Android/iOS Physical Extraction · Hacking Project

Perform and document forensically sound mobile acquisition and artifact parsing across Android and iOS while respecting encryption and legal boundaries.

**The problem**
Mobile devices hold the richest evidence in most modern investigations, yet full physical extraction is blocked by hardware-backed encryption, secure enclaves, locked bootloaders, and Full-Disk/File-Based Encryption. Investigators must understand the boundaries of what is legally and technically extractable (logical vs. file-system vs. physical) and how to parse the resulting images without altering evidence. Misapplied techniques destroy data or render evidence inadmissible.

**What you'll build**
Build a lab and toolkit that demonstrates the mobile acquisition hierarchy — logical, file-system, and (where lawful and feasible) physical extraction — on test devices, documenting encryption boundaries (Android FBE, iOS Data Protection classes). Parse extracted images to recover app databases, deleted records (SQLite WAL/freelist carving), location history, and communications, and produce a chain-of-custody-preserving forensic report using open tooling.

**Objective** — Perform and document forensically sound mobile acquisition and artifact parsing across Android and iOS while respecting encryption and legal boundaries.

**Expected outcome** — A documented extraction methodology plus a parsing toolkit that recovers app artifacts and deleted records from a test device image and outputs a chain-of-custody report.

**Difficulty** — Advanced — mobile OS internals, encryption models, low-level acquisition, and SQLite carving; strong legal/ethical constraints.

**Primary category** — DFIR (Mobile Forensics); Secondary = Security Research

**Security domains** — Primary = Digital Forensics; Secondary = Incident Response, Security Research

**Technical focus** — Mobile Forensics, Logical/File-System/Physical Extraction, iOS Data Protection & Keychain, Android FBE/FDE, SQLite WAL & Freelist Carving, Deleted-Data Recovery, Artifact Parsing, Chain of Custody

**Core technologies** — Languages: Python, SQL, Bash; Frameworks/Libraries: libimobiledevice, iLEAPP/ALEAPP, forensic SQLite parsers; Security Tools: Autopsy (mobile), MVT (Mobile Verification Toolkit), Cellebrite/Magnet (commercial context), ADB, checkra1n-class bootrom context (educational); Cloud/Infra: analysis workstation, write-blocked acquisition; AI/Data: pandas for artifact correlation; Databases: SQLite (app databases, WAL/SHM)

**Where it's valued** — Law enforcement and government, DFIR consultancies, e-discovery/legal, corporate insider-threat teams, journalism/human-rights (spyware detection)

**Careers it builds toward** — Mobile Forensics Examiner, DFIR Analyst, Digital Evidence Investigator, Threat Researcher (mobile/spyware), Incident Responder

**Framework alignment**
• MITRE ATT&CK: MITRE ATT&CK for Mobile — investigation of T1414 (Clipboard Data), T1636 (Protected User Data), T1409 (Stored Application Data), T1533 (Data from Local System); spyware context (e.g., Pegasus-class)
• NIST CSF 2.0: Respond (RS.AN), Detect (DE.CM — mobile compromise/spyware), Recover (RC)
• OWASP: MASVS / MSTG (Mobile) — storage (MSTG-STORAGE), cryptography (MSTG-CRYPTO) as analysis lenses
• CIS Controls v8: 3 (Data Protection), 1 (Inventory — mobile assets), 4 (Secure Configuration of Mobile Devices)

**Innovation** — Improved Existing Solution — commercial suites dominate acquisition, but an open, education-focused parsing/methodology toolkit (esp. deleted-record carving and spyware triage) is valuable and defensible. Scores: Innovation 7/10, Startup 6/10, Enterprise-Readiness 6/10, Patent = Possible.