File System Comparison Tool

One easy suggestion would be to use UFED Physical Analyzer and write a simple Python script that will run and compare the files from 2 or more opened projects and output only the difference.

Actually, this is something that we have in the pipeline.

I love the way people who know coding/programming refer to things as "simple" lol

But I would love to see that kind of functionality on PA )

The way I am thinking about testing is by using a clean installation of Android/IOS and then installing a app and then investigating any changes that app made across the Filesystem.

gilly_uk you may find you get some ideas for your what you may want to compare by looking at what these apps/tools do?

http//bitsplit-enterprises.com/iFuntastic/Intro.html

http//www.tuaw.com/2008/05/31/iphonebrowser-browse-your-iphones-file-system/

http//iphone.dashhacks.com/downloads/ibrickr-v091

http//code.google.com/p/t-pot/

http//joe-riggs.com/blog/2009/03/iphone-file-system-browser/
http//code.google.com/p/iphonebrowser/

http//anantshri.info/andro/file_system.html
http//blog.anantshri.info/android-file-system-graphical-view/

In terms of getting the file extractions, on Android anyway, as long as you're happy to get shell root on the device an ADB pull of the appropriate volumes is straightforward; even easier, download the Android SDK and work from within Emulators - a great way to learn about how Android works.

In terms of file system comparisons, one method for doing quick comparisons of file system extractions I've used before (and I'm now assuming you're on windows, apologies if this isn't the case) is to put the two extractions in folders and use Jesse Kornblum's MD5deep (http//md5deep.sourceforge.net/) to do a recursive hash of the files in all the sub-folders. Pipe the outputs to a text file and then sort and diff (or uniq) the two files. No programming required, just a little Commandline-fu!

Hope that helps, let me know if anything's unclear.

On the iOS platform, with newer OS versions, you may be able to identify the Apps which have previously been installed by looking in the SafeHarbor. Here you will find all of the user specific data from deleted applications, docked in the harbor waiting anxiously for the user to reinstall the application so that the data can be moved back to the Application folder. If I remember correctly there are also plists which contain details of when the data was docked in the harbor, i.e. when the app was uninstalled.

Thanks guys, im going to try each method out and see how well it works. Python one I might personally have to give a miss as I cant program but im sure one of my collegues could do it on my behalf.

You should learn Python. Everyone should. It's a lovely, easy, useful language!

http//digitalinvestigation.wordpress.com/2012/02/23/an-analyst-enthuses-about-python-no-not-that-one-the-geeky-stuff/