question: How can companies figure out you rooted your phone even if you factory reset it?
comment: Certain companies (Samsung for example) have a physical hardware “switch” (called KNOX on Samsung) which is activated once the phone is rooted. This changes the KNOX value from “0” to “1” and it never changes back. Companies use this value which can be checked through settings to determine whether the device has been previously rooted before.
passages: Android phones can be officially rooted by either going through manufacturers controlled process, using an exploit to gain root, or flashing custom recovery. Manufacturers allow rooting through a process they control, while some allow the phone to be rooted simply by pressing specific key combinations at boot time, or by other self-administered methods. Using a manufacturers method almost always voids the warranty permanently, even if the device is derooted and reflashed. Software exploits commonly either target a root-level process that is accessible to the user, by using an exploit specific to the phone's kernel, or using a known Android exploit that has been patched in newer versions; by not upgrading the phone, or intentionally downgrading the version.
   In recent years a number of hardware/software tools have emerged to recover logical and physical evidence from mobile devices. Most tools consist of both hardware and software portions. The hardware includes a number of cables to connect the mobile device to the acquisition machine; the software exists to extract the evidence and, occasionally even to analyse it.
   Due to the proprietary nature of mobiles it is often not possible to acquire data with it powered down; most mobile device acquisition is performed live. With more advanced smartphones using advanced memory management, connecting it to a recharger and putting it into a faraday cage may not be good practice. The mobile device would recognize the network disconnection and therefore it would change its status information that can trigger the memory manager to write data.
  
  Most acquisition tools for mobile devices are commercial in nature and consist of a hardware and software component, often automated.
  
  Section::::Forensic process.:Examination and analysis.
   BULLET::::- Cordless tool manufacturers making batteries that fit only their own brand of tools, and often are not backwards compatible. Often multiple brands are owned by the same company, and share tool designs and features, accessories and batteries are deliberately changed to make them incompatible. An example would be Stanley Black & Decker who also owns or manufactures Black & Decker, DeWalt, Porter Cable, Mastercraft, and Craftsman. All use almost identical batteries, yet all have some feature designed to stop use in other tools.
  
  Section::::Variations.
   Section::::Forensic process.
  
  The forensics process for mobile devices broadly matches other branches of digital forensics; however, some particular concerns apply. Generally, the process can be broken down into three main categories: seizure, acquisition, and examination/analysis. Other aspects of the computer forensic process, such as intake, validation, documentation/reporting, and archiving still apply.
  
  Section::::Forensic process.:Seizure.
   Generally this is harder to achieve because the device original equipment manufacturer needs to secure against arbitrary reading of memory; therefore, a device may be locked to a certain operator. To get around this security, mobile forensics tool vendors often develop their own boot loaders, enabling the forensic tool to access the memory (and often, also to bypass user passcodes or pattern locks).
  
  Generally the physical extraction is split into two steps, the dumping phase and the decoding phase.
  
  Section::::Data acquisition types.:Brute force acquisition.
   Section::::Forensic process.:Acquisition.
  
  The second step in the forensic process is acquisition, in this case usually referring to retrieval of material from a device (as compared to the bit-copy imaging used in computer forensics).
   On Android devices there is a factory data reset option in Settings that will appear to erase all of the device's data and reset all of its settings. This method is typically used when the device has an issue that cannot be fixed using other methods, or when the owner wants to destroy their personal data before selling the device. After performing a study, Avast! reported that the data is recoverable using "fairly generic" and "publicly available" forensics software. The "Factory data reset" option has no effect on the Knox Flag. As such, it does not reset the device to its original factory settings and is not a way to return the device to a state compatible with the manufacturer's warranty. Data on the SIM card and the MicroSD card are not erased. If the device has been modded to a custom recovery such as TWRP that is able to custom install custom roms. Be sure to back up any data as well as the stock rom that is necessary.
   Not all mobile devices provide such a standardized interface nor does there exist a standard interface for all mobile devices, but all manufacturers have one problem in common. The miniaturizing of device parts opens the question how to automatically test the functionality and quality of the soldered integrated components. For this problem an industry group, the Joint Test Action Group (JTAG), developed a test technology called boundary scan.
   Mobile phone technology is evolving at a rapid pace. Digital forensics relating to mobile devices seems to be at a stand still or evolving slowly. For mobile phone forensics to catch up with release cycles of mobile phones, more comprehensive and in depth framework for evaluating mobile forensic toolkits should be developed and data on appropriate tools and techniques for each type of phone should be made available a timely manner.
  
  Section::::Anti-forensics.
   BULLET::::- In 2012 two mobile phones developed by Chinese device manufacturer ZTE have been found to carry a backdoor to instantly gain root access via a password that has been hard-coded into the software. This was confirmed by security researcher Dmitri Alperovitch.
  
  BULLET::::- In 2013 Researchers with the University of Massachusetts have devised a method of breaking a CPU's internal cryptographic mechanisms by introducing specific impurities into the crystalline structure of transistors to change Intel's random number generator.
   Section::::Tools.
  
  Early investigations consisted of live manual analysis of mobile devices; with examiners photographing or writing down useful material for use as evidence. Without forensic photography equipment such as Fernico ZRT, EDEC Eclipse, or Project-a-Phone, this had the disadvantage of risking the modification of the device content, as well as leaving many parts of the proprietary operating system inaccessible.
   Customized phone cases use custom printing. Different companies have different methods of printing on cases; some utilize sublimation, others Inkjet-printed skins, others dye-sublimation 3D printing methods.
  
  Functional cases can integrate external batteries or a USB, Bluetooth, or WiFi keyboard and touchpad.
  
  Section::::Anti-lost devices.
  
  Anti-loss keychains can easily locate a smartphone through the GPS and Bluetooth low energy antennas of the phone. Once the user is within range of the smartphone, both the smartphone and device will alert the user. It also can be used to remotely take photographs using Bluetooth.
  
  Section::::Phone charms.
   Section::::Data acquisition types.:Logical acquisition.
   In manufacturing, the term "lockdown event" refers to a continuous improvement initiative in which manufacturing in a specific area (typically a cell or specific piece of machinery) is halted in order to contain, and determine, what are the issues that are preventing the manufacture of goods from meeting the quality specifications. During the "lockdown event" a multi disciplinary team reviews the specific area manufacturing processes, tooling and machine condition, to find the root cause(s) of the problem(s). Once changes to the process, or machine repairs that may include adjustments and/or replacement are effected, a sample run is initiated and evaluated. If the results of the validation are within the required specifications, the area lockdown is lifted and production is resumed. Follow up sampling is conducted subsequently to ensure continuity of the lockdown results.
   MOBILedit
  
  MOBILedit Forensic is a digital forensics product by Compelson Labs that searches, examines and report on data from GSM/CDMA/PCS cell phone devices. MOBILedit connects to cell phone devices via an Infrared (IR) port, a Bluetooth link, Wi-Fi, or a cable interface. After connectivity has been established, the phone model is identified by its manufacturer, model number, and serial number (IMEI) and with a corresponding picture of the phone.
   In 2014, Samsung released a security service called Knox, which is a tool that prevents all modifying of system and boot files, and any attempts set an e-fuse to 0x1, permanently voiding the warranty.
  
  Section::::Legality.
   Mobile forensics tools tend to consist of both a hardware and software component. Mobile phones come with a diverse range of connectors, the hardware devices support a number of different cables and perform the same role as a write blocker in computer devices.
  
  Section::::Software forensics.
   The unlock code is verified by the handset and is generated by the manufacturer, typically by an algorithm such as a one way hash or trapdoor function. Sometimes big telecom providers change the original factory unlock codes as an extra layer of security against unlocking services. For various big brands such as Samsung and Motorola there is no algorithm but just a random code generator where the unlock codes are programmed in the phone itself and then saved in a big database managed by the manufacturer. For the other brands where the unlock codes are still based on algorithms those are based on the IMEI number and the MCC code and have been reverse-engineered, stolen or leaked. Some handsets can be unlocked using software that generates an unlock code from an IMEI number and country and operator details using the algorithm specific to the handset. Other manufacturers have taken a more cautious approach, and embed a random number in the handset's firmware that is retained by the manufacturer and the network on whose behalf the lock was applied. These handsets can still be unlocked by online services that have access to either inside people with the manufacturer or with the telecom networks, or they need to be connected to the computer with a cable where specific software will bypass the security and SIM-unlock the phone. Sometimes this is done by advanced calculations to bypass the security the official way and other times using exploits or overwriting parts of the firmware where the lock status is kept, and often even recover a phone that is bricked or completely damaged in the software sense.
   There are many more complex challenges when examining mobile phones in comparison to the forensic examination of normal computers. Many mobile phones have their own proprietary operating systems, which makes reverse engineering of such devices a very complex operation. The speed of the mobile device market also means that there are many more new devices being manufactured on a regular basis, so a mobile forensics tool must deal with all of these issues before being suitable for the task.
   If an error is found in a product, the manufacturer may identify this problem to specific versions of the DMR, possibly using a CAPA, and may then choose to issue notices to customers for products, that have been built according to these versions of the DMR, or make a product recall.
  
  Section::::See also.
  
  BULLET::::- The sub-clause 4.2.3 of ISO 13485:2016 requires a manufacturer of medical device to establish a Technical file, similar to a device master record.
  
  BULLET::::- Design History File (DHF)
  
  BULLET::::- Device History Record (DHR)
  
  Section::::References.
   Some tools have additionally been developed to address increasing criminal usage of phones manufactured with Chinese chipsets, which include MediaTek (MTK), Spreadtrum and MStar. Such tools include Cellebrite's CHINEX, and XRY PinPoint.
  
  Section::::Tools.:Open source.
  
  Most open source mobile forensics tools are platform-specific and geared toward smartphone analysis. Though not originally designed to be a forensics tool, BitPim has been widely used on CDMA phones as well as LG VX4400/VX6000 and many Sanyo Sprint cell phones.
  
  Section::::Tools.:Physical tools.
  
  Section::::Tools.:Physical tools.:Forensic desoldering.
   Quality of the products is then measured with the results of this test. If a unit fails, it goes under investigation to see what caused the failure and then remove the cause whether it came from an assembly process or from a component being incorrectly manufactured, or any other cause. If it is proven that a real failure occurs, the batch of units that were produced along with the failed unit, is then tagged for re-test or repair to either verify or fix the problem.
  
  Section::::External links.
   New York University Tandon School of Engineering researchers have developed a way to corroborate a chip's operation using verifiable computing whereby "manufactured for sale" chips contain an embedded verification module that proves the chip's calculations are correct and an associated external module validates the embedded verification module. Another technique developed by researchers at University College London (UCL) relies on distributing trust between multiple identical chips from disjoint supply chains. Assuming that at least one of those chips remains honest the security of the device is preserved.
  
  Section::::See also.
  
  BULLET::::- Clipper chip
  
  BULLET::::- FBI–Apple encryption dispute
  
  BULLET::::- Hardware security
   A third method makes the entire re-balling process unnecessary. The chip is connected to an adapter with Y-shaped springs or spring-loaded pogo pins. The Y-shaped springs need to have a ball onto the pin to establish an electric connection, but the pogo pins can be used directly on the pads on the chip without the balls.
  