Int 6: Mobile Forensics Android - Menganalisis Perangkat Android

cd ~ && mkdir forensics-int6 && cd forensics-int6

# 1. Struktur database Android
echo "=== Database Android Penting ==*"
cat << 'DB'
/data/data/com.android.providers.telephony/databases/mmssms.db  → SMS & MMS
/data/data/com.android.providers.contacts/databases/contacts2.db → Contacts
/data/data/com.android.providers.calllog/databases/calllog.db → Call History
/data/data/com.android.chrome/app_chrome/Default/History → Browser History
/data/data/com.whatsapp/databases/msgstore.db → WhatsApp (user data)
/data/system/accounts.db → Account informasi
DB

# 2. Simulasi analisis call log
python3 << 'PYEOF'
import sqlite3, os

db = sqlite3.connect(':memory:')
cur = db.cursor()

# Buat tabel call log
cur.execute('''CREATE TABLE calls (
    _id INTEGER PRIMARY KEY,
    number TEXT,
    duration INTEGER,
    date INTEGER,
    type INTEGER,
    name TEXT
)''')

# type: 1=incoming, 2=outgoing, 3=missed
calls = [
    ("+6281234567890", 0, 1700000000, 1, "Budi"),   # Incoming
    ("+6289876543210", 125, 1700000300, 2, ""),       # Outgoing
    ("+6281111111111", 0, 1700000600, 3, ""),          # Missed
    ("+6285555555555", 3600, 1700001000, 2, "Unknown"),# ❌ Outgoing 1 jam!
    ("+6280000000000", 0, 1700002000, 3, "Unknown"),  # Missed
]

for number, duration, date, ctype, name in calls:
    cur.execute('INSERT INTO calls VALUES (?,?,?,?,?,?)',
                (None, number, duration, date, ctype, name))

# Analisis anomali
cur.execute('SELECT number, duration, type FROM calls WHERE duration > 1800')
print("=== ⚠️ Panggilan mencurigakan (>30 menit) ==*")
for row in cur.fetchall():
    print(f"  {row[0]} - durasi {row[1]} detik ({row[1]/60:.0f} menit)")

cur.execute('SELECT number, type FROM calls WHERE type=3')
print("\n=== Missed Calls ==*")
for row in cur.fetchall():
    print(f"  {row[0]}")

# SMS simulation
cur.execute('''CREATE TABLE sms (
    _id INTEGER PRIMARY KEY, address TEXT, body TEXT, date INTEGER, type INTEGER
)''')
# type: 1=inbox, 2=sent
sms_data = [
    ("+6281234567890", "Halo, meeting jam 10 ya", 1700000000, 1),
    ("+6289876543210", "Siap, nanti saya datang", 1700000100, 2),
    ("+6281111111111", "Klik link ini untuk verifikasi: http://phishing.com/login", 1700000500, 1), # ❌ Phishing!
    ("+6280000000000", "Password akun bank: 12345", 1700000600, 1), # ❌ Sensitif!
]

for addr, body, date, stype in sms_data:
    cur.execute('INSERT INTO sms VALUES (?,?,?,?,?)',
                (None, addr, body, date, stype))

print("\n=== SMS Analysis ==*")
cur.execute('SELECT address, body FROM sms WHERE body LIKE "%http%" OR body LIKE "%password%"')
for row in cur.fetchall():
    print(f"  🚩 {row[0]}: {row[1][:60]}")

db.close()
PYEOF