by Andrey Fedorov
The purpose of this article is to find additional information about the capabilities, specifics, and USPs of the ADR512 Android Data Recovery program. A full description of this software can be found here.
Developers from 512 BYTE, who created the software, invited specialists from digital forensics lab Gross to test it.
Let’s take a look at the practical tests.
The essence of the experiment step by step was as follows.
Two devices were taken: Lenovo A319 (OS version 4.4.2) and Xiaomi Redmi Note 3 Pro (OS version 6.0.1).
The Lenovo A319’s phone memory was reset to factory settings (all data, including the user’s, were deleted).
For the Lenovo A319, root rights were obtained to have full access to the memory (Hynix eMMC H4G2a) of the device.
An image of the Lenovo’s drive was created. The size of the image was 4GB.
The image was then investigated using Belkasoft Evidence Center Ultimate 2017, which is designed for data retrieval and analysis. The section “Messages” was missing in the report.
For testing, the instant messaging application imo was selected. This was installed via the Google Play Service. We chose this program because it has had over 100 million downloads. We purposefully did not choose the most used applications like “Viber”and “WhatsApp”.
Between these two devices instant messages were exchanged in “imo” (text: “512byte_gross”, “gross_512byte”). There is a screenshot below with the contents of the text messages, taken from the Xiaomi Redmi Note 3 Pro.
After using the “imo” application, the Lenovo A319 was re-imaged.
The image of the drive from was then investigated by using Belkasoft Evidence Center Ultimate. The “Messages” section now appears.
After removing the application, the image of the Lenovo A319 drive was made again.
This image was then studied with Belkasoft Evidence Center Ultimate and X-Ways Forensics 19.2. Belkasoft Evidence Center Ultimate did not detect the deleted messages (there was no “Messages” section). The search was carried out among available and deleted data: the structure of the file system of the logical section was investigated. We applied the carving method (signature analysis, carved), and searched by keywords (since the message content was known). The research time was about one hour twenty minutes. The probable reason for the lack of a positive result can be explained is that this software explores the SQLite database file (db) directly. In addition, this software can search this type of file as a result of signature analysis (carving). As a result, it can be assumed that in the event of damage to the SQLite data structures (damage or lack of signature), the evidence in the file will not be detected.
Using the X-Ways Forensics 19.2 software, entries in the free sectors of the section (image) were identified. At the same time, as in the previous case, the search was carried out among available and deleted data: the structure of the file system of the logical section was investigated; a carving method was applied; and we searched for keywords. The research took about one hour forty minutes (including research of file system structures, signature analysis, and searching for inputs). The positive result was achieved thanks to the known content of the messages.
Next, the image was analysed using ADR512. The research time with the selected settings was less than two minutes. Using this software we detected the deleted messages from our test in the “imo” application.
This test demonstrated that ADR512 has the advantage of looking for deleted messages in front of applications that work directly with database files. The positive result is achieved due to the fact that the program ADR512 implements the search for all SQLite records, without reference to the database file.
If you know the message content, you can find it in any Hex editor. However, certain questions remain: interpretation of the fields, date and time, and most importantly, the time spent analysing the data.
In the case where the search context is unknown or the number of messages is too large, a fundamentally different approach is required. ADR512 finds the messages regardless of the content and number of records.
About The Author