Tools, Systems and Programs · Topic 5 of 6
Mobile, Database, Cloud, Email and IoT Tools
Learn tools for Android and iOS acquisition, mobile suites, MSSQL and MySQL evidence, Azure and AWS investigation, email recovery and IoT forensics.
- 4 min
- Logical acquisition is easier but misses deleted data. Physical gets more.
- Cellebrite UFED, AXIOM, Oxygen and XRY are mobile suites.
- SQL Server evidence: .mdf, .ldf and logs. MySQL: binary log read with mysqlbinlog.
What it is
Phones, databases, cloud services, mailboxes and IoT devices each need purpose-built tools. The principle is the same: acquire without altering, verify, then parse. The exam asks which tool or source fits each platform.
How it works
Android and iOS acquisition tools
| Level | Android | iOS |
|---|---|---|
| Logical | adb pull, backups through forensic tools | Backups made with libimobiledevice (idevicebackup2) or iTunes |
| File system and physical | Forensic suites, bootloader or chip based methods, JTAG, chip off | Specialized extraction tools. Full access depends on model and OS version. |
adb devices
adb pull /sdcard/DCIM ./evidence/DCIMadb needs USB debugging to be enabled and the computer to be trusted. Record the device state before connecting, and hash the extracted files.
Mobile forensic tools
| Tool | Notes |
|---|---|
| Cellebrite UFED | Acquisition and analysis for many devices |
| Magnet AXIOM | Parsing and analysis, plus acquisition tools in the Magnet family |
| Oxygen Forensic Detective | Acquisition, apps and cloud data |
| MSAB XRY | Acquisition and analysis |
| MOBILedit Forensic | Logical and file system acquisition |
| ALEAPP and iLEAPP | Open source parsers for Android and iOS artifacts. They run standalone, and Autopsy plugins can call them. |
Tools parse SQLite databases, recover deleted records, and build timelines from messages, calls, location and app data.
MSSQL and MySQL evidence tools
| Server | Evidence files | Tools |
|---|---|---|
| SQL Server | .mdf, .ndf, .ldf, error log, default trace, backups | SQL Server Management Studio, ApexSQL Log or similar log readers, T-SQL queries |
| MySQL | Data directory, binary log, general and slow query logs | mysqlbinlog, mysqldump, the mysql client |
SQL Server also has an undocumented function sys.fn_dblog that reads active log records on a copy, and Dynamic Management Views for live sessions. For MySQL:
mysqlbinlog --start-datetime="2026-10-14 01:00:00" binlog.000001Query the live server read only, or work on a restored copy of a backup. Avoid changing the original.
Investigating Azure and AWS
Cloud evidence is mostly logs and snapshots, reached through the provider's APIs and consoles with the customer's authority. Shared responsibility means the customer owns the data and many logs, and the provider holds the infrastructure.
| Need | Azure | AWS |
|---|---|---|
| Control plane activity | Activity Log | CloudTrail |
| Sign in and identity | Microsoft Entra sign-in and audit logs | CloudTrail ConsoleLogin events, IAM |
| Network | NSG flow logs | VPC Flow Logs |
| Query and analysis | Log Analytics (KQL), Microsoft Sentinel | CloudWatch Logs, Athena |
| Threat detection | Microsoft Defender for Cloud | GuardDuty |
| Disk evidence | Managed disk snapshot | EBS snapshot |
aws ec2 create-snapshot --volume-id vol-0123456789abcdef0 --description "case 1042 evidence"
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLoginEnable and protect logs before an incident: they have retention limits. Copy logs and snapshots to a separate, locked account.
Acquiring email and deleted emails
Mail stores include PST and OST (Outlook), MBOX (many clients), EML and MSG (single messages), and server mailboxes. Tools: MailXaminer, Aid4Mail, Paraben Email Examiner, Magnet AXIOM and FTK, plus readpst from libpst on Linux.
Deleted email may be in the Outlook Recoverable Items folder, in unallocated space of the file, or in a server hold. A legal hold or journaling on the server preserves mail. Headers show the path and times: read the Received lines from the bottom up.
IoT device forensics
IoT evidence sits in device storage, firmware, companion apps, the cloud service and network traffic. Tools and methods: binwalk to unpack firmware images, flashrom and hardware access through UART, JTAG or SPI to read memory, Wireshark to capture traffic, and mobile forensic tools for the companion app. Vendor cloud accounts often hold the best history, such as voice assistant logs or camera events, and need legal process.
A worked example
An employee is suspected of leaking data from a cloud account. The investigator exports CloudTrail events for the user, finds a ConsoleLogin from a new address and a bucket policy change, and snapshots the affected volume.
The snapshot is shared to a forensic account, and its hash and the export time are recorded.
How the exam asks about this
- "Which AWS service records API calls for investigation?" → CloudTrail.
- "Which Azure log covers control plane operations on resources?" → The Activity Log.
- "Which tool unpacks IoT firmware images?" → binwalk.
What to remember for the exam
- Logical acquisition is easier but misses deleted data. Physical gets more.
- Cellebrite UFED, AXIOM, Oxygen and XRY are mobile suites.
- SQL Server evidence: .mdf, .ldf and logs. MySQL: binary log read with mysqlbinlog.
- Azure Activity Log and AWS CloudTrail show who did what in the control plane.
- Snapshots preserve cloud disks. Copy them to a protected account.
Cloud logs have retention limits and some are off by default. Request preservation early.
Common mistakes
Seizing a cloud account like a laptop. Evidence is reached through APIs and legal process.
Opening the original PST. Work on a copy.
Believing IoT devices hold no evidence. The cloud and companion app often do.
Check yourself
Which AWS log shows API calls made in an account?
CloudTrail.
Which tool reads MySQL binary logs?
mysqlbinlog.
Why read Received headers from the bottom up?
The bottom entry is the earliest hop, so reading upward follows the message path.
Topic 5 of 6 in Tools, Systems and Programs
Test yourself on Tools, Systems and Programs
The full EC-Council 312-49 question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.