Page 1
SECUREFOLDERS & CONTAINERS · A GUIDE FOR UK LAWYERS Android Secure Folders, Knox and Manufacturer Security Containers A Second, Separately Locked Phone Inside the Phone, and Why It Is So Often Where the Evidence Is COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: a second phone inside the phone 03 The containers: Secure Folder, Knox, private spaces and work profiles 04 How containers are secured 05 Finding the container and reaching it law full y 06 What a container holds, and honest limits 07 Deployment: the concealed second life 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: many Android phones carry a second, separately secured space, Samsung's Knox-based Secure Folder, other makers' private spaces, or Android's work profile, each a second phone inside the phone with its own apps, second-account messaging, photos and files, sealed behind its own credential and keys and must be looked for on every device and reached law full y.
§ 02 · FIRST PRINCIPLES The problem in plain English: a second phone inside the phone
§ 03 · THECONTAINERS The containers: Secure Folder, Knox, private spaces and work profiles
Page 2
§ 04 · HOWCONTAINERSARESECURED How containers are secured
§ 05 · FINDINGANDREACHING Finding the container and reaching it law full y
§ 06 · WHAT IT HOLD S What a container holds, and honest limits
§ 07 · DEPLOYMENT Deployment: the concealed second life
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE COUNTERPARTS INSIDE THE PROFILE ACCOUNTS' BACKUP USAGE CONTAINER (SYSTEM CLOUD S / (MAKER ARTEFACTS MAIN SECOND CONTAINER RECORDS) PROVIDER S CLOUD)
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEUNLOCKEDPHONEWITHTHELOCKEDFOLDERINSIDE EXAMPLE2 · THECONTAINERTHATSTAYEDSHUT, ANDTHEACCOUNTSTHATDIDNOT EXAMPLE3 · THECONTAINERTHATWASAWORKPROFILE, READFAIRLY
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider 2. Please, preserving the device's state and integrity: (1) detect from the system's user, profile, package
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The security-container checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions What is a Secure Folder or security container? If the phone is unlocked, isn't everything accessible? How do you find a hidden container? Can the container be broken into? If the container stays locked, is the evidence lost? Does having a container prove someone was hiding something?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Android Secure Folders Knox And Manufacturer Security Containers, Computer Forensics Lab, https://e-discovery.uk/library/android-secure-folders-knox-and-manufacturer-security-containers/pdf.