![Page 1: Forensic Aspect of Remote Wiping in Android · Forensic Aspect of Remote Wiping in Android Presented by: Ming Di Leom Supervisor: Dr. Kim-Kwang Raymond Choo](https://reader031.vdocuments.mx/reader031/viewer/2022022600/5b3e92517f8b9a28308ca9a2/html5/thumbnails/1.jpg)
Forensic Aspect of Remote Wiping in Android
Presented by: Ming Di Leom
Supervisor: Dr. Kim-Kwang Raymond Choo
![Page 2: Forensic Aspect of Remote Wiping in Android · Forensic Aspect of Remote Wiping in Android Presented by: Ming Di Leom Supervisor: Dr. Kim-Kwang Raymond Choo](https://reader031.vdocuments.mx/reader031/viewer/2022022600/5b3e92517f8b9a28308ca9a2/html5/thumbnails/2.jpg)
Structure
• Background
• Thumbnail recovery
• Effectiveness of remote wiping apps
• Discussion
• Future research
2
![Page 3: Forensic Aspect of Remote Wiping in Android · Forensic Aspect of Remote Wiping in Android Presented by: Ming Di Leom Supervisor: Dr. Kim-Kwang Raymond Choo](https://reader031.vdocuments.mx/reader031/viewer/2022022600/5b3e92517f8b9a28308ca9a2/html5/thumbnails/3.jpg)
Background
• In August 2013, Google announced Android Device
Manager (ADM).
• Remotely
• Locate
• Ring
• Erase (factory reset) your Android device
• Available to Android v2.3 (Gingerbread) and above
(~99%).
• No setup or installation required.
• Automatically installed through Google Play Service.
• Just need Google Account.
![Page 4: Forensic Aspect of Remote Wiping in Android · Forensic Aspect of Remote Wiping in Android Presented by: Ming Di Leom Supervisor: Dr. Kim-Kwang Raymond Choo](https://reader031.vdocuments.mx/reader031/viewer/2022022600/5b3e92517f8b9a28308ca9a2/html5/thumbnails/4.jpg)
![Page 5: Forensic Aspect of Remote Wiping in Android · Forensic Aspect of Remote Wiping in Android Presented by: Ming Di Leom Supervisor: Dr. Kim-Kwang Raymond Choo](https://reader031.vdocuments.mx/reader031/viewer/2022022600/5b3e92517f8b9a28308ca9a2/html5/thumbnails/5.jpg)
![Page 6: Forensic Aspect of Remote Wiping in Android · Forensic Aspect of Remote Wiping in Android Presented by: Ming Di Leom Supervisor: Dr. Kim-Kwang Raymond Choo](https://reader031.vdocuments.mx/reader031/viewer/2022022600/5b3e92517f8b9a28308ca9a2/html5/thumbnails/6.jpg)
• Remote wipe feature is not new in Android.
• Previously offered to Google Apps customer, or via
third party app (e.g. anti-virus).
![Page 7: Forensic Aspect of Remote Wiping in Android · Forensic Aspect of Remote Wiping in Android Presented by: Ming Di Leom Supervisor: Dr. Kim-Kwang Raymond Choo](https://reader031.vdocuments.mx/reader031/viewer/2022022600/5b3e92517f8b9a28308ca9a2/html5/thumbnails/7.jpg)
Research motivation
• ADM marks remote wiping as official (built-in) feature
in Android.
• This means most Android phone is already equipped
with remote wiping capability.
• Previous studies have shown factory reset is
ineffective.
![Page 8: Forensic Aspect of Remote Wiping in Android · Forensic Aspect of Remote Wiping in Android Presented by: Ming Di Leom Supervisor: Dr. Kim-Kwang Raymond Choo](https://reader031.vdocuments.mx/reader031/viewer/2022022600/5b3e92517f8b9a28308ca9a2/html5/thumbnails/8.jpg)
Thumbnail recovery
8
![Page 9: Forensic Aspect of Remote Wiping in Android · Forensic Aspect of Remote Wiping in Android Presented by: Ming Di Leom Supervisor: Dr. Kim-Kwang Raymond Choo](https://reader031.vdocuments.mx/reader031/viewer/2022022600/5b3e92517f8b9a28308ca9a2/html5/thumbnails/9.jpg)
Preliminary study
• Repeat the experiment done by previous study
(Schwamm 2014).
• Using older Android device (Nexus S vs. Samsung S3).
• Attempt to recover camera photos.
• Using similar forensic software to recover photos.
• Recovery rate is much lower (~50% vs 100%)
• Why?
• Let’s try to manually recover
Schwamm, R 2014, 'Effectiveness of the factory reset on a mobile device',
Master's thesis, Naval Postgraduate School, Monterey, California, USA.
![Page 10: Forensic Aspect of Remote Wiping in Android · Forensic Aspect of Remote Wiping in Android Presented by: Ming Di Leom Supervisor: Dr. Kim-Kwang Raymond Choo](https://reader031.vdocuments.mx/reader031/viewer/2022022600/5b3e92517f8b9a28308ca9a2/html5/thumbnails/10.jpg)
![Page 11: Forensic Aspect of Remote Wiping in Android · Forensic Aspect of Remote Wiping in Android Presented by: Ming Di Leom Supervisor: Dr. Kim-Kwang Raymond Choo](https://reader031.vdocuments.mx/reader031/viewer/2022022600/5b3e92517f8b9a28308ca9a2/html5/thumbnails/11.jpg)
Recovered Original
Fragmentation
![Page 12: Forensic Aspect of Remote Wiping in Android · Forensic Aspect of Remote Wiping in Android Presented by: Ming Di Leom Supervisor: Dr. Kim-Kwang Raymond Choo](https://reader031.vdocuments.mx/reader031/viewer/2022022600/5b3e92517f8b9a28308ca9a2/html5/thumbnails/12.jpg)
• However, not all kind of files are fragmented.
• e.g. thumbnail
• Smaller version of original picture.
• Less likely to be fragmented.
![Page 13: Forensic Aspect of Remote Wiping in Android · Forensic Aspect of Remote Wiping in Android Presented by: Ming Di Leom Supervisor: Dr. Kim-Kwang Raymond Choo](https://reader031.vdocuments.mx/reader031/viewer/2022022600/5b3e92517f8b9a28308ca9a2/html5/thumbnails/13.jpg)
Thumbnail recovery
• Structure of thumbnail cache
• Existing (free) file recovery tool can be tweaked to
target thumbnail only.
• Reduce false positive
![Page 14: Forensic Aspect of Remote Wiping in Android · Forensic Aspect of Remote Wiping in Android Presented by: Ming Di Leom Supervisor: Dr. Kim-Kwang Raymond Choo](https://reader031.vdocuments.mx/reader031/viewer/2022022600/5b3e92517f8b9a28308ca9a2/html5/thumbnails/14.jpg)
Result*
Thumbnail type Thumbnails recovered Percentage
200 x 200 resolution thumbnail in thumbcache 10/10 100%
VGA resolution thumbnail in thumbcache 3/10 (9/10 if include
fragmented thumbnail)30%
Embedded thumbnail in JPEG file 10/10 100%
(* After factory reset)
![Page 15: Forensic Aspect of Remote Wiping in Android · Forensic Aspect of Remote Wiping in Android Presented by: Ming Di Leom Supervisor: Dr. Kim-Kwang Raymond Choo](https://reader031.vdocuments.mx/reader031/viewer/2022022600/5b3e92517f8b9a28308ca9a2/html5/thumbnails/15.jpg)
Effectiveness of remote
wiping/factory resetIn 3rd-party app
15
![Page 16: Forensic Aspect of Remote Wiping in Android · Forensic Aspect of Remote Wiping in Android Presented by: Ming Di Leom Supervisor: Dr. Kim-Kwang Raymond Choo](https://reader031.vdocuments.mx/reader031/viewer/2022022600/5b3e92517f8b9a28308ca9a2/html5/thumbnails/16.jpg)
Effectiveness of remote wiping/factory reset
• Schwamm, (2014) tested default factory reset
function.
• 7 apps were tested against the default.
• Compare the recovery rate.
• 2 apps offer “secure” wiping, which should make the
files unrecoverable.
• Test on 3 mobile devices:
• Moto G (< 3 months of usage, using new file system)
• Nexus S (> 3 years of usage, older file system)
• Nexus 4 (~2 years of usage, most common file system,
test still ongoing)
![Page 17: Forensic Aspect of Remote Wiping in Android · Forensic Aspect of Remote Wiping in Android Presented by: Ming Di Leom Supervisor: Dr. Kim-Kwang Raymond Choo](https://reader031.vdocuments.mx/reader031/viewer/2022022600/5b3e92517f8b9a28308ca9a2/html5/thumbnails/17.jpg)
Results:
• 1 app default wipe method remove almost nothing
• Out of 2 apps which offer secure wiping, only 1 is
more effective.
• Even with secure wiping, data recovery is still
possible
• Almost all apps are similar to default’s.
• Very low recovery rate on Moto G (secure wiping or
not)
![Page 18: Forensic Aspect of Remote Wiping in Android · Forensic Aspect of Remote Wiping in Android Presented by: Ming Di Leom Supervisor: Dr. Kim-Kwang Raymond Choo](https://reader031.vdocuments.mx/reader031/viewer/2022022600/5b3e92517f8b9a28308ca9a2/html5/thumbnails/18.jpg)
Discussion
• Data remnant issue can be solved through full-disk
encryption
• Introduced in Android 4.0 (Ice Cream Sandwich)
• Default in Android 5.0 (Lollipop)
• However, 4 months after Android Lollipop release,
encryption is back to optional due to performance
issue of current hardware.
• Recommendation:
• Enable full-disk encryption if possible
• Secure wiping, although not very effective, but better than
nothing.
![Page 19: Forensic Aspect of Remote Wiping in Android · Forensic Aspect of Remote Wiping in Android Presented by: Ming Di Leom Supervisor: Dr. Kim-Kwang Raymond Choo](https://reader031.vdocuments.mx/reader031/viewer/2022022600/5b3e92517f8b9a28308ca9a2/html5/thumbnails/19.jpg)
Future research
• Thumbnail recovery
• More photo gallery apps
• More devices (i.e. camera resolution)
• Effectiveness study
• Secure wiping method used.
• Which/how factor (usage, file system) affects recovery
rate.
19
![Page 20: Forensic Aspect of Remote Wiping in Android · Forensic Aspect of Remote Wiping in Android Presented by: Ming Di Leom Supervisor: Dr. Kim-Kwang Raymond Choo](https://reader031.vdocuments.mx/reader031/viewer/2022022600/5b3e92517f8b9a28308ca9a2/html5/thumbnails/20.jpg)
Q & A
20