Pieces0310

取证须让证物说话,莫妄以自我心证来给案情下定论.切忌画靶射箭,为找而找. 取证的根基仰赖经验与判断,在IT各领域的经验愈丰富,愈能看出端倪. 取证须善用工具,但不过度依赖工具.工具只能帮你缩小可能范围,但无法告诉你答案,仍需靠人进行分析判断.

首页 新随笔 联系 订阅 管理

A friend of mine Anita, she attempted to extract Naver LINE from a smartphone running Android 13, but all the mobile forensic tools at her disposal failed, even attempting APK Downgrade extraction. She is at her wits' end and asks me to give her a hand.

I come up with a good idea. Since the phone is unlocked, we can use adb uiautomator to dump chat messages of certain App on the top of screen.



But there are lots of chat messages in the chat room. How can we retrieve all of them? We'll need to utilize the scrolling function for that.


Fortunately, by combining the aforementioned commands, we were able to retrieve all the chat messages without fail. This also helped Anita successfully uncover important clues from the chat messages of Naver LINE.

 

posted on 2024-05-05 22:02  Pieces0310  阅读(201)  评论(0)    收藏  举报