## 2 Related Works and State of the Art Review
### Related Works
#### 2.7.1 Acquisitions Based on Device Firmware Attack  
[PERSON] et al. [20] proposed an acquisition method based on the analysis of firmware update protocols for Android smartphones from manufacturers Samsung, LG, and Pantech. They stated that it is possible to perform physical acquisition on Android smartphones using the flash memory read command, applying reverse engineering to the firmware update protocol on the boot loader. However, at the time of the work, the Android devices used were the models G3 (F400S, D851), Optimus G (F180S, E975), R3 (IM-A850S), Iron2 (IM-A910S), and Nexus 4/5 (E960, D821), which have not yet the main memory encrypted by default.  
[PERSON] et al. [43] presented a forensic tool based on the replacement of the Recovery Mode with a focus on NAND and eMMC cards. The possibility of data recovery was explored after uninstalling an application on Android devices with EXT4 file system. Of the devices submitted to data extraction, the most recent version of Android was 4.4.X, with kernel 3.4.39.  
[PERSON] et al. [7] proposed a forensic acquisition for Android smartphones with Qualcomm processors in an approach using special modes. They addressed the special modes 9008 and 9006 of the Qualcomm processor to extract the data partition. This mode is also known as Emergency Download Mode (EDL). Acquiring the data image using Qualcomm 9008 Mode, there is no need to unlock the boot loader; start the device in fastboot mode and set the phone to Qualcomm 9008 mode. Mode 9006 is applied to cause intentional damage to the boot partition, after which a computer can read the device's data partition. In the experiments, data integrity and the possibility of executing the proposed methods were also proven. However, the experiment was done on devices with Android OS Version 5.1.1, and the proposed approach reaches only devices using Qualcomm SoCs.  
[PERSON] et al. [34] exploited the Common Criteria (CC), which is a feature that increases the security level of Samsung devices and therefore makes it difficult for forensic acquisition for law enforcement. Due to the impossibility of gaining access to the project's specifications, documentation, and source code, the authors reverse-engineered the implementation of CC mode, as Samsung's secure boot manager protects it. They presented how this security mode is applied, its vulnerabilities, and how they can be used to bypass CC mode by increasing the attack surface for later forensic acquisition. However, the work is limited to devices manufactured by Samsung.  
[PERSON] et al. [44] recovered 3500 AT commands from more than 2000 Android smartphone firmware images from eleven suppliers. The commands were tested on eight Android devices from four different suppliers via the USB interface. The authors identified the possibility to rewrite the device's firmware, bypass Android's security mechanisms, obtain sensitive device information, perform screen unlocks, and inject touch events using AT commands only. There are still other features that can be exploited by the AT command, which features an attack surface on Android devices. AT commands were written in the early 1980s, whose purpose was to control modems, but they can still be used on most Android OS smartphones. The technique proved to be effective only on Samsung devices up to the Galaxy S7 Edge model with Android OS up to version 7.0. Tested on a Galaxy S8 Plus model, the technique proved ineffective, as well as on Google Nexus 6P and Google Pixel models.