±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 34714
New Yesterday: 2 Visitors: 271

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Android Emulator

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

Android Emulator

Post Posted: Tue Nov 06, 2018 1:03 am

Hi guys,

Has anyone got any experience with Android Emulators?

I work for LE and the case I'm working on contains IIOC and inciting of children. We have downloaded a phone and recovered a video created with screen recording software (DU Recorder) showing a victim. Plus there are several other .rec files found in the same folder location, which we assume are videos that were not saved/discarded and may be recoverable to show further victims.
The .rec videos do not play, so my idea was to put these files into the recording software and see if they could be recovered.

Cellebrite is supposed to have an emulator within PA, but we cannot seem to find how to use it. The videos we have seen are of them selling their product.

We have also tried some software that you throw the working video at, it should recognise the format and then decode the other files. This hasn't worked though as the software expects there to be something in the first sector of the .rec file that isn't there.

There appear to be quite a few emulators out there and I don't want to try them all so would like suggestions of reliable/powerful ones to use. I'm open to suggestions and possibly other methods to try to recover the .rec files.

Thank you for your time.  

PensiveHike
Newbie
 
 
  

Re: Android Emulator

Post Posted: Tue Nov 06, 2018 4:47 am

EDITED -
The emulator function within PA is pretty simple just follow the instructions. Download the virtulaisation software from the Cellebrite portal

DO NOT USE ANDYROID, ONLY USE DISTRO FROM CELLEBRITE

Open PA - go to the app virtualisation section- select your apps and away you go.  

Last edited by dandaman_24 on Thu Nov 08, 2018 6:12 am; edited 2 times in total

dandaman_24
Senior Member
 
 
  

Re: Android Emulator

Post Posted: Tue Nov 06, 2018 6:09 am

How do you populate the table with apps? Ours is blank  

PensiveHike
Newbie
 
 
  

Re: Android Emulator

Post Posted: Tue Nov 06, 2018 8:12 am

I haven't used Cellebrite's implementation but I always hated using Andy, felt dirty and I was never comfortable running it outside a sandbox (and never on my forensics machine). I always liked NOX as an emulator. I did a webinar on Android emulators here if you want an overview of a few:
www.magnetforensics.co...id-device/

Not sure if it would work in your case but could be useful. I've installed apps and then just dropped media in the appropriate path and had success before.

Another option is to skip the emulator all together and just find a way to play the recording, could be proprietary but I often use VLC as my first pass to try and play videos since it covers a lot, if not I'll try to convert it to something a little more recognizable using something like Handbrake which works quite well and supports a lot of formats as well.

Hopefully one of those options works for ya, good luck

Jamie McQuaid
Magnet Forensics  

mcman
Senior Member
 
 
  

Re: Android Emulator

Post Posted: Tue Nov 06, 2018 11:37 am

- mcman
I haven't used Cellebrite's implementation but I always hated using Andy, felt dirty and I was never comfortable running it outside a sandbox (and never on my forensics machine).


Hear hear. Especially after they bundled a cryptocurrency miner in some versions.
_________________
Arun Prasannan
CCL-Forensics Ltd. 

polar
Member
 
 
  

Re: Android Emulator

Post Posted: Tue Nov 06, 2018 2:05 pm

Alexis Brignoni did a great post on manually doing this with nox on his blog: abrignoni.blogspot.com...-data.html  

B1N2H3X
Newbie
 
 
  

Re: Android Emulator

Post Posted: Wed Nov 07, 2018 11:54 am

In the context of the new Android Emulator solution that was integrated into Cellebrite UFED PA, please only use the Emulator package that is distributed by Cellebrite and can be downloaded from Cellebrite user portal, as it is a clean version that does not include any commercial advertising.

Few weeks ago there was a webinar that explained and demonstrated the usage and the different use cases of this new great capability. Please approach support to get a link to that recorded webinar.

Best regards,
Ron Serber  

RonS
Senior Member
 
 

Page 1 of 2
Go to page 1, 2  Next