new entry
This commit is contained in:
overcuriousity
parent
a6b51187b7
commit
9798837806
File diff suppressed because one or more lines are too long
490
src/content/knowledgebase/android-logical-imaging.md
Normal file
490
src/content/knowledgebase/android-logical-imaging.md
Normal file
@ -0,0 +1,490 @@
|
|||||||
|
---
|
||||||
|
title: "Extraktion logischer Dateisysteme alter Android-Smartphones - eine KI-Recherche"
|
||||||
|
tool_name: "Android Logical Imaging"
|
||||||
|
description: "Wie man alte Android-Handys aufbekommen könnte - eine Recherche von Claude"
|
||||||
|
last_updated: 2025-07-21
|
||||||
|
author: "Claude 4 Sonnet (Research)"
|
||||||
|
difficulty: "advanced"
|
||||||
|
categories: ["data-collection"]
|
||||||
|
tags: ["imaging", "filesystem", "hardware-interface"]
|
||||||
|
sections:
|
||||||
|
overview: true
|
||||||
|
installation: true
|
||||||
|
configuration: true
|
||||||
|
usage_examples: true
|
||||||
|
best_practices: true
|
||||||
|
troubleshooting: true
|
||||||
|
advanced_topics: true
|
||||||
|
review_status: "published"
|
||||||
|
---
|
||||||
|
|
||||||
|
|
||||||
|
# Übersicht
|
||||||
|
|
||||||
|
Open-Source Android Forensik bietet robuste Alternativen zu kommerziellen Lösungen wie Cellebrite UFED und Magnet AXIOM. Besonders für ältere Android-Geräte (5+ Jahre) existieren bewährte Methoden zur Datenextraktion und -analyse.
|
||||||
|
|
||||||
|
## Kernkomponenten des Open-Source Forensik-Stacks
|
||||||
|
|
||||||
|
**Autopsy Digital Forensics Platform** bildet das Fundament mit GUI-basierter Analyse und integrierten Android-Parsing-Fähigkeiten. Die Plattform unterstützt **ALEAPP (Android Logs Events And Protobuf Parser)**, das über 100 Artefakt-Kategorien aus Android-Extraktionen parst.
|
||||||
|
|
||||||
|
**Mobile Verification Toolkit (MVT)** von Amnesty International bietet spezialisierte Command-Line-Tools für Android-Analyse mit Fokus auf Kompromittierungserkennung.
|
||||||
|
|
||||||
|
**SIFT Workstation** stellt eine komplette Ubuntu-basierte forensische Umgebung mit 125+ vorinstallierten Tools bereit.
|
||||||
|
|
||||||
|
## Erfolgsraten nach Gerätealter
|
||||||
|
|
||||||
|
- **Pre-2017 Geräte**: 85-98% logische Extraktion, 30-70% physische Extraktion
|
||||||
|
- **2017-2019 Geräte**: 80-95% logische Extraktion, 15-35% physische Extraktion
|
||||||
|
- **2020+ Geräte**: 70-85% logische Extraktion, 5-15% physische Extraktion
|
||||||
|
|
||||||
|
# Installation
|
||||||
|
|
||||||
|
## SIFT Workstation Setup
|
||||||
|
|
||||||
|
### Systemanforderungen
|
||||||
|
- Quad-Core CPU 2.5GHz+
|
||||||
|
- 16GB+ RAM
|
||||||
|
- 500GB+ SSD Speicher
|
||||||
|
- USB 3.0+ Anschlüsse
|
||||||
|
|
||||||
|
### Installation
|
||||||
|
1. Download von [SANS SIFT Workstation](https://www.sans.org/tools/sift-workstation/)
|
||||||
|
2. VMware/VirtualBox Import der OVA-Datei
|
||||||
|
3. VM-Konfiguration: 8GB+ RAM, 4+ CPU-Kerne
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Update nach Installation
|
||||||
|
sudo apt update && sudo apt upgrade -y
|
||||||
|
sudo sift update
|
||||||
|
```
|
||||||
|
|
||||||
|
## Autopsy Installation
|
||||||
|
|
||||||
|
### Windows Installation
|
||||||
|
1. Download von [autopsy.com](https://www.autopsy.com/)
|
||||||
|
2. Java 8+ Installation erforderlich
|
||||||
|
3. Installation mit Administratorrechten
|
||||||
|
|
||||||
|
### Linux Installation
|
||||||
|
```bash
|
||||||
|
# Ubuntu/Debian
|
||||||
|
sudo apt install autopsy sleuthkit
|
||||||
|
# Oder manueller Download und Installation
|
||||||
|
wget https://github.com/sleuthkit/autopsy/releases/latest
|
||||||
|
```
|
||||||
|
|
||||||
|
## Essential Tools Installation
|
||||||
|
|
||||||
|
### Android Debug Bridge (ADB)
|
||||||
|
```bash
|
||||||
|
# Ubuntu/Debian
|
||||||
|
sudo apt install android-tools-adb android-tools-fastboot
|
||||||
|
|
||||||
|
# Windows - Download Android Platform Tools
|
||||||
|
# https://developer.android.com/studio/releases/platform-tools
|
||||||
|
```
|
||||||
|
|
||||||
|
### ALEAPP Installation
|
||||||
|
```bash
|
||||||
|
git clone https://github.com/abrignoni/ALEAPP.git
|
||||||
|
cd ALEAPP
|
||||||
|
pip3 install -r requirements.txt
|
||||||
|
```
|
||||||
|
|
||||||
|
### Mobile Verification Toolkit (MVT)
|
||||||
|
```bash
|
||||||
|
pip3 install mvt
|
||||||
|
# Oder via GitHub für neueste Version
|
||||||
|
git clone https://github.com/mvt-project/mvt.git
|
||||||
|
cd mvt && pip3 install .
|
||||||
|
```
|
||||||
|
|
||||||
|
### Andriller Installation
|
||||||
|
```bash
|
||||||
|
git clone https://github.com/den4uk/andriller.git
|
||||||
|
cd andriller
|
||||||
|
pip3 install -r requirements.txt
|
||||||
|
```
|
||||||
|
|
||||||
|
# Konfiguration
|
||||||
|
|
||||||
|
## ADB Setup und Gerätevorbereitung
|
||||||
|
|
||||||
|
### USB-Debugging aktivieren
|
||||||
|
1. Entwickleroptionen freischalten (7x Build-Nummer antippen)
|
||||||
|
2. USB-Debugging aktivieren
|
||||||
|
3. Gerät via USB verbinden
|
||||||
|
4. RSA-Fingerprint akzeptieren
|
||||||
|
|
||||||
|
### ADB Verbindung testen
|
||||||
|
```bash
|
||||||
|
adb devices
|
||||||
|
# Sollte Gerät mit "device" Status zeigen
|
||||||
|
adb shell getprop ro.build.version.release # Android Version
|
||||||
|
adb shell getprop ro.product.model # Gerätemodell
|
||||||
|
```
|
||||||
|
|
||||||
|
## Autopsy Projektkonfiguration
|
||||||
|
|
||||||
|
### Case-Setup
|
||||||
|
1. Neuen Fall erstellen
|
||||||
|
2. Ermittler-Informationen eingeben
|
||||||
|
3. Case-Verzeichnis festlegen (ausreichend Speicherplatz)
|
||||||
|
|
||||||
|
### Android Analyzer Module aktivieren
|
||||||
|
- Tools → Options → Modules
|
||||||
|
- Android Analyzer aktivieren
|
||||||
|
- ALEAPP Integration konfigurieren
|
||||||
|
|
||||||
|
### Hash-Algorithmen konfigurieren
|
||||||
|
- MD5, SHA-1, SHA-256 für Integritätsprüfung
|
||||||
|
- Automatische Hash-Berechnung bei Import aktivieren
|
||||||
|
|
||||||
|
## MVT Konfiguration
|
||||||
|
|
||||||
|
### Konfigurationsdatei erstellen
|
||||||
|
```yaml
|
||||||
|
# ~/.mvt/config.yaml
|
||||||
|
adb_path: "/usr/bin/adb"
|
||||||
|
output_folder: "/home/user/mvt_output"
|
||||||
|
```
|
||||||
|
|
||||||
|
# Verwendungsbeispiele
|
||||||
|
|
||||||
|
## Fall 1: Logische Datenextraktion mit ADB
|
||||||
|
|
||||||
|
### Geräteinformationen sammeln
|
||||||
|
```bash
|
||||||
|
# Systeminfo
|
||||||
|
adb shell getprop > device_properties.txt
|
||||||
|
adb shell cat /proc/version > kernel_info.txt
|
||||||
|
adb shell mount > mount_info.txt
|
||||||
|
|
||||||
|
# Installierte Apps
|
||||||
|
adb shell pm list packages -f > installed_packages.txt
|
||||||
|
```
|
||||||
|
|
||||||
|
### Datenbank-Extraktion
|
||||||
|
```bash
|
||||||
|
# SMS/MMS Datenbank
|
||||||
|
adb pull /data/data/com.android.providers.telephony/databases/mmssms.db
|
||||||
|
|
||||||
|
# Kontakte
|
||||||
|
adb pull /data/data/com.android.providers.contacts/databases/contacts2.db
|
||||||
|
|
||||||
|
# Anrufliste
|
||||||
|
adb pull /data/data/com.android.providers.contacts/databases/calllog.db
|
||||||
|
```
|
||||||
|
|
||||||
|
### WhatsApp Datenextraktion
|
||||||
|
```bash
|
||||||
|
# WhatsApp Datenbanken (Root erforderlich)
|
||||||
|
adb shell su -c "cp -r /data/data/com.whatsapp/ /sdcard/whatsapp_backup/"
|
||||||
|
adb pull /sdcard/whatsapp_backup/
|
||||||
|
```
|
||||||
|
|
||||||
|
## Fall 2: Android Backup-Analyse
|
||||||
|
|
||||||
|
### Vollständiges Backup erstellen
|
||||||
|
```bash
|
||||||
|
# Umfassendes Backup (ohne Root)
|
||||||
|
adb backup -all -system -apk -shared -f backup.ab
|
||||||
|
|
||||||
|
# Backup entschlüsseln (falls verschlüsselt)
|
||||||
|
java -jar abe.jar unpack backup.ab backup.tar
|
||||||
|
tar -xf backup.tar
|
||||||
|
```
|
||||||
|
|
||||||
|
### Backup mit ALEAPP analysieren
|
||||||
|
```bash
|
||||||
|
python3 aleappGUI.py
|
||||||
|
# Oder Command-Line
|
||||||
|
python3 aleapp.py -t tar -i backup.tar -o output_folder
|
||||||
|
```
|
||||||
|
|
||||||
|
## Fall 3: MVT Kompromittierungsanalyse
|
||||||
|
|
||||||
|
### Live-Geräteanalyse
|
||||||
|
```bash
|
||||||
|
# ADB-basierte Analyse
|
||||||
|
mvt-android check-adb --output /path/to/output/
|
||||||
|
|
||||||
|
# Backup-Analyse
|
||||||
|
mvt-android check-backup --output /path/to/output/ backup.ab
|
||||||
|
```
|
||||||
|
|
||||||
|
### IOC-Suche mit Pegasus-Indikatoren
|
||||||
|
```bash
|
||||||
|
# Mit vorgefertigten IOCs
|
||||||
|
mvt-android check-adb --iocs /path/to/pegasus.stix2 --output results/
|
||||||
|
```
|
||||||
|
|
||||||
|
## Fall 4: Physische Extraktion (Root erforderlich)
|
||||||
|
|
||||||
|
### Device Rooting - MediaTek Geräte
|
||||||
|
```bash
|
||||||
|
# MTKClient für MediaTek-Chipsets
|
||||||
|
git clone https://github.com/bkerler/mtkclient.git
|
||||||
|
cd mtkclient
|
||||||
|
python3 mtk payload
|
||||||
|
|
||||||
|
# Nach erfolgreichem Root
|
||||||
|
adb shell su
|
||||||
|
```
|
||||||
|
|
||||||
|
### Vollständiges Memory Dump
|
||||||
|
```bash
|
||||||
|
# Partitionslayout ermitteln
|
||||||
|
adb shell su -c "cat /proc/partitions"
|
||||||
|
adb shell su -c "ls -la /dev/block/"
|
||||||
|
|
||||||
|
# Vollständiges Device Image (Root erforderlich)
|
||||||
|
adb shell su -c "dd if=/dev/block/mmcblk0 of=/sdcard/full_device.img bs=4096"
|
||||||
|
adb pull /sdcard/full_device.img
|
||||||
|
```
|
||||||
|
|
||||||
|
# Best Practices
|
||||||
|
|
||||||
|
## Rechtliche Compliance
|
||||||
|
|
||||||
|
### Dokumentation und Chain of Custody
|
||||||
|
- **Vollständige Dokumentation**: Wer, Was, Wann, Wo, Warum
|
||||||
|
- **Hash-Verifikation**: MD5/SHA-256 für alle extrahierten Daten
|
||||||
|
- **Nur forensische Kopien analysieren**, niemals Originaldaten
|
||||||
|
- **Schriftliche Genehmigung** für Geräteanalyse einholen
|
||||||
|
|
||||||
|
### Familiengeräte und Nachlässe
|
||||||
|
- Genehmigung durch Nachlassverwalter erforderlich
|
||||||
|
- Gerichtsbeschlüsse für Cloud-Zugang eventuell nötig
|
||||||
|
- Drittpartei-Kommunikation kann weiterhin geschützt sein
|
||||||
|
|
||||||
|
## Technische Best Practices
|
||||||
|
|
||||||
|
### Hash-Integrität sicherstellen
|
||||||
|
```bash
|
||||||
|
# Hash vor und nach Transfer prüfen
|
||||||
|
md5sum original_file.db
|
||||||
|
sha256sum original_file.db
|
||||||
|
|
||||||
|
# Hash-Verifikation dokumentieren
|
||||||
|
echo "$(date): MD5: $(md5sum file.db)" >> chain_of_custody.log
|
||||||
|
```
|
||||||
|
|
||||||
|
### Sichere Arbeitsumgebung
|
||||||
|
- Isolierte VM für Forensik-Arbeit
|
||||||
|
- Netzwerk-Isolation während Analyse
|
||||||
|
- Verschlüsselte Speicherung aller Evidenz
|
||||||
|
- Regelmäßige Backups der Case-Datenbanken
|
||||||
|
|
||||||
|
### Qualitätssicherung
|
||||||
|
- Peer-Review kritischer Analysen
|
||||||
|
- Standardisierte Arbeitsabläufe (SOPs)
|
||||||
|
- Regelmäßige Tool-Validierung
|
||||||
|
- Kontinuierliche Weiterbildung
|
||||||
|
|
||||||
|
## Erfolgsmaximierung nach Gerätehersteller
|
||||||
|
|
||||||
|
### MediaTek-Geräte (Höchste Erfolgsrate)
|
||||||
|
- BootROM-Exploits für MT6735, MT6737, MT6750, MT6753, MT6797
|
||||||
|
- MTKClient für Hardware-Level-Zugang
|
||||||
|
- Erfolgsrate: 80%+ für Geräte 2015-2019
|
||||||
|
|
||||||
|
### Samsung-Geräte
|
||||||
|
- Ältere Knox-Implementierungen umgehbar
|
||||||
|
- Emergency Dialer Exploits für Android 4.x
|
||||||
|
- Erfolgsrate: 40-70% je nach Knox-Version
|
||||||
|
|
||||||
|
### Pixel/Nexus-Geräte
|
||||||
|
- Bootloader-Unlocking oft möglich
|
||||||
|
- Fastboot-basierte Recovery-Installation
|
||||||
|
- Erfolgsrate: 60-80% bei freigeschaltetem Bootloader
|
||||||
|
|
||||||
|
# Troubleshooting
|
||||||
|
|
||||||
|
## Problem: ADB erkennt Gerät nicht
|
||||||
|
|
||||||
|
### Lösung: USB-Treiber und Berechtigungen
|
||||||
|
```bash
|
||||||
|
# Linux: USB-Berechtigungen prüfen
|
||||||
|
lsusb | grep -i android
|
||||||
|
sudo chmod 666 /dev/bus/usb/XXX/XXX
|
||||||
|
|
||||||
|
# udev-Regeln erstellen
|
||||||
|
echo 'SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", MODE="0666", GROUP="plugdev"' | sudo tee /etc/udev/rules.d/51-android.rules
|
||||||
|
sudo udevadm control --reload-rules
|
||||||
|
```
|
||||||
|
|
||||||
|
### Windows: Treiber-Installation
|
||||||
|
1. Geräte-Manager öffnen
|
||||||
|
2. Android-Gerät mit Warnsymbol finden
|
||||||
|
3. Treiber manuell installieren (Android USB Driver)
|
||||||
|
|
||||||
|
## Problem: Verschlüsselte Android Backups
|
||||||
|
|
||||||
|
### Lösung: Android Backup Extractor
|
||||||
|
```bash
|
||||||
|
# ADB Backup Extractor installieren
|
||||||
|
git clone https://github.com/nelenkov/android-backup-extractor.git
|
||||||
|
cd android-backup-extractor
|
||||||
|
gradle build
|
||||||
|
|
||||||
|
# Backup entschlüsseln
|
||||||
|
java -jar abe.jar unpack backup.ab backup.tar [password]
|
||||||
|
```
|
||||||
|
|
||||||
|
## Problem: Unzureichende Berechtigungen für Datenextraktion
|
||||||
|
|
||||||
|
### Lösung: Alternative Extraktionsmethoden
|
||||||
|
```bash
|
||||||
|
# AFLogical OSE für begrenzte Extraktion ohne Root
|
||||||
|
# WhatsApp Key/DB Extractor für spezifische Apps
|
||||||
|
# Backup-basierte Extraktion als Fallback
|
||||||
|
|
||||||
|
# Custom Recovery für erweiterten Zugang
|
||||||
|
fastboot flash recovery twrp-device.img
|
||||||
|
```
|
||||||
|
|
||||||
|
## Problem: ALEAPP Parsing-Fehler
|
||||||
|
|
||||||
|
### Lösung: Datenformat-Probleme beheben
|
||||||
|
```bash
|
||||||
|
# Log-Dateien prüfen
|
||||||
|
python3 aleapp.py -t dir -i /path/to/data -o output --debug
|
||||||
|
|
||||||
|
# Spezifische Parser deaktivieren
|
||||||
|
# Manuelle SQLite-Analyse bei Parser-Fehlern
|
||||||
|
sqlite3 database.db ".tables"
|
||||||
|
sqlite3 database.db ".schema table_name"
|
||||||
|
```
|
||||||
|
|
||||||
|
# Erweiterte Techniken
|
||||||
|
|
||||||
|
## Memory Forensics mit LiME
|
||||||
|
|
||||||
|
### LiME für ARM-Devices kompilieren
|
||||||
|
```bash
|
||||||
|
# Cross-Compilation Setup
|
||||||
|
export ARCH=arm
|
||||||
|
export CROSS_COMPILE=arm-linux-gnueabi-
|
||||||
|
export KERNEL_DIR=/path/to/kernel/source
|
||||||
|
|
||||||
|
# LiME Module kompilieren
|
||||||
|
git clone https://github.com/504ensicsLabs/LiME.git
|
||||||
|
cd LiME/src
|
||||||
|
make
|
||||||
|
|
||||||
|
# Memory Dump erstellen (Root erforderlich)
|
||||||
|
adb push lime.ko /data/local/tmp/
|
||||||
|
adb shell su -c "insmod /data/local/tmp/lime.ko 'path=/sdcard/memory.lime format=lime'"
|
||||||
|
```
|
||||||
|
|
||||||
|
### Volatility-Analyse von Android Memory
|
||||||
|
```bash
|
||||||
|
# Memory Dump analysieren
|
||||||
|
python vol.py -f memory.lime --profile=Linux <profile> linux.pslist
|
||||||
|
python vol.py -f memory.lime --profile=Linux <profile> linux.bash
|
||||||
|
python vol.py -f memory.lime --profile=Linux <profile> linux.netstat
|
||||||
|
```
|
||||||
|
|
||||||
|
## FRIDA-basierte Runtime-Analyse
|
||||||
|
|
||||||
|
### FRIDA für Kryptographie-Hooks
|
||||||
|
```javascript
|
||||||
|
// crypto_hooks.js - SSL/TLS Traffic abfangen
|
||||||
|
Java.perform(function() {
|
||||||
|
var SSLContext = Java.use("javax.net.ssl.SSLContext");
|
||||||
|
SSLContext.init.overload('[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom').implementation = function(keyManagers, trustManagers, secureRandom) {
|
||||||
|
console.log("[+] SSLContext.init() called");
|
||||||
|
this.init(keyManagers, trustManagers, secureRandom);
|
||||||
|
};
|
||||||
|
});
|
||||||
|
```
|
||||||
|
|
||||||
|
### FRIDA Installation und Verwendung
|
||||||
|
```bash
|
||||||
|
# FRIDA Server auf Android-Gerät installieren
|
||||||
|
adb push frida-server /data/local/tmp/
|
||||||
|
adb shell su -c "chmod 755 /data/local/tmp/frida-server"
|
||||||
|
adb shell su -c "/data/local/tmp/frida-server &"
|
||||||
|
|
||||||
|
# Script ausführen
|
||||||
|
frida -U -l crypto_hooks.js com.target.package
|
||||||
|
```
|
||||||
|
|
||||||
|
## Custom Recovery und Fastboot-Exploits
|
||||||
|
|
||||||
|
### TWRP Installation für forensischen Zugang
|
||||||
|
```bash
|
||||||
|
# Bootloader entsperren (Herstellerabhängig)
|
||||||
|
fastboot oem unlock
|
||||||
|
# Oder
|
||||||
|
fastboot flashing unlock
|
||||||
|
|
||||||
|
# TWRP flashen
|
||||||
|
fastboot flash recovery twrp-device.img
|
||||||
|
fastboot boot twrp-device.img # Temporäre Installation
|
||||||
|
|
||||||
|
# In TWRP: ADB-Zugang mit Root-Berechtigungen
|
||||||
|
adb shell mount /system
|
||||||
|
adb shell mount /data
|
||||||
|
```
|
||||||
|
|
||||||
|
### Partitions-Imaging mit dd
|
||||||
|
```bash
|
||||||
|
# Vollständige Partition-Liste
|
||||||
|
adb shell cat /proc/partitions
|
||||||
|
|
||||||
|
# Kritische Partitionen extrahieren
|
||||||
|
adb shell dd if=/dev/block/bootdevice/by-name/system of=/external_sd/system.img
|
||||||
|
adb shell dd if=/dev/block/bootdevice/by-name/userdata of=/external_sd/userdata.img
|
||||||
|
adb shell dd if=/dev/block/bootdevice/by-name/boot of=/external_sd/boot.img
|
||||||
|
```
|
||||||
|
|
||||||
|
## SQLite Forensics und gelöschte Daten
|
||||||
|
|
||||||
|
### Erweiterte SQLite-Analyse
|
||||||
|
```bash
|
||||||
|
# Freelist-Analyse für gelöschte Einträge
|
||||||
|
sqlite3 database.db "PRAGMA freelist_count;"
|
||||||
|
sqlite3 database.db "PRAGMA page_size;"
|
||||||
|
|
||||||
|
# WAL-Datei Analyse
|
||||||
|
sqlite3 database.db "PRAGMA wal_checkpoint;"
|
||||||
|
strings database.db-wal | grep -i "search_term"
|
||||||
|
|
||||||
|
# Undark für Deleted Record Recovery
|
||||||
|
undark database.db --freelist --export-csv
|
||||||
|
```
|
||||||
|
|
||||||
|
### Timeline-Rekonstruktion
|
||||||
|
```bash
|
||||||
|
# Autopsy Timeline-Generierung
|
||||||
|
# Tools → Generate Timeline
|
||||||
|
# Analyse von MAC-Times (Modified, Accessed, Created)
|
||||||
|
|
||||||
|
# Plaso Timeline-Tools
|
||||||
|
log2timeline.py timeline.plaso /path/to/android/data/
|
||||||
|
psort.py -o dynamic timeline.plaso
|
||||||
|
```
|
||||||
|
|
||||||
|
## Weiterführende Ressourcen
|
||||||
|
|
||||||
|
### Dokumentation und Standards
|
||||||
|
- [NIST SP 800-101 Rev. 1 - Mobile Device Forensics Guidelines](https://csrc.nist.gov/pubs/sp/800/101/r1/final)
|
||||||
|
- [SANS FOR585 - Smartphone Forensics](https://www.sans.org/cyber-security-courses/advanced-smartphone-mobile-device-forensics/)
|
||||||
|
- [ALEAPP GitHub Repository](https://github.com/abrignoni/ALEAPP)
|
||||||
|
- [MVT Documentation](https://docs.mvt.re/en/latest/)
|
||||||
|
|
||||||
|
### Community und Weiterbildung
|
||||||
|
- [Autopsy User Documentation](https://sleuthkit.org/autopsy/docs/)
|
||||||
|
- [Android Forensics References](https://github.com/impillar/AndroidReferences/blob/master/AndroidTools.md)
|
||||||
|
- [Digital Forensics Framework Collection](https://github.com/mesquidar/ForensicsTools)
|
||||||
|
|
||||||
|
### Spezialisierte Tools
|
||||||
|
- [MTKClient für MediaTek Exploits](https://github.com/bkerler/mtkclient)
|
||||||
|
- [Android Forensics Framework](https://github.com/nowsecure/android-forensics)
|
||||||
|
- [Santoku Linux Mobile Forensics Distribution](https://santoku-linux.com/)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
**Wichtiger Hinweis**: Diese Anleitung dient ausschließlich für autorisierte forensische Untersuchungen. Stellen Sie sicher, dass Sie über entsprechende rechtliche Befugnisse verfügen, bevor Sie diese Techniken anwenden. Bei Zweifeln konsultieren Sie Rechtsberatung.
|
||||||
@ -878,6 +878,23 @@ tools:
|
|||||||
- reporting
|
- reporting
|
||||||
- data-processing
|
- data-processing
|
||||||
- scripting
|
- scripting
|
||||||
|
- name: "Android Logical Imaging"
|
||||||
|
icon: "📋"
|
||||||
|
type: "method"
|
||||||
|
description: "Es gibt immer wieder auch Fälle, wo man nicht allermodernste Mobilgeräte knacken muss - der Großvater, der im Nachlass ein altes Samsung mit wichtigen Daten hinterlassen hat.
|
||||||
|
Es muss in diesn Fällen nicht der teure Hersteller aus Israel sein. Die Androis-ADB-Shell bietet genug Möglichkeiten, auch ohne viel Geld auszugeben an das logische Dateisystem zu gelangen.
|
||||||
|
Die Erfolgsaussichten sinken jedoch massiv bei neuren Geräten."
|
||||||
|
domains: ["mobile-forensics"]
|
||||||
|
phases: ["data-collection"]
|
||||||
|
platforms: []
|
||||||
|
skillLevel: "advanced"
|
||||||
|
accessType: null
|
||||||
|
url: "https://claude.ai/public/artifacts/66785e1f-62bb-4eb9-9269-b08648161742"
|
||||||
|
projectUrl: null
|
||||||
|
license: null
|
||||||
|
knowledgebase: true
|
||||||
|
related_concepts: null
|
||||||
|
tags: ["imaging", "filesystem", "hardware-interface"]
|
||||||
- name: Microsoft Office 365
|
- name: Microsoft Office 365
|
||||||
type: software
|
type: software
|
||||||
description: >-
|
description: >-
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user