A study on LG content lock and data acquisition from apps based on content lock function. (December 2021)

• Record Type: Journal Article
• Authors: Kim, Giyoon; Park, Myungseo; Kim, Jongsung
• Is Part Of: Forensic science international. Volume 39(2021)
• Publication Date: 2021-12
• Subjects: LG -- Content lock -- File decryption -- Digital forensics
• DOI: 10.1016/j.fsidi.2021.301284
• Languages: English
• ISSNs: 2666-2817

Abstract

Abstract: During digital forensics investigations, smartphone application data are an important target, because they store personal user data, such as memos, images, and videos. Some applications use data hiding or encryption to protect application data, including personal user information. While these methods are excellent for data protection, they act as anti-forensics in digital forensic investigations. The LG smartphone provides Content Lock as a system application to protect the privacy of the user's memo and multimedia files. Content locked by Content Lock can only be accessed by entering the password specified by the user. In this paper, we identified the password verification process of Content Lock using reverse engineering, and recovery of the password input by the user. The original data in the locked file were acquired by analyzing two applications, QuickMemo+ and Gallery, that use Content Lock. No special data were required to obtain the original data. Our research enabled us to obtain original data hidden or encrypted by system apps on LG smartphones. Our research suggests that it is possible to obtain original data hidden or encrypted by system apps on LG smartphones. Highlights: The LG smartphone provides Content Lock as a system app to protect the user's memo and multimedia files, for their privacy. The LG Content Lock App generates and stores an authenticator for user authentication process. We analyzed the Content Lock process provided by QuickMemo+ and Gallery apps in detail.