Website:
Corpus:

S3 Downloads Browser

corpora/mobile/2011-android/ sub-dirs:

corpora/mobile/2011-android/ files:

Name Size Last Modified SHA2-256 SHA3-256
README.txt 2,736 2020-11-22 03:10:17Z c218049dd6781fc5c61e0bdca61ea6d3efda749038d5126658c66e151dc985d4 2fe9eae1ddc7b79e991d502ed5f08d9ce8710dabe05672baf5a57e40b472dc56

README

This directory holds a corpora of images taken from Android devices. 

HTC Nexus One:
Android 2.2.1
Kernel: 2.6.32.9-27240-gbca5320
Android Build: FRG83
IMEI: 354957034051501

The Nexus One partitions are:
dev:    size   erasesize  name
mtd0: 000e0000 00020000 "misc"
mtd1: 00400000 00020000 "recovery"
mtd2: 00380000 00020000 "boot"
mtd3: 09100000 00020000 "system"
mtd4: 05f00000 00020000 "cache"
mtd5: 0c440000 00020000 "userdata"

Samsung Nexus S:
Android 2.3
Kernel: 2.6.35.7-g119403d
Android Build: GRH55
IMEI: 355031040342228

The Nexus S partitions are:
The mmcblk0 is the only block imaged.

lrwxrwxrwx root     root              2011-06-14 20:42 media -> /dev/block/mmcblk0p3
lrwxrwxrwx root     root              2011-06-14 20:42 userdata -> /dev/block/mmcblk0p2
lrwxrwxrwx root     root              2011-06-14 20:42 system -> /dev/block/mmcblk0p1

and


dev:    size   erasesize  name
mtd0: 00200000 00040000 "bootloader"
mtd1: 00140000 00040000 "misc"
mtd2: 00800000 00040000 "boot"
mtd3: 00800000 00040000 "recovery"
mtd4: 1d580000 00040000 "cache"
mtd5: 00d80000 00040000 "radio"
mtd6: 006c0000 00040000 "efs"

With the exception of the baseline image, both phones were synced to the npsforensics@gmail.com account. The clockworkmod ROM Manager application was downloaded from the Android market, used to get a unique recovery image for each device and was used to perform backups that provide our logical acquisition technique. 

This directory has two directories, one for each phone. Each phone directory contains multiple directories pertaining to different data placed on the phone. The phone directory structure is as follows:

2011-NexusX-Y
2011-NexusX-Y-Z

Where X is the phone model, Y indicates the experiment number (listed below), and Z is alway equal to 1 and indicates the logical (clockworkmod technique) image.

Experiments:

2011-NexusX-1
This is the baseline image, with no network data on devices. NOTE: These devices were slightly used and might have existing data.

2011-NexusX-1.5
An image taken after associating a google account with the android device.

2011-NexusX-2
No data passed. This associates to a wireless router and scans the GSM and 802.11 RF spectrum picking up network metadata.

2011-NexusX-3
SOMETHING WITH BLUETOOTH

2011-NexusX-4
Android Device associates to TacBSR and wireless router. Pulls a 10KB file from 192.168.77.4.

2011-NexusX-5
Android Device associates to TacBSR and wireless router. Pulls a 1MB file from 192.168.77.2.

2011-NexusX-6
The Android devices use the Facebook application. 

2011-NexusX-7
Devices are associated to TacBSR and wireless routers, use bluetooth device, use Facebook, retrieve a 10MB file from 192.168.77.1, place a call to the other device.