I am interested in performing a penetration test of a Windows Phone 8 application for which I do not have the source code. While I can easily validate network communication security, it is more difficult to validate that the application is not storing any sensitive data insecurely.
Because there is no public jailbreak/root for Windows Phone 8 at this time, this seems to be a difficult task.
I considered that if I could install the app into the Windows Phone 8 emulator/simulator that I could use WinDbg, Process Hacker, maybe Process Monitor, or even API Monitor to determine where files are being written/read in the simulator's file system.
My purpose is to ensure a Windows Phone 8 application enforces security as this application claims, and it is difficult to perform a penetration test without root/SYSTEM access to the device.
Is it possible to monitor a Windows Phone 8 app's filesystem activity either in the simulator or on a device (without the app's source)? If so, how?