Idea: Make extraction folder read only to preserve integrity

[bedoyadaniel]

In order to preserve the integrity of the evidence, ideally one should work on a copy of the extraction folder. The suggestion is to move the files in the folder to read only (currently most are writable by the owner, and the owner's group) so that they can not be altered, and hence are easier to preserve and ensure integrity.

Example of current permissions:

daniel@os:~/apps/androidqf/androidqf-1.7.0/build/597465e1-8287-4500-8524-4edfdbad8b97$ ls -lah
total 151M
drwxr-xr-x 5 daniel daniel 4.0K Nov 14 11:25 .
drwxrwxr-x 5 daniel daniel 4.0K Nov 22 09:35 ..
-rw-r--r-- 1 daniel daniel  530 Nov 14 11:25 acquisition.json
drwxr-xr-x 2 daniel daniel  36K Nov 14 11:21 apks
-rw-r----- 1 daniel daniel 126K Nov 14 11:10 backup.ab
-rw-r--r-- 1 daniel daniel 9.1M Nov 14 11:23 bugreport.zip
-rw-rw-r-- 1 daniel daniel 129K Nov 14 11:25 command.log
-rw-rw-r-- 1 daniel daniel  17M Nov 14 11:22 dumpsys.txt
-rw-rw-r-- 1 daniel daniel 3.5K Nov 14 11:25 env.txt
-rw-rw-r-- 1 daniel daniel 119M Nov 14 11:25 files.json
-rw-rw-r-- 1 daniel daniel  30K Nov 14 11:21 getprop.txt
-rw-rw-r-- 1 daniel daniel  76K Nov 14 11:25 hashes.csv
-rw-rw-r-- 1 daniel daniel 4.5M Nov 14 11:25 logcat.txt
drwxr-xr-x 5 daniel daniel 4.0K Nov 14 11:25 logs
-rw-rw-r-- 1 daniel daniel 570K Nov 14 11:21 packages.json
-rw-rw-r-- 1 daniel daniel 334K Nov 14 11:22 processes.txt
-rw-rw-r-- 1 daniel daniel    2 Nov 14 11:25 root_binaries.json
-rw-rw-r-- 1 daniel daniel    9 Nov 14 11:25 selinux.txt
-rw-rw-r-- 1 daniel daniel  14K Nov 14 11:22 services.txt
-rw-rw-r-- 1 daniel daniel 9.0K Nov 14 11:25 settings_global.txt
-rw-rw-r-- 1 daniel daniel 9.1K Nov 14 11:25 settings_secure.txt
-rw-rw-r-- 1 daniel daniel 1.2K Nov 14 11:25 settings_system.txt
drwxr-xr-x 2 daniel daniel 4.0K Nov 14 11:25 tmp

This is somewhat related to issue #49 where there was a suggestion to hash files. This might be complementary, and in combination if the files are moved to read only and hashes are calculated, it should be easier for analysts to demonstrate the integrity of the evidence.

[Te-k]

That's a really good idea!