --color
  - - - tshark -r xyz.pcab | head -n 10
        
        This command will show first 10 lines of traffic data
      - tshark -r xyz.pcab | tail -n 10
        
        This command will show last 10 lines of traffic data
      - Counting the number of packets
        
        tshark -r xyz.pcap -qz io,stat,0,"COUNT(frame) frame"
      - Showing the first n packets
        
        tshark -r nitroba.pcap -T fields -e frame.time -e frame | head -n n
      - Search title keywords in the .html page
        
        tshark -r nitroba.pcap -Y "data-text-lines matches \"secure anonymous E-mail\"" 2>/dev/null
      - Finding request method
        
        tshark -r nitroba.pcap -Y (ip.src == 192.168.15.4 ) && (ip.dst == 69.25.94.22) && http.request.method == "POST"
      - Search all packets sending and receiving in the request using MAC address
        
        tshark -r nitroba.pcap -qz io,stat,0,"COUNT(frame) frame","eth.addr == xx:xx:xx:xx:xx:xx"
      - Extracting useful information from cookies using MAC add
        
        eth.addr == xx:xx:xx:xx:xx:xx && http.cookie contains ""
- - - - Displays the layout of the partitions in a volume system, which include partition tables and disk labels.