Hacking Android phone using Metasploit

Hacking Android phone using Metasploit

Introduction
World is contracting with the growth of mobile phone technology. As the number of users is increasing day by day, facilities and the statistics are changing likewise. The mobile phones are providing ease and comfort in connecting to the people around us and enable us to share our conversation. But at the same time security threats are also increasing with the growth of the mobile users. With the term of security, users need to be aware of the attacks and security measures those are required to be carried out. The most used platform in mobile phones is android which is very popular among other available platforms. Android has become the operating system of choice for users who value innovation so with this article I am going to show how to hack the mobile phone on android platform by using Metasploit.

Requirements for exploitation

Metasploit

Metasploit Framework, a tool for developing and executing exploit code against a remote target machine. Metasploit is an advanced open-source platform for developing, testing and using exploit code. The framework is used by network security professionals to perform penetration tests, system administrators to verify patch installations, product vendors to perform regression testing, and security researchers world-wide. The framework is written in the Ruby programming language and includes components written in C and assembler.

The extensible model through which payloads, encoders, no-op generators, and exploits can be integrated has made it possible to use the Metasploit Framework as an outlet for cutting-edge exploitation research. It ships with hundreds of exploits, as you can see in their list of modules. This makes writing your own exploits easier, and it certainly beats scouring the darkest corners of the Internet for illicit shell code of dubious quality.

Android Device
Android is a Linux-based mobile phone operating system. The operating system uses touch inputs that loosely correspond to real-world actions, like swiping, tapping, pinching, and reverse pinching to manipulate on-screen objects, and a virtual keyboard. Android is the most popular smart phone platform having cemented itself as a major player in the mobile marketplace to other device makers

Process of Exploitation

Metasploit has added some functionality for security testing Android Devices. Metasploit has released android meterpreter too for exploitation so in this article we will show you how to use an android meterpreter payload to hack into an android device.

We will do this by creating a “malicious” APK file (An APK file is a file format used to distribute and install software on the Android operating system.), so that once it is run, it will connect out to our attacking machine running Metasploit. We will set Metasploit up to listen for the incoming connection and once it sees it, create a fully functional remote access to the device.

We need to create the Application that will include a remote shell. To do so, we will use the msfpayload command from Metasploit. Open Kali Linux Terminal and type ifconfig to get the Attackers IP address for victim to connect back. 

Generate msfpayload application which will be sent to victim. So, execute the following command to generate payload application. 

msfpayload	Metasploit command to create payloads (exe, java, apk etc.)
Lhost	Attackers IP address for victim to connect back
Lport	(Port of your local pc)port for victim to connect back
-R	msfpayload parameter indicates generation of raw payload
APK	Application Package file

Attacker’s IP address is 192.168.1.5.You can use any port number except the well known ports.

Successful execution of msfpayload will create mali_app.apk App which is a Metasploit reverse TCP. When the app is installed on any android device, it will connect back to attackers IP address.

Open terminal and type msfconsole to go to Metasploit console. 

Start a multi handler on your machine to get a reverse tcp connection from victim using the following command. 

Because our payload is reverse_tcp where attacker expects the victim to connect back to attacker machine, attacker needs to set up the handler to handle incoming connections. We need to set up a listener to handle reverse connection sent by victim when the exploit successfully executed.

The next step we need to configure the switch for the Metasploit payload. lhost and Lport will be same that we have given in payload. 

A multi handler will start on your machine and it will be waiting for a reverse_tcp connection from victim's side. 

Send your payload to victim and wait for its execution. As soon as victim will execute it, it will return a reverse connection and you can access meterpreter shell on victim Android Phone.

On Android device, it should show up as a “Main Activity”. After opening the application a big button will appear on your phone that says, “ReverseTcp”, when it is pressed, your phone will connect out to the Metasploit system and a remote shell session is created. 

On your Metaploit system you should see an active session is created and it drops you automatically into a meterpreter prompt. This means is we are inside the victim android Smartphone and we can do everything with victim phone. 

You can type “sysinfo” to get information on the device. 

As in Linux, the ‘ls’ command will list the files in the current remote directory. 

The ‘ps’ command displays a list of running processes on the target. 

Webcam_list command provides you a list of all webcams on the target android phone. Each webcam will have an index number.

Webcam_snap 1 command take a snapshot for the specified webcam, by default number 1 and will try without argument precision to open the saved snapshot 

Record_mic command record audio from the default microphone for X seconds and store the recorded sound in the default directory. 

Prevention

• Check app permissions: Look carefully at any application before you install it to make sure it’s legitimate and it only asks for necessary permissions. A torch app asking to access your contacts, internet and phone is never really a good idea. Discard app that seem shady – they’re usually not worth risking personal information over

• Download Apps Only from Trusted Sources: Using the Google Play Store to download apps or Amazon’s Appstore already makes you among the more secure tiers of Android users – many dodgy apps are distributed through third-party Android app stores rather than the official ones.
• Switch off 'Unknown sources: It’s highly advisable to keep installation of apps from Unknown Sources at “off” in the device’s settingsThis will help ensure that nothing enters the system except through official channels. Prior to installing an application you downloaded outside of the Play store, Google will scan the app and warn you of any potential threats if you on the verify app button .
  

Conclusion

Android is one of the most open, versatile, and customizable mobile operating systems out there. Among the mobile phone malware attacks, the Android smart phones are largely targeted by the hackers. This is mainly due to the reason that the Android applications market provides an open platform for the applications. In this article we create a malicious Android application and whenever victim runs it on the android phones, it will connect out to attacking machine running Metasploit. After the successful exploitation we get the meterpreter prompt that provides the access of the victim’s android Smartphone access that leads us to perform our desired activity on victim’s phone.

Penetration Testing Apps for Android Devices

Introduction

The amount of mobile phone users is larger than PC users according to a recent research. At the same time, the people who own Android phones are increasing rapidly. Android phone brings people a lot of convenience that it helps people do as much work as they can do on computer, while has no limitation to the location

Android has become a need rather than luxury these days, and its popularity has increased rapidly among available smart phones. There are lots of OS which are available these days but among all of them android is the best one, as it can be handled easily and also it is very easy to implement because its open source nature.

Android App Development is nowadays has become an important tool for developing mobile applications. The Software Development Kit facilitated by the Android assists the developers to start developing and working on the applications instantaneously and the app can be implemented faster.

Now penetration testing is possible by using Android platform, now there will be no need to carry your system to various locations to carry out Penetration Testing.As we all know Penetration Testing involves much involvement of the person into their system but by using your android phone you can perform it at any location in a best way you can.

Following are the Android applications that you can use for penetration testing.

1.     Networking Tools

Port Scanner: this tool lets you scan ports on a remote host via its IP or domain name so you can know which ports are open on the host. It supports 3G, protocol recognition, and many other features.

Fing: Fing is a professional App for network analysis. A simple and intuitive interface helps you evaluate security levels, detect intruders and resolve network issues. It helps us to find out which devices are connected to your Wi-Fi network, in just a few seconds.

Network Discovery: Network Discovery is similar to Fing. It is used for device discovery and works as a port scanner for local area network.

tPacketCapture: tPacketCapture does packet capturing without using any root permissions. tPacketCapture uses VpnService provided by Android OS.Captured data are saved as a PCAP file format in the external storage.

Droidsheep: Droidsheep is written by Andrew Koch. It works as a session hijacker for non-encrypted sites and allows you to save cookies files/sessions for later analysis. It is no longer available from developer’s site i.e. droidsheep.de.

FaceNiff: FaceNiff is an app that allows you to sniff and intercept web session profiles over the WiFi that your mobile is connected to. It is possible to hijack sessions only when WiFi is not using EAP, but it should work over any private networks

2.     DOS

LOIC: LOIC is a tool for network stress testing denial-of-service attack application. LOIC performs a denial-of-service (DoS) attack (or when used by multiple individuals, a DDoS attack) on a target site by flooding the server with TCP or UDP packets with the intention of disrupting the service of a particular host.

AnDOSid: AnDOSid allows security professionals to simulate a DOS attack. AnDOSid app launched a HTTP POST flood attack, where the number of HTTP requests becomes so huge; a victim’s server has trouble responding to them all. When the server begins to rely too heavily on its system resources, it crashes.

3.     Packet sniffer

Intercepter-NG: Intercepter-NG is a multifunctional network toolkit. It has functionality of several famous separate tools and more over offers a good and unique alternative of Wireshark for android.
The main features are:
network discovery with OS detection

·         network traffic analysis

·         passwords recovery

·         files recovery

Shark for Root: Traffic sniffer, works on 3G and WiFi (works on FroYo tethered mode too).To open dump use WireShark or similar software, for preview dump on phone use Shark Reader.

PacketShark: This is a packet sniffer application. Features include friendly capture options interface, filter support, live capture view, and Dropbox upload of capture files. It allows viewing the capture packets no need to install other application as a viewer.

4.     Scanners

WPScan: WPScan is a black box WordPress Security Scanner written in Ruby which attempts to find known security weaknesses within WordPress installations. This app was developed by Alessio Dalla Piazza. Its intended use it to be for security professionals or WordPress administrators to assess the security posture of their WordPress installations. WPScan includes user enumeration and will detect timthumb file, theme and WordPress version and notify you 

Nessus: Nessus is a popular penetration testing tool that is used to perform vulnerability scans with its client/server architecture. Nessus Android app can perform following tasks.

·         Connect to a Nessus server (4.2 or greater)

·         Launch existing scans on the server

·         Start, stop or pause running scans

·         Create and execute new scans and scan templates

·         View and filter reports

Network Mapper:

·         A very fast net scanner for network admins that can scan your network in the office and export as CSV via Gmail to give you a map of what devices are on your LAN.

·         Includes a port scanner for security audit scans and a MAC vendor database to identify NIC manufacturers

·         Can detect firewalled and stealthed computers, quite useful if you are looking for a windows/firewall box that you can't see on your network.

·         Useful if you want to find FTP servers, SSH servers, SMB servers etc on your network and would help you to diagnose faults.

·         You can save the scan results as a CSV file which can be imported into Excel/Google Spreadsheet/LibreOffice

5.     Webattack

DroidSQLi: DroidSQLi is the first automated MySQL Injection tool for Android. It allows you to test your MySQL-based web application against SQL injection attacks.

DroidSQLi supports the following injection techniques:

·         Time based injection

·         Blind injection

·         Error based injection

·         Normal injection

It automatically selects the best technique to use and employs some simple filter evasion methods.

Sqlmapchik: sqlmapchik is a cross-platform sqlmap GUI for popular sqlmap tool. It is primarily aimed to be used on mobile devices. The easiest way to install sqlmapchik on Android device is to download it from Google Play.

6.     Pentesting suites

dSploit: dSploit is an Android network analysis and penetration suite which aims to offer to IT security experts/geeks the most complete and advanced professional toolkit to perform network security assessments on a mobile device. Once dSploit is started, you will be able to easily map your network, fingerprint alive host’s operating systems and running services, search for known vulnerabilities, crack logon procedures of many tcp protocols, perform man in the middle attacks such as password sniffing, real time traffic manipulation etc.

These are the available modules in the app.

·         RouterPWN

·         Trace

·         Port Scanner

·         Inspector

·         Vulnerability Finder

·         Login Cracker

·         Packet Forger

·         MITM

Revenssis Penetration Suite: Revenssis Penetration Suite is a set of all the useful types of tools used in Computer and Web Application security.  

·         Web Vulnerability Scanners including:

o   SQL injection scanner

o   XSS scanner

o   DDOS scanner

o   CSRF scanner

o   SSL misconfiguration scanner

o   Remote and Local File Inclusion (RFI/LFI) scanners

·         Useful utilities such as:

o   WHOIS lookup, IP finder, Shell, SSH, Blacklist lookup tool, Ping tool,

·         Forensic tools (in implementation) such as malware analyzers, hash crackers, network sniffer, ZIP/RAR password finder, social engineering toolset, reverse engineering tool

·         Vulnerability research lab (sources include: Shodan vulnerability search engine, ExploitSearch, Exploit DB, OSVDB and NVD NIST

·         Self scan and Defence tools for your Android phone against vulnerabilities

·         Connectivity Security Tools for Bluetooth, Wifi and Internet. (NFC, Wifi Direct and USB in implementation)

zANTI: zANTI is a comprehensive network diagnostics toolkit that enables complex audits and penetration tests at the push of a button. It provides cloud-based reporting that walks you through simple guidelines to ensure network safety.

zANTI offers a comprehensive range of fully customizable scans to reveal everything from authentication, backdoor and brute-force attempts to database, DNS and protocol-specific attacks – including rogue access points.

7.     Anonymity

Orbot: Orbot is a free proxy app that empowers other apps to use the internet more securely. Orbot uses Tor to encrypt your Internet traffic and then hides it by bouncing through a series of computers around the world. Tor is an open network that helps you defend against a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security known as traffic analysis.

·         Orbot is the safest way to use the Internet on Android. Period. Orbot bounces your encrypted traffic several times through computers around the world, instead of connecting you directly like VPNs and proxies. This process takes a little longer, but the strongest privacy and identity protection available is worth the wait.

·         Use with Orweb, the most anonymous way to access any website, even if it’s normally blocked, monitored, or on the hidden web.

·         Use Gibberbot with Orbot to chat confidentially with anyone, anywhere for free.

·         Any installed app can use Tor if it has a proxy feature, using the settings. You can use private web searching with DuckDuckGo.

·         Orbot can be configured to transparently proxy all of your Internet traffic through Tor. You can also choose which specific apps you want to use through Tor.

·         Orbot is free software.

OpenVPN: OpenVPN Connect is the official full-featured Android VPN client for the OpenVPN Access Server, Private Tunnel VPN and OpenVPN Community, developed by OpenVPN Technologies, Inc.

·         Does not require a rooted device.

·         Easily import .ovpn profiles from SD card, OpenVPN Access Server, Private Tunnel or via a browser link.

·         Improved power management - preferences setting allows VPN to pause in a low-power state whenever screen is blanked or network is unavailable.

·         Android Keychain integration - OpenVPN profiles may reference a cert/key pair in the Android keychain.

·         Supports hardware-backed keystores

·         Support for multi-factor authentication using OpenVPN static and dynamic challenge/response protocols.

·         Full IPv6 support (at both the tunnel and transport layer).

Orweb: Orweb is the most privacy-enhancing web browser on Android for visiting any website, even if it’s normally censored, monitored, or on the hidden web. Orweb is the safest browser on Android. Orweb evades tracking and censorship by bouncing your encrypted traffic several times through computers around the world, instead of connecting you directly like VPNs and proxies. This process takes a little longer, but the strongest privacy and identity protection available is worth the wait.

·         Orweb bypasses almost every kind of network restriction.

·         Orweb does not store any information about the websites you visit.

·         You can prevent sites you visit from installing any cookies (which could track your web activities), allow them selectively, or allow any site to create cookies.

·         JavaScript, a common attack method for malicious software, is disabled by default.

·         Orweb is opensource.

·         Orweb attempts to prevent Flash from loading on sites you visit, blocking   many common security threats.

·         Orweb is available in: Arabic, Chinese, Dutch, English, Esperanto, Farsi, French, German, Hungarian, Italian, Norwegian, Russian, Spanish, Swedish and Tibetan

Conclusion

Android Operating System has been progressing quite rapidly. Android, is an innovative and open platform.  Android is most popular mobile OS. It is well positioned to address the growing needs of the mobile marketplace. Due to rapid growth of android, developers are now focusing on developing their tools in the android environment. Above mention android application is the proof of that. The Software Development Kit facilitated by the Android helps developers to achieve the same.

Above applications discussed are the ways to perform penetration testing from your android mobile. We can achieve anonymity and can perform web attacks by using android phone. It also provides us penetration suites and other networking tools.

References

·         http://www.irongeek.com/i.php?page=videos/notacon11/nindroid-pentesting-apps-for-your-android-device-michael-palumbo

Android Architecture and Forensics

Android Architecture and Forensics

Android is one of the most open, versatile, and customizable mobile operating systems out there. Android is a Linux-based operating system with market share - 79.70% in smart phones. Android is a software stack for mobile devices that includes an operating system, middleware and key applications.

Android Architecture

Android operating system is a stack of software components which is roughly divided into five sections and four main layers, where each layer is a group of several program components. Together it includes operating system, middleware and important applications. Each layer in the architecture provides different services to the layer as shown below in the architecture diagram.

Linux kernel

The architecture is based on the Linux2.6 kernel. Android use Linux kernel as its hardware abstraction layer between the hardware and rest of the software. It also provides memory management, process management, a security model, and networking, a lot of core operating system infrastructures that are robust and have been proven over time

Android’s native libraries.

· Libc: c standard lib.

· SSL: Secure Socket Layer

· SGL: 2D image engine

· OpenGL|ES: 3D image engine

· Media Framework: media codecs

· SQLite: Database engine

· WebKit: Kernel of web browser

· FreeType: Bitmap and Vector

· SufraceManager: Compose window manager with off-screen buffering.

Android Runtime

Android Runtime consists of Dalvik Virtual machine and Core Java libraries.

• Core Java Libraries: These are different from Java SE and Java ME libraries. However these libraries provide most of the functionalities defined in the Java SE libraries.
• Dalvik Virtual Machine: It is a type of JVM used in android devices to run apps and is optimized for low processing power and low memory environments. Unlike the JVM, the Dalvik Virtual Machine doesn’t run .class files, instead it runs .dex files. A .dex file is built from .class file at the time of compilation and provides hifger efficiency in low resource environments. The Dalvik VM allows multiple instance of Virtual machine to be created simultaneously providing security, isolation, memory management and threading support. It is developed by Dan Bornstein of Google.

Application Framework

The blocks that our applications directly interact with.

· Activity Manager: Manages the activity life cycle of applications

· Content Providers: Manage the data sharing between applications

· Telephony Manager: Manages all voice calls. We use telephony manager if we want to access voice calls in our application.

· Location Manager: Location management, using GPS or cell tower

· Resource Manager: Manage the various types of resources we use in our Application

Applications

And the final layer on top is Applications. This is where all the applications get written. It includes the home application, the contacts application, the browser, and your apps. And everything at this layer is, again, using the same app framework provided by the layers below.

Rooting Android Phone

Rooting your phone can give you the opportunity to do so much more than your phone can do out of the box—whether it's wireless tethering, speeding it up with over clocking, or customizing the look of your phone with themes. By default phones do not allow users root access because the average consumer will not need it.

What is rooting?

That’s essentially what happens if you root your Android device. With root access, you can get around any restrictions that your manufacturer or carrier may have applied. You can run more apps; you can customize your device to a greater degree; and you can potentially speed it up in a variety of ways. It’s similar running programs as administrators in Windows, or running a command with sudo in Linux. With a rooted phone, you can run apps that require access to certain system settings, as well as flash custom ROMs to your phone, which add all sorts of extra features.

The process involves backing up your current software and then flashing (installing) a new custom ROM (modified version of Android).

Steps to be followed

There are several tools for rooting purposes. This time I am using tool named Rescue Root. Steps for rooting android devices are as follow.

· Download and install Rescue Root on your PC. You can download it from http://rescueroot.com/.

· Run the software and connect your Android phone, tablet by USB to your PC. Make sure that your android device is in the USB Debugging Mode.

· Click on next step to begin. Android device will automatically be identified by the software, and the specific drivers for Android device will be installed on the computer – no hassle searching to find the right drivers, this is all done automatically.

· Once Android device support is confirmed, Rescue Root will make a full backup of your phone and store it on PC. This will guarantee that all your data, apps, contacts and files are completely safe.

· A root script specific to your device will be identified, downloaded, and run via USB, rooting your Android without you needing to run any scripts, complex steps, or batch files. The software will then reboot your phone and confirm that it has been rooted.

· Your device is now successfully rooted.

Advantages of Rooting

· Running special applications

· Custom ROM's-This is the most powerful feature of "rooted" phones. There are hundreds of custom ROM's that can do anything from speeding up the processing speed of your phone to changing the entire look and feel of your phone.

Disadvantages

There are essentially three potential cons to rooting your Android.

· Voiding your warranty: Some manufacturers or carriers will use rooting as an excuse to void your warranty.

· Bricking your phone: Whenever you tamper too much, you run at least a small risk of bricking your device. This is the big fear everyone has. The obvious way to avoid it happening is to follow instructions carefully.

· Security risks: Rooting may introduce some security risks. Depending on what services or apps you use on your device, rooting could create security vulnerability.

Extract data from an Android mobile device.

Requirements

· Santoku Linux

· An Android mobile device with USB debugging on.

Santoku Linux, a custom distribution jam-packed with tools for mobile forensics, mobile malware analysis, and mobile security testing.

Santoku is preconfigured with:

· AFLogical Opensource Edition

· Android Brute Forece Encryption

· iphone Backup Analyzer

• Libimobiledevice
• Scalpel

· Sleuth Kit

• Exiftool

Steps to be followed

Make sure your device is connected to your machine. If you’re using Santoku in VMWare Player, go to VM then Removable Devices and click “Connect”.

Enable USB debugging on your device. Go to Settings then Developer Options, then check USB debugging.

To check weather santoku is properly communicating with our target device or not we will use adb i.e Android Debug Bridge. We have to make ensure that the USB Debugging is on in our target device.

We will use command adb devices and it should return with a serial number and 'device'. If it can’t then it will shows the couple of error massages means it’s not communicating properly.

When the connection is established successfully then first we have to deploy the agent for this we go to Santoku menu -> Device Tools ->SDK Manager ->AFlogical OSE.

After that we execute the script that pushes the agent to the target device we do this by running the command AFLogical-OSE.

Then on the target device we have to open AFLogical-OSE and Select whatever data we want to extract and then click capture.

The data is then extracted from the target device to the SDCard of the Device and after pressing enter on our santoku machine data will be pulled from our SDCard to the Santoku machine

From santoku we can access the data we selected in the clear format.

By using the below command we can uninstall the agent from the target device.

Data Recovery from android

Android phone is turned more like a storage device with lots of snapped pictures, audio & video files, latest exciting apps, mails, messages and so on. In situations like this, losing or accidentally deleting file is a common issue that most of the Android users face.

Wondershare Dr.Fone

Wondershare Dr.Fone Data Recovery software has the following features:

· Recover lost or deleted SMS text messages and contacts directly from your smart phone.

· Help you get back photos, video, audio files and document from SD cards inside your device, no matter they are lost because of accidently deleting, factory resetting, flashing ROM, rooting, etc.

· You are allowed to preview and selectively check to restore messages, contacts and photos.

Steps to be followed

Install and run the program on your computer, and connect your Android phone with computer.

Enable USB debugging on your Android device.

Once you enable USB debugging, the Android recovery software will detect your phone, the next step you can tap on the Start button to analyze the data on your SD card.

After finish scanning the SD card, you will be able to preview found files such as Messages, contacts, photos and videos, so as to check whether your lost files are found or not.

Then select files you want to recover from SD card, and then left click on Recover button.

WhatsApp Forensics

WhatsApp is a widespread instant messaging application for smartphones, available for iOS, Android, BlackBerry, Symbian and Windows Phone. The chance to replace the traditional SMS service avoiding its cost, has allowed this application to gain popularity very quickly. The automatic synchronization of the app to the phone addresses book, the unlimited message length and the possibility to share a high range of multimedia attachments have persuaded many people.

Steps to be followed

WhatsApp stores all its information on a SQLite database: the location and the structure of the database are different from platform to platform.

In android you will be only able to get an encrypted file from the SD card (/sdcard/WhatsApp/Databases/msgstore.db.crypt)

Whatsapp Xtract is an Open Source tool for WhatsApp extraction and analysis. It supports multi platform such as Windows, Linux, and Mac OS X. By now it supports iOS and Android. Download whatsapp xtract and unzip it.

You need Python and for Android msgstore.db.crypt decryption the PyCrypto library. The easiest way is to install ActivePython. Run pyCrypto as an administrator.

Run whatsapp_xtract_console.bat and then manually specify the input file with command whatsapp_xtract.py -i msgstore.db.crypt.

After pressing enter whatsapp xtract tries to decrypt android database and we will get the extracted message of whatsapp in html format in the same directory.

The resulting file size of the .html file will be slightly bigger than the size of the .db database.

Skype Forensics

Skype is an IP telephony service provider that offers free calling between subscribers and low-cost calling to people who don't use the service. In addition to standard telephone calls, Skype enables file transfers, texting, video chat and videoconferencing. The service is available for desktop computers, notebook and tablet computers and other mobile devices, including mobile phones.

Steps to be followed

Skype xtractor is an Open source tool for Skype analysis. It’s available for computer and mobile version. It supports multi platform i.e Windows, Linux

The main.db file is a SQLite database. Using Skype xtractor, you can open the official memory of the Skype program. The information you can retrieve from this file represent the data that has not been deleted or removed by the user.

Features

· Extract the most important fields for the following tables (of the Skype’s main.db): Accounts, Calls, Chats, Contacts, File Transfers, Group Chat, Voice Mails

· Extract most of the messages stored in the Chatsync files. (Note: Chatsync files store edited and deleted messages)

· Reporting in HTML and CSV supported

· HTML reporting has filters to sort data in the best way.

To use Skype Xtractor simply type the following commands in your shell or cmd:

Python skype.py --chatsync /path/of/the/mainDatabase/main.db

After pressing enter it will extract all the tables attached in main.db.

We will get the extracted files of Skype.

Conclusion

Mobile forensics, arguably the fastest growing and evolving digital forensic discipline, offers significant opportunities as well as many challenges. Android forensics involves the analysis of data from devices, it is important to have a broad understanding of both the platform and the tools that will be used throughout the investigation. From this article you will get the idea of android architecture and the some tools used in android forensics.

References

• https://santoku-linux.com/
• http://www.recovery-android.com/
• http://haifux.org/lectures/298/android.pdf
• http://rescueroot.com/