In Depth Review of SailfishOS Forensic Artifacts

### Overview In this presentation, Krassimir Tzvetanov, a graduate student at Purdue University and research assistant at the CyberTAP program, provides an in-depth forensic review of Sailfish OS. Sailfish OS is an open-source Linux-based mobile operating system developed by Jolla (originating from Nokia's OS 2005, Maemo, MeeGo, and the Mer project) combined with a proprietary UI. The platform has seen adoption in Russia under the name Aurora OS via Open Mobile Platform (owned by Rostelecom) as an alternative to Android and iOS, with plans to deploy millions of units for government use. Tzvetanov addresses the scarcity of modern forensic research on Sailfish OS by evaluating acquisition tools, analyzing system architecture, and cataloging artifacts across telephony, wireless networking, core system configurations, and applications.

### Key Topics - **Acquisition and Tool Performance:** Testing commercial forensic suites (Magnet AXIOM Process, Cellebrite UFED, MOBILedit) versus open-source acquisition techniques. Commercial tools completely failed to acquire or parse the filesystem schema, whereas Autopsy could only extract raw files without contextual parsing. Successful extraction required booting TWRP, accessing the device via ADB shell, and using the `dd` command to create a raw image for analysis with The Sleuth Kit. - **Methodology & Testbed:** Analyzing a Sony Xperia XA2 (Qualcomm Snapdragon 630 chipset, single SIM) running Sailfish OS version 3.2.1.20. The methodology involved taking baseline filesystem images, introducing targeted user actions, timestamping changes, and diffing new images against baselines (or live monitoring via SSH). - **Filesystem Architecture:** Examination of the device's partition schema, which features over 80 partitions organized in an A/B layout to allow seamless, failsafe OS updates.

### Technical Details - **USB & Interfaces:** Depending on device state, the USB vendor/product minor numbers change (e.g., `0de` in bootloader mode, `0afe` when running/charging, `0802` in developer mode exposing network-over-usb / RNDIS). Configuration settings and local IP are located in `/var/lib/usb-moded/usb-moded.ini`. - **Telephony & SIM Artifacts:** Telephony details are stored primarily in SQLite databases. Carrier and SIM metadata (ICCID, MCC, MNC) reside in `telephony.db`. Calls and SMS messages are tracked in `commhistory.db` (including timestamps, direction, and free-text message bodies). The `events` and `eventproperties` tables link via ID to associate incoming events with specific SIM cards. The `ofono` daemon manages lower-layer SIM data in `/var/lib/ofono/`, keeping timestamps of when cards were introduced and last used, plus GPRS/APN context configurations. Connection Manager (`connman`) at `/home/.system/var/lib/connman/` logs cellular data activation, timestamps for when data was turned on or shut off, and assigned IPv4/IPv6 addresses. - **Wireless Interfaces:** Wi-Fi MAC addresses are found in `/data/vendor/wifi/wlan_mac.bin`, and connection profiles with SSIDs, timestamps, and assigned IPs are saved under `connman` directories. Bluetooth settings and MAC addresses reside in `/data/vendor/bluetooth` and `/var/lib/bluetooth/`, including paired device info files containing link keys, device types, and trust states. - **System Artifacts & Security:** Setup wizard artifacts reveal initial device provisioning, while `last_boot_time.utc` and rotating `system_boot_timestamp` files track reboots and kernel versions used. Accounts are mapped in `accounts.db`, while `signon-secrets.db` stores credentials, unencrypted plain-text passwords, and tokens. Device locks store PIN hashes in `device-lock.enc` (or 0 bytes if disabled) and timestamps in `device-lock.conf`. Fingerprint templates reside in `sailfish-fpd/templates/user.db`, with enrollment dates in `fingers.json`. Contacts reside in `contacts.db` tied together by `contact_id`. - **Applications:** The default browser (Mozilla-based) stores cache in `cache2`, SQLite databases for cookies and certs, plain text HSTS history in `SiteSecurityServiceState.txt`, and credentials in `logins.json`. The email client (QMF/qmail derivative) stores email messages as individual files under `qmf/mail/`, creating subdirectories for multi-part messages alongside `qmailstore.db`. Calendar entries reside in `mkcal.db` linked by `component_id`.

### Takeaways Commercial forensic software currently fails to automatically process and interpret Sailfish OS images. However, forensic examiners can successfully acquire devices using low-level tools (TWRP, ADB shell, `dd`) and reconstruct detailed user timelines manually by examining SQLite databases and configuration files. Future research includes automated parsing, comparative analysis with Aurora OS, and investigating artifact traces left by Dalvik-based Android application emulation.