Search icon CANCEL
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Conferences
Free Learning
Arrow right icon
Arrow up icon
GO TO TOP
Practical Mobile Forensics

You're reading from   Practical Mobile Forensics Dive into mobile forensics on iOS, Android, Windows, and BlackBerry devices with this action-packed, practical guide

Arrow left icon
Product type Paperback
Published in Jul 2014
Publisher
ISBN-13 9781783288311
Length 328 pages
Edition 1st Edition
Tools
Concepts
Arrow right icon
Toc

Table of Contents (15) Chapters Close

Preface 1. Introduction to Mobile Forensics 2. Understanding the Internals of iOS Devices FREE CHAPTER 3. Data Acquisition from iOS Devices 4. Data Acquisition from iOS Backups 5. iOS Data Analysis and Recovery 6. iOS Forensic Tools 7. Understanding Android 8. Android Forensic Setup and Pre Data Extraction Techniques 9. Android Data Extraction Techniques 10. Android Data Recovery Techniques 11. Android App Analysis and Overview of Forensic Tools 12. Windows Phone Forensics 13. BlackBerry Forensics Index

Other important files


Apart from SQLite and plist files, several other locations may contain valuable information to an investigation.

The others sources include the following:

  • Cookies

  • Keyboard cache

  • Photos

  • Wallpaper

  • Snapshots

  • Recordings

  • Downloaded applications

Cookies

Cookies can be recovered from /private/var/mobile/Library/Cookies/Cookies.binarycookies. This file is a standard binary file that contains cookies saved when web pages are accessed on the device. This information can be a good indication of what websites the user has been actively visiting.

To convert the binary cookie to human readable format, run the BinaryCookieReader.py Python script on the cookie file, as shown in the following command. The Python script source code is available in the code bundle of the book.

$python BinaryCookieReader.py Cookies.binarycookies
Cookie : __utma=167051323.813879307.1359034257.1367989551.1386632713.9; domain=.testflightapp.com; path=/; expires=Wed, 09 Dec 2015; 
Cookie : __utmb=167051323.24.8.1386633092975...
lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at $19.99/month. Cancel anytime