MOBILE FORENSICS

Forensic analysis of Android app permissions

App permissions determine which functions and data an Android app is allowed to access. Analysing them can provide important insights into how an app works technically and how certain device functions might be used.

Runtime Permissions
Camera and microphone access
Site authorisations
Access to contacts and calendars
Storage permissions
Notification accesses
Background permissions
AppOps and system-wide settings
Features specific to the manufacturer and version

TECHNICAL BACKGROUND

Technical Fundamentals

Android uses a permissions system that has evolved over the various versions.

Forensic aspects include, amongst others:

  • •Runtime Permissions
  • •Camera and microphone access
  • •Site authorisations
  • •Access to contacts and calendars
  • •Storage permissions
  • •Notification accesses
  • •Background permissions
  • •AppOps and system-wide settings
  • •Features specific to the manufacturer and version

Its significance only becomes apparent when viewed in the context of other artefacts.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Following a suitable forensic data backup, installed applications, permission settings and system artefacts are examined using recognised IT forensic tools and manual analysis. The results are correlated with app data, timestamps and other artefacts. All stages of the investigation are documented in a reproducible manner.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔What permissions have been granted to an app?
  • ✔Which sensitive functions was the app able to access?
  • ✔Have the permissions changed?
  • ✔Can permissions be correlated with other artefacts?
  • ✔What is the technical significance of the findings?

LIMITATIONS & CONCLUSION

What you should know

The fact that authorisation has been granted does not automatically prove that it has actually been used. To draw reliable conclusions, additional technical evidence must be analysed.

Analysing app permissions provides important insights into the potential access rights of an application. Only a comprehensive assessment of all available technical data enables a well-founded IT forensic evaluation.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to have the permissions and behaviour of Android apps professionally investigated? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

Are permissions relevant in a forensic context?
Yes. They show which functions an app was generally permitted to access.
Can authorisation alone prove that there has been misuse?
No. Further technical artefacts need to be analysed.
Are changes to permissions investigated?
Provided that such artefacts exist, yes.
Do permissions vary depending on the version of Android?
Yes. The permissions system has been expanded across several versions of Android.
Could an expert report be drawn up on this matter?
Yes. The results are documented in a transparent manner and assessed from a technical perspective.