You can access forensic software for mobile forensic devices
SAFT is a free and easy-to-use mobile forensics application developed by SignalSEC security researchers. SAFT allows you to extract valuable information from device in just one click.
AFLogical OSE – Open source Android Forensics app and framework is an application in APK format that must be installed beforehand in the Android terminal. Once the process is completed it allows varied information to be extracted to the SD card (call log, contact list and list of applications installed, text messages and multimedia), which must subsequently be recovered either by connecting the card to an external device or through the ADB.
Open Source Android Forensics is a framework that is distributed via a virtual machine image that brings together various tools which allow the analysis of applications for mobile devices, including both a static and a dynamic analysis or even a forensic analysis.
Andriller is an application for Windows operating systems that brings together different forensic utilities. It allows a lot of interesting information to be obtained that is related, amongst others, both to social media and to messaging programmes (Skype, Tinder, Viber, WhatsApp, etc.).
FTK Imager Lite allows us to work with memory dumps of mobile devices to analyse them and obtain evidence.
NowSecure Forensics Community Edition
NowSecure Forensics Community Edition is distributed as a virtual image that brings together various tools to carry out a forensic analysis, and can carry out different types of evidence extraction or even file carving in its commercial version.
LIME- Linux Memory Extractor is software that allows a volatile memory dump to be obtained from a Linux-based device, as is the case for Android phones. Likewise, it has the advantage that it can be executed remotely via a network.
Android Data Extractor Lite (ADEL)
Android Data Extractor Lite (ADEL) is a tool developed in Python that allows a forensic flowchart to be obtained from the databases of the mobile device. To carry out the process, it is necessary for the mobile device to be rooted or have personalised recovery installed.
WhatsApp Xtract allows WhatsApp conversations to be viewed on the computer in a simple and user-friendly way. As such, the different databases that store information corresponding to messages should be obtained beforehand.
Skype Xtractor is an application, supported both on Windows and Linux that allows us to view information of the Skype main.db file, which stores information about contacts, chats, calls, transferred files, deleted messages etc.
Cellebrite Touch is one of the most well-known and complete evidence extraction devices. It allows us to work with over 6,300 different terminals with the main mobile operating systems. It is also very simple and intuitive.
Encase Forensics, in addition to Cellebrite, is a worldwide reference in forensic analysis. Its wide range of features includes that which identifies encrypted files and that which attempts to decipher them through Passware Kit Forensic, a tool that incorporates specific algorithms for this purpose.
Oxygen Forensic Suite is capable of obtaining information from more than 10,000 different mobile device models and even obtaining information from services on the cloud and import backups or images.
MOBILedit! Forensic allows a lot of information to be received and advanced operations to be carried out such as obtaining a complete memory dump, avoiding terminal-locking measures, and flexibly creating reports.
Elcomsoft iOS Forensic Toolkit
Elcomsoft iOS Forensic Toolkit allows for physical acquisition on iOS devices such as iPhone, iPad or iPod. It also includes other utility features such as that of deciphering the keychain that stores user passwords in the terminal analysed or registering each action that is performed during the whole process to keep a record of them.
A little Python tool to crack the Pattern Lock on Android devices
