Product Code Database
Mobile device forensics is a branch of digital forensics relating to recovery of digital evidence or data from a mobile device under sound conditions. The phrase mobile device usually refers to ; however, it can also relate to any digital device that has both internal memory and communication ability, including PDA devices, GPS devices and tablet computers.
Mobile devices can be used to save several types of personal information such as contacts, photos, calendars and notes, SMS and MMS messages. Smartphones may additionally contain video, email, web browsing information, location information, and social networking messages and contacts.
There is growing need for mobile forensics due to several reasons and some of the prominent reasons are:
Mobile device forensics can be particularly challenging on a number of levels:
Evidential and technical challenges exist. For example, cell site analysis following from the use of a mobile phone usage coverage is not an exact science. Consequently, whilst it is possible to determine roughly the cell site zone from which a call was made or received, it is not yet possible to say with any degree of certainty that a mobile phone call emanated from a specific location e.g. a residential address.
As a result of these challenges, a wide variety of tools exists to extract evidence from mobile devices; no one tool or method can acquire all the evidence from all devices. It is therefore recommended that forensic examiners, especially those wishing to qualify as expert witnesses in court, undergo extensive training in order to understand how each tool and method acquires evidence; how it maintains standards for forensic soundness; and how it meets legal requirements such as the Daubert standard or Frye standard.
Early efforts to examine mobile devices used similar techniques to the first computer forensics investigations: analyzing phone contents directly via the screen and photographing important content. However, this proved to be a time-consuming process, and as the number of mobile devices began to increase, investigators called for more efficient means of extracting data. Enterprising mobile forensic examiners sometimes used cell phone or PDA synchronization software to "back up" device data to a forensic computer for imaging, or sometimes, simply performed computer forensics on the hard drive of a suspect computer where data had been synchronized. However, this type of software could write to the phone as well as reading it, and could not retrieve deleted data.[1]
Some forensic examiners found that they could retrieve even deleted data using "flasher" or "twister" boxes, tools developed by OEMs to "flash" a phone's memory for debugging or updating. However, flasher boxes are invasive and can change data; can be complicated to use; and, because they are not developed as forensic tools, perform neither hash verifications nor (in most cases) audit trails. For physical forensic examinations, therefore, better alternatives remain necessary.
To meet these demands, commercial tools appeared which allowed examiners to recover phone memory with minimal disruption and analyze it separately. Over time these commercial techniques have developed further and the recovery of deleted data from proprietary mobile devices has become possible with some specialist tools. Moreover, commercial tools have even automated much of the extraction process, rendering it possible even for minimally trained first responders—who currently are much more likely to encounter suspects with mobile devices in their possession, compared to computers—to perform basic extractions for triage and data preview purposes.
Traditionally mobile phone forensics has been associated with recovering SMS and MMS messaging, as well as call logs, contact lists and phone IMEI/ESN information. However, newer generations of smartphones also include wider varieties of information; from web browsing, Wireless LAN settings, geolocation information (including geotagging contained within image metadata), e-mail and other forms of rich internet media, including important data—such as social networking service posts and contacts—now retained on smartphone 'apps'.
The European Union requires its member countries to retain certain telecommunications data for use in investigations. This includes data on calls made and retrieved. The location of a mobile phone can be determined and this geographical data must also be retained. In the United States, however, no such requirement exists, and no standards govern how long carriers should retain data or even what they must retain. For example, text messages may be retained only for a week or two, while call logs may be retained anywhere from a few weeks to several months. To reduce the risk of evidence being lost, law enforcement agents must submit a preservation letter to the carrier, which they then must back up with a search warrant.
However, leaving the phone on carries another risk: the device can still make a network/cellular connection. This may bring in new data, overwriting evidence. To prevent a connection, mobile devices will often be transported and examined from within a Faraday cage (or bag). Even so, there are two disadvantages to this method. First, most bags render the device unusable, as its touch screen or keypad cannot be used. However, special cages can be acquired that allow the use of the device with a see-through glass and special gloves. The advantage with this option is the ability to also connect to other forensic equipment while blocking the network connection, as well as charging the device. If this option is not available, network isolation is advisable either through placing the device in airplane mode, or phone cloning its SIM card (a technique which can also be useful when the device is missing its SIM card entirely).
It is to note that while this technique can prevent triggering a remote wipe (or tampering) of the device, it doesn't do anything against a local dead man's switch.
Due to the proprietary nature of mobiles it is often not possible to acquire data with it powered down; most mobile device acquisition is performed live. With more advanced smartphones using advanced memory management, connecting it to a recharger and putting it into a faraday cage may not be good practice. The mobile device would recognize the network disconnection and therefore it would change its status information that can trigger the memory manager to write data.
Most acquisition tools for mobile devices are commercial in nature and consist of a hardware and software component, often automated.
The FAT file system is generally used on NAND memory. A difference is the block size used, which is larger than 512 bytes for hard disks and depends on the used memory type, e.g., NOR type 64, 128, 256 and NAND memory of 16, 128, 256, or 512 Kibibyte.
Different software tools can extract the data from the memory image. One could use specialized and automated forensic software products or generic file viewers such as any hex editor to search for characteristics of file headers. The advantage of the hex editor is the deeper insight into the memory management, but working with a hex editor means a lot of handwork and file system as well as file header knowledge. In contrast, specialized forensic software simplifies the search and extracts the data but may not find everything. AccessData, Sleuthkit, ESI Analyst and EnCase, to mention only some, are forensic software products to analyze memory images.Rick Ayers, Wayne Jansen, Nicolas Cilleros, and Ronan Daniellou. (October 2005). Retrieved from Cell Phone Forensic Tools: An Overview and Analysis. National Institute of Standards and Technology. Since there is no tool that extracts all possible information, it is advisable to use two or more tools for examination. There is currently (February 2010) no software solution to get all evidences from flash memories.
Generally this is harder to achieve because the device original equipment manufacturer needs to secure against arbitrary reading of memory; therefore, a device may be locked to a certain operator. To get around this security, mobile forensics tool vendors often develop their own , enabling the forensic tool to access the memory (and often, also to bypass user passcodes or pattern locks).
Generally the physical extraction is split into two steps, the dumping phase and the decoding phase.
In recent years a number of hardware/software tools have emerged to recover logical and physical evidence from mobile devices. Most tools consist of both hardware and software portions. The hardware includes a number of cables to connect the mobile device to the acquisition machine; the software exists to extract the evidence and, occasionally, even to analyze it.
Most recently, mobile device forensic tools have been developed for the field. This is in response both to military units' demand for fast and accurate anti-terrorism intelligence, and to law enforcement demand for forensic previewing capabilities at a crime scene, search warrant execution, or exigent circumstances. Such mobile forensic tools are often rugged computer for harsh environments (e.g. the battlefield) and rough treatment (e.g. being dropped or submerged in water).
Generally, because it is impossible for any one tool to capture all evidence from all mobile devices, mobile forensic professionals recommend that examiners establish entire toolkits consisting of a mix of commercial, open-source, broad support, and narrow support forensic tools, together with accessories such as battery chargers, Faraday bags or other signal disruption equipment, and so forth.
Some tools have additionally been developed to address increasing criminal usage of phones manufactured with Chinese chipsets, which include MediaTek (MTK), Spreadtrum and MStar. Such tools include Cellebrite, and XRY PinPoint.
Desoldering the chips is done carefully and slowly, so that the heat does not destroy the chip or data. Before the chip is desoldered the PCB is baked in an oven to eliminate remaining water. This prevents the so-called popcorn effect, at which the remaining water would blow the chip package at desoldering.
There are mainly three methods to melt the solder: hot air, infrared light, and steam-phasing. The infrared light technology works with a focused infrared light beam onto a specific integrated circuit and is used for small chips. The hot air and steam methods cannot focus as much as the infrared technique.
A third method makes the entire re-balling process unnecessary. The chip is connected to an adapter with Y-shaped springs or spring-loaded . The Y-shaped springs need to have a ball onto the pin to establish an electric connection, but the can be used directly on the pads on the chip without the balls.
The advantage of forensic desoldering is that the device does not need to be functional and that a copy without any changes to the original data can be made. The disadvantage is that the re-balling devices are expensive, so this process is very costly and there are some risks of total data loss. Hence, forensic desoldering should only be done by experienced laboratories.
Not all mobile devices provide such a standardized interface nor does there exist a standard interface for all mobile devices, but all manufacturers have one problem in common. The miniaturizing of device parts opens the question how to automatically test the functionality and quality of the soldered integrated components. For this problem an industry group, the Joint Test Action Group (JTAG), developed a test technology called boundary scan.
Despite the standardization there are four tasks before the JTAG device interface can be used to recover the memory. To find the correct bits in the boundary scan register one must know which processor and memory circuits are used and how they are connected to the system bus. When not accessible from outside one must find the test points for the JTAG interface on the printed circuit board and determine which test point is used for which signal. The JTAG port is not always soldered with connectors, such that it is sometimes necessary to open the device and re-solder the access port. The protocol for reading the memory must be known and finally the correct voltage must be determined to prevent damage to the circuit.
The boundary scan produces a complete forensic image of the volatile memory and non-volatile memory. The risk of data change is minimized and the memory chip doesn't have to be Desoldering. Generating the image can be slow and not all are JTAG enabled. Also, it can be difficult to find the test access port.Ronald van der Knijff. (2007). retrieved from 10 Good Reasons Why You Should Shift Focus to Small Scale Digital Device Forensics .
If the USB drive has no protection switch, a blocker can be used to mount the drive in a read-only mode or, in an exceptional case, the memory chip can be Desoldering. The SIM and memory cards need a card reader to make the copy. The SIM card is soundly analyzed, such that it is possible to recover (deleted) data like contacts or text messages.
The Android operating system includes the dd command. In a blog post on Android forensic techniques, a method to live image an Android device using the dd command is demonstrated.
Note, this would not prevent writing or using the memory internally by the CPU. The flasher tools are easy to connect and use, but some can change the data and have other dangerous options or do not make a complete copy.Marcel Breeuwsma, Martien de Jongh, Coert Klaver, Ronald van der Knijff, and Mark Roeloffs. (2007). retrieved from . Small l Scale Digital Device Forensics Journal, Volume 1 (Number 1). Also, many of these tools have become more adept at recovering user passcodes/passwords, without user data loss. An example of a tool commonly used for this area is a BST Dongle .
Furthermore, different products extract different amounts of information from different devices. This leads to a very complex landscape when trying to overview the products. In general this leads to a situation where testing a product extensively before purchase is strongly recommended. It is quite common to use at least two products which complement each other.
Mobile phone technology is evolving at a rapid pace. Digital forensics relating to mobile devices seems to be at a stand still or evolving slowly. For mobile phone forensics to catch up with release cycles of mobile phones, more comprehensive and in depth framework for evaluating mobile forensic toolkits should be developed and data on appropriate tools and techniques for each type of phone should be made available a timely manner.
|
|
