Mobile Forensics: UFED vs Magnet ACQUIRE

Magnet Acquire (Magnet Forensics) is a free forensic tool that is becoming more and more popular. Among other devices, you can use it for forensic acquisition of Android smartphones and tablets. Since extracted data is stored in an archive of its own format, it is not always possible to analyze them with other mobile forensic tools. This article will show you how to analyze a logical image created with Acquire using UFED Physical Analyzer (Cellebrite).

How Magnet Acquire works.

When extracting data from an Android mobile device, Magnet Acquire performs the following steps:

1) Creates a backup of this device.

2) Installs an agent app on the device.

3) Uses this app to retrieve some types of data and copies files from the device’s SD card (if present).

4) Repacks all extracted data and files into one file.

Structure of an Acquire logical image.

Here is the image of the folder with an Acquire logical image.

Fig. 1. Samsung smartphone logical image created with Magnet Acquire

Where:

– ‘activity_log.txt’ contains extraction log.

– ‘image_info.txt’ contains summary report.

Fig. 2. Summary report.

File ‘samsung SAMSUNG-SM-G900A Quick Image.zip’ – Samsung smartphone logical image.

The structure of ‘SAMSUNG-SM-G900A Quick Image.zip’ file.

‘samsung SAMSUNG-SM-G900A Quick Image.zip’ contains the following files and folders:

Fig. 3. ‘SAMSUNG-SM-G900A Quick Image.zip’ contents.

‘Agent Data’ folder contains files: ‘calendar.db’, ‘contacts2.db’, ‘contacts3.db’, ‘mmssms.db’, ‘wifi.db’.

‘sdcard’ folder contains files copied from the SD card of the Android device.

‘adb-data.tar’ contains the Android device backup.

Preparation for the analysis.

1. Unzip the file ‘adb-data.tar’.
2. Transfer databases from the ‘Agent Data’ directory to the appropriate sub-directories of apps:

• Move the files ‘contacts2.db’, ‘contacts3.db’ from ‘Agent Data’ to the created subfolder ‘com.android.providers.contacts’.
• Move the file ‘mmssms.db’ into the created subfolder ‘com.android.providers.telephony / databases’.
• Move the file ‘calendar.db’ into the created subfolder ‘com.android.providers.calendar / db’.
• Move the file ‘wifi.db’ into the created subfolder ‘databases’.

3. Place the ‘apps’ and ‘sdcard’ directories into the ‘Prepared Magnet Backup’ directory.

Preliminary analysis.

Start UFED Physical Analyzer.

On the toolbar, select ‘File’ – ‘Open (Advanced) …’.

In the ‘Open (Advanced)’ window, click the ‘Select Device’ button.

In the next window, select ‘Google’ and the device ‘Google Android Filesystem (Generic)’

Fig. 4. The ‘Open (Advanced)’ window.

Click the ‘Next’ button. Click the ‘Next’ button again. In the next window, click the ‘Folder’ button, specify the path to the folder ‘Prepared Magnet Backup’. Click the ‘Finish’ button. Processing will start.

Fig. 5. Results of the preliminary analysis.

Finally, you can see the results of the analysis in UFED Physical Analyzer. Click on the ‘Databases’ category. It shows that ‘contacts3.db’, ‘calendar.db’, ‘wifi.db’ have not been parsed.

Fig. 6.Databases analysis results.

You can use SQLite Wizard to analyze these files.

Databases parsing queries creation.

We are going to use ‘wifi.db’ to show you how to parse unknown databases with SQLite Wizard. Similar steps are required to parse other databases.

In the ‘Databases’ category, select the ‘wifi.db’ file. Right-click it and select ‘Open in SQLite Wizard’.

In the ‘SQLite Wizard’ window, fill in two fields: ‘Application’ and ‘Name’. Tick the ‘Include deleted rows’ box, doing it you may extract more evidence, but also it can result in increased number of false-positives. Click the ‘Next’ button.

Fig. 7. ‘SQLite wizard’ window.

In the next window, select ‘wifi_configurations’. In the opened tab ‘wifi_configurations’ put a tick in front of ‘*’. Click the ‘Next’ button.

Fig. 8. ‘SQLite Wizard’ window.

In the next window select ‘Wireless Networks’

Fig. 9. ‘SQLite Wizard’.

Drag field types to the corresponding columns.

In the next window, select ‘Wireless Networks’.

Fig. 10. ‘SQLite Wizard’.

Click the ‘Next’ button. Click the ‘Save’ button.

Repeat the steps for other databases if you want to.

Analysis of ‘wifi.db’, ‘contacts3.db’ and ‘calendar.db’ databases.

On the toolbar, choose ‘Tools’ – ‘SQLite wizard’ – ‘Open SQLite query manager’ (or press Ctrl + Q).

In the window that opens, hold down the ‘Ctrl’ key, select ‘wifi.db’, ‘contacts3.db’, ‘calendar.db’. Click the ‘Run’ button.

Fig. 11. ‘Open SQLite query manager’.

As a result of the additional analysis:

– a new category ‘Calendar’ has appeared;

– the number of detected and restored records in categories ‘Contacts’ and ‘Wireless Networks’ has  been increased.

Fig. 12. Results of the analysis

Conclusion

As you can see, you can use not only IEF or Axiom for processing Magnet Acquire Android logical images. In the article we have shown how to do it with UFED Physical Analyzer, including it’s brand new module – SQLite Wizard.

Authors:

Igor Mikhaylov & Oleg Skulkin  & Igor Shorokhov