{"id":2722,"date":"2017-05-09T16:23:19","date_gmt":"2017-05-09T20:23:19","guid":{"rendered":"https:\/\/www.digitalforensicscorp.com\/blog\/?p=2722"},"modified":"2024-12-11T18:37:13","modified_gmt":"2024-12-11T18:37:13","slug":"mobile-forensics-ufed-vs-magnet-acquire","status":"publish","type":"post","link":"https:\/\/www.digitalforensics.com\/blog\/software\/mobile-forensics-ufed-vs-magnet-acquire\/","title":{"rendered":"Analyzing Magnet Acquire Android Images in UFED Physical Analyzer"},"content":{"rendered":"

Magnet Acquire (Magnet Forensics) is a free digital forensics<\/a> tool that is becoming more and more popular. Among other devices, you can use it for forensic acquisition of Android smartphones and tablets. Since extracted data is stored in an archive of its own format, it is not always possible to analyze them with other mobile forensic tools. This article will show you how to analyze a logical image created with Acquire using UFED Physical Analyzer (Cellebrite).<\/p>\n

 <\/p>\n

<\/p>\n

<\/span>How Magnet Acquire works.<\/span><\/h2>\n

When extracting data from an Android mobile device, Magnet Acquire performs the following steps:<\/p>\n

1) Creates a backup of this device.<\/p>\n

2) Installs an agent app on the device.<\/p>\n

3) Uses this app to retrieve some types of data and copies files from the device\u2019s SD card (if present).<\/p>\n

4) Repacks all extracted data and files into one file.<\/p>\n

<\/span>Structure of an Acquire logical image.<\/span><\/h3>\n

Here is the image of the folder with an Acquire logical image.<\/p>\n

\"\"<\/p>\n

Fig. 1. Samsung smartphone logical image created with Magnet Acquire<\/p>\n

 <\/p>\n

Where:<\/p>\n

– ‘activity_log.txt’ contains extraction log.<\/p>\n

– ‘image_info.txt’ contains summary report.<\/p>\n\n\n\n
Imager Product: Magnet ACQUIREImager Version: 2.0.1.5875 <\/p>\n

Examiner Name:<\/p>\n

Evidence Number:<\/p>\n

Description:<\/p>\n

 <\/p>\n

Relative Activity Log Path: activity_log.txt<\/p>\n

Original Activity Log Path: C:\\Users\\JohnSmith\\Desktop\\Android Image \u2013 2017-04-15 02-26-12\\activity_log.txt<\/p>\n

Activity Log MD5 Hash: 2ABDCFDD59D34E68D53B3A1D2B3B7E14<\/p>\n

 <\/p>\n

Output Directory: Android Image \u2013 2017-04-15 02-26-12<\/p>\n

Full Output Directory: C:\\Users\\JohnSmith\\Desktop\\Android Image \u2013 2017-04-15 02-26-12<\/p>\n

 <\/p>\n

Total Segments: 1<\/p>\n

 <\/p>\n

Relative Segment 1 Path: amsung SAMSUNG-SM-G900A Quick Image.zip<\/p>\n

Full Segment 1 Path: C:\\Users\\JohnSmith\\Desktop\\Android Image \u2013 2017-04-15 02-26-12\\samsung SAMSUNG-SM-G900A Quick Image.zip<\/p>\n

Segment 1 MD5 Hash: E52F3AE87812206FC0352B4615B6DD28<\/p>\n

Segment 1 SHA1 Hash: E3322B732413DD2E811418B3E0C76EF8AFE13355<\/p>\n

 <\/p>\n

Imaging Start UTC: 2017-04-15 07:26:24<\/p>\n

Imaging Start UTC Ticks: 636278379842607163<\/p>\n

Imaging End UTC: 2017-04-15 07:37:57<\/p>\n

Imaging End UTC Ticks: 636278386777205242<\/p>\n

 <\/p>\n

Device Information<\/p>\n

Manufacturer: amsung<\/p>\n

Product Model: SAMSUNG-SM-G900A<\/p>\n

Operating System Version: 6.0.1<\/p>\n

Unique Identifier: 8dd665c8<\/p>\n

Serial Number: 8dd665c8<\/p>\n

 <\/p>\n

Additional Device Information<\/p>\n

Boot Serial Number: 8dd665c8<\/p>\n

Bootloader: G900AUCS4DQC1<\/p>\n

Build PDA: G900AUCS4DQC1<\/p>\n

Build Date UTC: 1488437396<\/p>\n

Hidden Build version: G900AUCS4DQC1<\/p>\n

Build ID: MMB29M<\/p>\n

SDK Version: 23<\/p>\n

Chip Name: MSM8974PRO<\/p>\n

GSM Version: 6.0_r8<\/p>\n

Device Encryption: unencrypted<\/p>\n

Product Board: MSM8974<\/p>\n

Product Brand: amsung<\/p>\n

CPU ABI: armeabi-v7a<\/p>\n

CPU ABI 2: armeabi<\/p>\n

Product Device: klteatt<\/p>\n

Product Name: klteuc<\/p>\n

First Boot: 1492207837383<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Fig. 2. Summary report.<\/p>\n

File ‘samsung SAMSUNG-SM-G900A Quick Image.zip’ \u2013 Samsung smartphone logical image.<\/p>\n

<\/span>The structure of ‘SAMSUNG-SM-G900A Quick Image.zip’ file.<\/span><\/h2>\n

‘samsung SAMSUNG-SM-G900A Quick Image.zip’ contains the following files and folders:<\/p>\n

\"\"<\/p>\n

Fig. 3. ‘SAMSUNG-SM-G900A Quick Image.zip’ contents.<\/p>\n

‘Agent Data’ folder contains files: ‘calendar.db’, ‘contacts2.db’, ‘contacts3.db’, ‘mmssms.db’, ‘wifi.db’.<\/p>\n

 <\/p>\n\n\n\n
NOTE: For QUICK logical images of Android devices, Magnet ACQUIRE is designed to use the ADB process to acquire the application data from the device. It uses the agent application to acquire select application data that may be available to be obtained in addition to the ADB-recovered data (for example, SMS\/MMS, Contacts, browser history etc) if it wasn\u2019t found in the ADB backup. As the Wifi details recovered by the ACQUIRE agent are not stored in a database the Wifi.db is a schema created by Magnet development team to house the details which are obtained from the Android WifiManager.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

 <\/p>\n

‘sdcard’ folder contains files copied from the SD card of the Android device.<\/p>\n

‘adb-data.tar’ contains the Android device backup.<\/p>\n

Preparation for the analysis.<\/p>\n

    \n
  1. Unzip the file ‘adb-data.tar’.<\/li>\n
  2. Transfer databases from the ‘Agent Data’ directory to the appropriate sub-directories of apps:<\/li>\n<\/ol>\n