Android phone SD card MBR - SCH-R720

I wanted to find out the storage format of my SCH-R720 Android phone.  I wanted to find out the default file and folders that are created by the phone, the file type it uses, and the VBR signature of the Android formatted storage device.

Model Number: SCH-R720

Android Version: 2.3.4

Baseband Version: S:R720.06 x.EH02

Kernel Version: 2.6.35.7

Build number: GINGERBREAD.EH02

Wipe the storage device and fill it with zeros

C:\fau-1.3.0.2390\fau\FAU.x86>wipe -w 00 \\.\physicaldrive1

Forensic Acquisition Tools, 1, 3, 0, 2390 wipe, 1, 3, 0, 2390

Copyright (C) 2002-2009 GMG Systems, Inc.

After the wipe, I have verified the wipe results by searching for anything else, but zeroes on the drive in FTK Imager regular expression ( [^\x00] ).

Formatting

jumpcode                         no. of fats               sectors per track           nt reserved                      volume/partition name
oem/id name                     root entries             no. of heads               extended boot signature         fat type
bytes per sector                 total sectors            hidden sectors              extended boot signature        executable signature
sectors per allocation          media type             total sectors                extended boot signature
reserved sectors                sectors per fat              drive id                          volume serial number
Formatting the the 2GB MicroSD storage device ( by default the phone formatted the drive to FAT16 ) resulted in the following default file structure ( the RED entry is a deleted entry ).  The LOST.DIR is the first directory entry and the volume was no name associated with it by default, thus LOST.DIR create time can be considered the initial format time/date.

Filename	Full Path	Size	Created	Modified
[root]	\[root]\	16384
VBR	\VBR	512
[unallocated space]	\[unallocated space]\	0
file system slack	\file system slack	512
FAT1	\FAT1	122368
FAT2	\FAT2	122368
LOST.DIR	\[root]\LOST.DIR\	32768	2012-Nov-30 00:48:04	2012-Nov-30 00:48:04
.android_secure	\[root]\.android_secure\	32768	2012-Nov-30 00:48:04	2012-Nov-30 00:48:04
DCIM	\[root]\DCIM\	32768	2012-Nov-30 00:48:04	2012-Nov-30 00:48:04
Android	\[root]\Android\	32768	2012-Nov-30 00:48:05	2012-Nov-30 00:48:04
DiskCacheIndex-1701006599.tmp	\[root]\DiskCacheIndex-1701006599.tmp	0	2012-Nov-30 00:48:08	2012-Nov-30 00:48:08
data	\[root]\Android\data\	32768	2012-Nov-30 00:48:05	2012-Nov-30 00:48:04
com.cooliris.media	\[root]\Android\data\com.cooliris.media\	32768	2012-Nov-30 00:48:05	2012-Nov-30 00:48:04
cache	\[root]\Android\data\com.cooliris.media\cache\	32768	2012-Nov-30 00:48:06	2012-Nov-30 00:48:06
local-album-cache	\[root]\Android\data\com.cooliris.media\cache\local-album-cache\	32768	2012-Nov-30 00:48:06	2012-Nov-30 00:48:06
local-meta-cache	\[root]\Android\data\com.cooliris.media\cache\local-meta-cache\	32768	2012-Nov-30 00:48:05	2012-Nov-30 00:48:04
local-skip-cache	\[root]\Android\data\com.cooliris.media\cache\local-skip-cache\	32768	2012-Nov-30 00:48:05	2012-Nov-30 00:48:04
local-image-thumbs	\[root]\Android\data\com.cooliris.media\cache\local-image-thumbs\	32768	2012-Nov-30 00:48:06	2012-Nov-30 00:48:06
local-video-thumbs	\[root]\Android\data\com.cooliris.media\cache\local-video-thumbs\	32768	2012-Nov-30 00:48:06	2012-Nov-30 00:48:06
chunk_0	\[root]\Android\data\com.cooliris.media\cache\local-album-cache\chunk_0	10	2012-Nov-30 00:48:06	2012-Nov-30 00:48:06
index	\[root]\Android\data\com.cooliris.media\cache\local-album-cache\index	44	2012-Nov-30 00:48:06	2012-Nov-30 00:48:06
index	\[root]\Android\data\com.cooliris.media\cache\local-image-thumbs\index	18	2012-Nov-30 00:48:08	2012-Nov-30 00:48:08

Next time, I will explore picture and video storage formats and the reliability of the "Erase SD card" feature the phone provides.  I'm curious to find out if that option is a format or a wipe utility.  

UserAssist

We talk a lot about UseAssist key and its structure, but I don;t see much talk about what it really means to forensic investigators.  We've seen its structure change since WinXP and now the run count starts from 0 instead of 5 and it has some strange structures, but the time is still there to interpret. 

First of all, we need to understand what we have to check in order to see if it should keep the list of programs that were executed by the user.  If the values are empty, you should not jump to the conclusion that your suspect must have used an evidence eliminator.  It might have been set by the user previously or by the network administrator group policy.

The following image shows the settings that control is you see anything under your UserAssist key in the registry.  Un-checking the first check box not just disable the application logging, but it also clears the UserAssist key of any existing entries. 






The following registry keys correspond to the check boxes above.

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackDocs
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackProgs









Disabling the program logging ( TrackProgs ) will also update the following key.
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids\exefile

Since the start Menu properties window also includes the Power Button Action settings, every time you apply your settings changes, you will see this value also accessed.
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_PowerButtonAction

Note: Just in case if you are interested, its values are:
2             - shut down
1             - log off
256         - switch user
512         - lock
4             - restart
2097168 - sleep

So, the main question I wanted to answer was: Is UserAssist key keeps track of applications that were ran on a machine by a user?




Legend:
Green - Always 0s or Fs
Pink - Run count
Blue - Focus count
Orange - Focus time
Light orange - always same
green - always Fs
Purple - last run time
Red - unused

As you can see above, I can see that I launched calc.exe from its default location twice ( pink area ), but after I've moved it to c:\temp and wanted to start calc.exe, it did not launch and still showed the application run count.  Therefore, my conclusion is that you can not reliably determine how many times a user used an application, but how many time he/she tried to use it.