In Depth Review of SailfishOS Forensic Artifacts
summary
SailfishOS resists common commercial mobile forensic suites, forcing full imaging via adb/dd over USB and partition extraction with SlotKit; Autopsy extracts files but cannot interpret schemas. The device uses an A/B scheme with over 80 partitions, USB minor IDs change by mode (examples 0de, 0afe, 0802), and key artifacts live in SQLite files such as telephony.db and com_history.db (calls, SMS, ICCID bindings). SIM timestamps sit in /var/lib/phono and network state in /home/system/var/lib/conman.
AI-written summary · about
chapters (12)
- 0:00Start
- 3:36Acquisition and Analysis with Commercial Tools
- 5:24Usb Interface
- 6:21Partition Schema
- 12:19Reference Inferences
- 12:54Wireless Interfaces
- 15:47Forensics Artifacts
- 17:21Accounts Database File
- 19:44Deleted Context
- 20:36Web Browser
- 23:11Gallery
- 23:26Future Work and Conclusions
related talks
26mAndroid Forensics, how the police investigates your device
49mMobile app analysis with Santoku Linux
31mAnti-Forensics: Reverse Engineering a Leading Phone Forensic Tool
25mHarvesting Inconsistent Security Configurations in Custom Android ROMs...
36mPhysical Attacks Against Smartphones
35mInput Output + Syslog (iO+S): Obtaining Data From Locked iOS Devices via Live Monitoring
57mFaux Disk Encryption: Realities of Secure Storage On Mobile Devices
01h 17mSmart phones and law enforcement.