Paper accepted!

Today, we got the great message that our paper “Forensic Acquisition of Location Data on Android Smartphones” had been accepted for the Eighth Annual IFIP WG 11.9 International Conference on Digital Forensics in South Africa. We are really looking forward to participate.

For all of you, who can’t wait until January, here is the abstract of our work:

It is now well-known that, for various reasons, smartphone operating systems persistently store location information in their local storage. Less well-known is probably that also various network applications (apps) do this too. In this paper we present a system with which all this information can be extracted and visualized at the same time. Our system is based on the forensic data extraction tool ADEL. During our evaluation we found that in contrast to data retained by the network operator, location data stored on the mobile device in many cases offers much more precise information than the rather coarse-grained data from the network operator. However, the availability of data shows a much higher variability on the mobile phone than at the network operator.

How to root a HTC Wildfire

The following steps will void the warranty of the device and there is no guaranty that it will work on your device!

  • First of all you will need to know what version of HBOOT the device is using and the serial number of it
  • If HBOOT is not 1.01.0001 you have to downgrade to HTC Froyo WWE for Revolutionary
  • Download & install the HTC Sync drivers
  • Make sure USB debugging is enabled on the device
  • Download Revolutionary 0.4pre4
  • Connect the HTC Wildfire to the computer via USB
  • Launch the Revolutionary software and enter in the beta key you got from the revolutionary website
  • Revolutionary will now root the device, set S-OFF and install clockwork recovery. The device will reboot on its own afterwards
  • Now you can flash a custom ROM with the help of clockwork recovery

If all these steps are finished successfully you are root and, if you have flashed a new custom ROM, you are running a newer version of Android.

Android devices and JTAG

Today I got some new toys to improve the forensic investigation process on smartphones. These tools allow to connect directly to the JTAG interface on the smartphone and so it should be possible to get a real dump of the memory.

I’m really excited how this works out 🙂