Digital Forensics for Samsung Galaxy S4

Samsung Galaxy S4 Overview

Samsung is one of the leading smartphone manufacturers in the world, with its Galaxy and J-series line of smartphones making up over 24% of the global market share as of 2016—over five percent higher than Apple’s iPhone and an order of magnitude greater than most competing Android smartphone manufacturer’s products. March 2013 saw the unveiling of the Samsung Galaxy S4, with the S4 going on sale in April of that year. Over the next two months, Samsung sold over twenty million units, making the Galaxy S4 Samsung’s fastest-selling phone at that point (it was later surpassed by the Galaxy S5).

The Samsung Galaxy S4 uses one of two chipsets. Most S4 models in North America, Europe, and parts of Asia contain Qualcomm Snapdragon 800 MSM8974 or Qualcomm Snapdragon 600 APQ8064AB chipsets. Other Galaxy S4 models use a Samsung Exynos 5 Octa 5410 chipset. The Exynos 5 Octa 5410 chipset utilizes a heterogeneous octa-core CPU comprised of two quad-core CPU clusters. Using heterogeneous computing, the phone can dynamically switch between the more powerful and less powerful core clusters to balance performance and battery usage based on the user’s needs.

The Samsung Galaxy S4’s internal NAND data storage chip and eMMC chip together could store up to 64 gigabytes of data. At first, the smartphone offered limited access to removable SD card storage: unlike with other Android smartphones, Galaxy S4 users had less control over where their installed apps lived and lacked the ability to move or install apps to their microSD cards. This was particularly a problem with models of the smartphone with only 16 gigabytes of internal storage, as the phone’s O/S and preinstalled apps consumed roughly half of the phone’s storage space. Future updates to the phone rectified this problem.

Samsung Galaxy S4 Forensics

Our forensics experts here at Gillware Digital Forensics are well-versed in the intricacies of Android mobile forensics. Every brand and model of Android phone is just a little different from its neighbor, and the Samsung Galaxy S4 is no exception. That said, there are always some commonalities. Android smartphones, the Samsung Galaxy S4 included, store their data in several locations. These include the NAND chip inside the phone and the phone’s internal eMMC chip, the SIM card, and any removable microSD storage the user has installed.

The Galaxy S4 smartphone first utilized Android 4.2 “Jelly Bean”, but could later be upgraded to 4.4 “KitKat” and 5.0.1 “Lollipop”. Each subsequent version of the Android operating system adds new features and capabilities to Android smartphones, some of which can make it difficult for digital forensic investigators to acquire the data on a smartphone.

Android security tools can make work difficult for forensic investigators. For example, Samsung introduced Knox for the Galaxy S4 in its Android 4.3 update. Knox was created to provide enterprise-grade security services for several Samsung products, including the Galaxy S4. Using Knox, a Galaxy S4 owner can have their work data exist in an encrypted environment wholly separate from their personal data on the same phone. Knox was approved by the Defense Information Systems Agency of the Department of Defense for use with “sensitive, but unclassified” data. With MyKnox, a Samsung Galaxy S4 user can even remotely control, sync, or wipe the contents of their phone.

In many Samsung Galaxy S4 forensics situations, getting into the device can be the hardest part. But sifting through the data to determine what exists on the device (and, in the case of deleted data, what used to exist) also requires a keen and experienced investigator to make sense of the device’s contents.

Gillware’s Services for Samsung Galaxy S4 Forensics

Qualcomm Snapdragon APQ8064 system-on-chip (SoC) chipset (source)

Gillware Digital Forensics assists its clients in every aspect of the digital forensics process. This includes initial forensic assessment and evaluation, data recovery in our secure cleanroom environment (if necessary), full forensic analysis, and even expert testimony to ensure that the court clearly understands the results of our work.

Gillware Digital Forensics offers the decades of forensics experience of its president, Cindy Murphy. Murphy has over 30 years of experience in law enforcement, including her 17 years as a digital forensics expert with the Madison Police Department.

No matter what kind of work needs to be done, you can count on Gillware Digital Forensics. Whether you need to know what apps the user had on their Galaxy S4, who the user called and texted (and whether they deleted any SMS messages), whether or not their phone had any sort of mobile malware or spyware installed on it, or anything else about the user’s mobile phone usage, you can trust the experts at Gillware Digital Forensics to retrieve as much information as possible—even if the phone has been severely damaged.

Broken and Damaged Samsung Galaxy S4 Forensics Data Recovery

The board from a Galaxy S4 smartphone with the eMMC memory chip (right) removed for chip-off forensic analysis.

Smartphones are actually incredibly resilient, and the Samsung Galaxy S4 is no exception. Think about how many times you let your phone tumble onto the concrete, only for it to come out none the worse for the wear—apart from a few scuffs and scratches, perhaps, or a cracked screen. You could never imagine your computer taking this kind of punishment and remaining quite so intact.

But smartphones do have a tolerance threshold, and sometimes you’ll encounter a Samsung Galaxy S4 that has clearly crossed it. Maybe it’s been buried in the middle of a swamp for six months. Maybe it’s been in a fire. Or maybe a car ran over it, and it’s barely holding together—or in pieces.

This is where Gillware can leverage the experience of our data recovery lab, in operation for over 12 years. Our data recovery experts have recovered data from countless cell phones of just about every make and model that have come to us after suffering some catastrophic damage.

Recovering data from damaged hard drives is tough enough, requiring the expertise of professional data recovery engineers and a cleanroom environment. Due to the novel ways in which flash memory stores data, recovering data from NAND and eMMC chips can be even more difficult, requiring flash memory experts to delve into the storage media and manually reconstruct the lost data.

Gillware Digital Forensics has data recovery experts who specialize in all kinds of data retrieval methods, including JTAG and chip-off data retrieval. With our flash memory data recovery experts, tools, and techniques, we can create write-blocked forensic images of a Samsung Galaxy S4’s eMMC chip and SD card, perform and piece together a raw dump of the phone’s NAND memory, and access the data on the phone’s SIM card.

To get started on a case, follow the link below to request an initial consultation with Gillware Digital Forensics.