Why forensic investigators must keep their eye on the Samsung Secure Folder? Like the word ‘Secure Folder’, Samsung Secure Folder is separated from the normal storage space and encrypted based on Samsung’s security technology ‘Knox’. PIN/pattern/password or biometric verification is required to access the secure folder. The data in the secure folder is not accessible from outside and is not visible even when the device is connected to the PC. This means, personal or confidential data can be stored in Samsung Secure Folder, and this can be the core data for your forensic investigation. Today we introduce how MD-NEXT can help you to approach Samsung Secure Folder with various methods by models, MD-NEXT will support Android version 11 soon, and you’ll get more meaningful data!

*’The ‘Knox’ space manages the entire space variably just like many apps manage data in their DB. And when data is deleted from the Knox, it is returned to the non-allocated area of the basic storage space, therefore, ‘Logical Extraction’ is carried out in file unit.

MD-NEXT Extraction methods by Models

• Galaxy A5/S7/S8/S9/Note8/Note9 Series (Exynos & Qualcomm)

If the Android security patch level is before August 2019, you can obtain the security folder using the ADB Pro T4 method. The USERDATA partition is acquired as a physical image, and additionally, the files stored in the secure folder are decrypted and acquired as a separate logical image.

• Galaxy A6/A7/S9/J6/Note9 Series (Exynos)

If the Android OS version is 10, you can obtain the secure folder using the Bootloader Pro method. Like the ADB Pro T4 method, the USERDATA partition is acquired as a physical image, and additionally, the files stored in the secure folder are decrypted and acquired as a separate logical image.

• Galaxy A30/A40/A50/S10/Note10 Series + Galaxy Tab A 10.1 Series (Exynos)

Samsung Galaxy S10 and Note 10 series of devices and some A series of devices, you can obtain a secure folder by using the Full Filesystem (Bootloader Pro2) method (Supports both Android 9,10 and 11). When acquiring the active files of the USERDATA partition, the files stored in the secure folder are decrypted and acquired as a single logical image.

How to Review Data?

The data in the secure folder is acquired as a separate logical image from the physical image of the USERDATA partition. The file naming scheme for logical images has been changed in MD-NEXT version 1.89.5(Released date Jul.15, 2020), so the file name may differ depending on the version. Information on the file name and extension of the acquired images can be checked in the acquisition report.

Download PDF_MD-NEXT – Samsung Secure Folder

‘MD-LIVE’ New features to Save your Onsite Investigation Time

Whenever to access the evidence phone at the crime scene, you may always suffer from insufficient time and its complicated steps to use the mobile forensic tool. The search on the apps to watch and the pinpoint of the keywords from the piles of text messages are getting crucial for the first responders. MD-LIVE has armed itself with two useful features to save the investigation time and to meet these needs for smartphone forensics.

1. ‘Keyword’

The keywords that are frequently searched such as drug, sexual assault, murder cases can be grouped and registered by category. Users can select a category that matches the case, it can save much time from repetitive searching keyword routine and prevent missing important search terms. Moreover, user can continuously update the keyword list and share with their colleagues by Import/Export feature.

–                How to register keywords?

Click the ‘Keyword’ icon in the upper right corner of MD-LIVE. Enter the keyword group name in ‘Name’ and list the search terms to be included in the ‘keyword’, separated by ‘;’, and click the ‘Add keyword’ button.

 –                How to search with keywords?

Select the target you want to search from the list of registered keywords and click the ‘Search by selected keyword’. Then MD-LIVE performs a multi-search on the targets registered in the keyword group.

2. ‘Watch List’

If there are apps to be scanned every time or need to quickly scan a specific list of apps according to your institution’s needs, ‘Watch List’ is a preferentially considerable feature. This supports you to easily determine whether a specific app is installed in the device in advance. By selecting a forensic target at a time, it saves you a lot of time from searching multiple apps each time and selecting them as targets. And once app scanning is completed you can quickly determine whether an in-depth forensic investigation is needed on the specific target.

–                How to use Watch List feature?

Connect the device and operate Watch List feature on the [Select Data] step. Target apps can be added by right-clicking on the desired app and the list of apps can be managed by ‘Manage Watch List’ at the top right of MD-LIVE. Select ‘Manage Watch List’ and add the package name of the app you want to specify.

An eye-shaped badge will be displayed next to the app, and you can easily review all the listed apps through the ‘Watch List’ filter and select them as an extraction target at once.