 |
| Kindle Fire HDX Robber |
Yesterday I was trying to get a physical image of my Kindle Fire HDX 7 software version 13.3.1.0 using the Cellebrite Touch Ultimate and did not have any luck. I found that the operating system is Fire OS 3 which branched off from Android 4.2.2. Even if I could have got an image I would have needed to wait for the dongle for the UFED Physical Analyzer to get updated.
Today I
came into the lab thinking I could use the UFED Physical Analyzer to take a
physical image of the Kindle. It turns out that the software is used to view
the physical image, not to take one. Thus I needed to get an image somehow. I
took out the Cellebrite Touch Ultimate again and took another look at my options. There
is an option to take a physical extraction of the file system. I figured this
would provide me with all of the forensically important data. The state of the
Kindle is restored to factory settings as if it had never been used. This
physical extraction should serve as a base line.
The
extraction gave me 158 images, four videos, 193 text, and 93 databases. My
initial inventory of the information reveals a lot of interesting data within
the databases. For example:
 |
| File System Extraction Analysis |
No comments:
Post a Comment