Forensic Carving of Wireless Network Information from the Android Linux Kernel

v Chapter 1 Introduction 1 1.1 Motivation 1 1.2 Android Operating System 1 1.3 Contributions 2 1.4 Organization 2 Chapter 2 Related Works 4 2.1 Network Structure Carving 4 2.2 Mobile Memory Forensics 5 2.3 Volatile Memory Forensics 7 Chapter 3 Implementation 8 3.1 Methodology 8 3.2 Design 11 3.3 wext_stream_scan plugin 13 3.4 iwe_pull and iwe_carve 15 Chapter 4 Limitations 18 iv 4.1 iw_event streams in memory 18 4.2 Volatility framework 19 4.3 Methodoloy and Testing 20 Chapter 5 Results 22 5.1 Acquiring Viable Memory Capture 22 5.2 Analysis of Memory Captures 23 4.3 Methodoloy and Testing 20 Chapter 6 Conclusion 28 5.1 Wrap-Up 28 5.2 Future Work 28 Appendix A 30 References 32