Hide It Pro App Forensics - Android
Welcome to my first blog post. Following #DFIR on Twitter has convinced me it's about time I started sharing some information with the community. Luckily, I ran across some good info during a recent investigation. Using the data below, I hope it helps save someone else a lot of time if you run across this app during your own investigations.
I came across some questionable images on an Android phone. The problem was, they were located in a folder that I wasn't familiar with.
Like many forensicators, not knowing is maddening. Using the all powerful Google, I found a clue to as to their app origins. Thanks to Shubham Chaudhary and his post , I found out the odd folder was created by the Google Play app Hide It Pro.
It is very important to understand how an app works and is viewed by a user before digging into the bits behind the curtain. If you don't understand how an app functions for a user, the underlying data can be misinterpreted.
The path to Language\.fr has NO bearing on the phone's language choice. This folder is used for obfuscation. In all testing, the installation used this specific folder to store the data.
The path to Language\.fr has NO bearing on the phone's language choice. This folder is used for obfuscation. In all testing, the installation used this specific folder to store the data.
The Hide It Pro app camouflages itself when installed as Audio Manager.
NOTE: The underlying folder structure shown later including SQLite DB files, sub-folders for Pictures, Videos and etc DO NOT get created upon the app's installation. Only after the app is first opened and configured do these folders get created.
When the user opens the app initially, it displays a prompt on how to access the hidden data. It then requests a PIN or password to be entered, followed by a recovery e-mail address. I've included screenshots of this process including the PIN and e-mail address I used for reference later when analyzing the data stored on the device.
Once setup, the user holds down the "Audio Manager" logo, enters their PIN/password and the true app is revealed.
The app allows the user to add photos, video, audio into the folders from the phone's gallery. SMS texting is also available with an add-on app which allows the user to create a hidden contact list and communicate via SMS without having the data be seen by the device's default texting app. Notes can also be made here away from prying eyes.
Let's now look at how to view all this data from a forensic examination. All the data reviewed below can be accessed via a logical image of the phone. A physical image isn't necessary to investigate this app. I tested this using Magnet's Aquire to obtain a logical ADB backup of the test device.
The first artifact to look for is the file com.hideitpro_preferences.xml located in apps/com.hideitpro/sp/ folder. The XML contains either the PIN or password set by the user in plain text. It also includes the recovery e-mail address. The XML from my test device is shown below.
<?xml version='1.0' encoding='utf-8' standalone='yes' ?> <map> <string name="lockType">pin</string> <string name="pin">1234</string> <boolean name="setupCompleted" value="true" /> <boolean name="fingerprint" value="false" /> <int name="locktype" value="5" /> <boolean name="lsup" value="false" /> <string name="ve">0!true:1!true:2!true:3!true:4!true:5!true:6!true:7!true:8!true:9!true:10!true:11!true:</string> <string name="recoveryEmail">troyschnack@gmail.com</string> <int name="launchCount" value="1" /> </map>
The remaining artifacts are located in the ProgramData\Android\Language\.fr\ folder. 
Exploring the Audio, Pictures and Videos folder will reveal their contents. However, we want to know when and where the data came from. For that information, the SQLite DB files are the key. I used Sanderson Forensics SQLite Browser for the analysis. Photos added to the app are simply copied from their current location. If the user does not delete the original photo, it will remain. Photos with no path indicate that the photo was copied from the phones default photos storage rather than a subfolder.
The first DB file to review is sys. The sys DB contains the following fields
aqua SMS table structure - added Unix mSecs
aqua Blacklist (contacts) table structure - added Unix mSecs
notes.db table structure - created and updated Unix mSecs
The encrypted folder does indeed encrypt files. I will let someone else with more time and capabilities figure out the encryption method used. The majority of users will not use this folder. Most store their photos in the Pictures assuming that the hidden app is secure enough. Only files in the encrypted folder are encrypted. The rest are easily viewed in your forensic tool of choice.
One other important note
If the user deleted the Hide It Pro app from their device, the app and the XML will not be available. However, the Language\.fr folder remains will all the files, folders and DBs.
I hope this information is helpful in one of your cases. I will be creating a custom artifact for Magnet's Axiom in the near future.
If you have any suggestions, comments or questions, feel free to post them. As this is my first blog post, be kind.
Thanks!!
The custom AXIOM artifact is now posted on Magnet's Artifact Exchange
ReplyDelete