Mobile Device Forensics

Mobile Device Forensics ➢ Introduction - Mobile phones and tablets are mini-computers and can do almost everything a conventional computer can do - For this reason, they are almost as important in DF as computers are themselves - This topic starts by considering how cellular networks work and looks at different operating systems - The type of evidence found is discussed and tools to retrieve it are introduced ➢ Cellular Networks and how they work - It is necessary to consider networks as well as the phones themselves, as crucial evidence may be found there o Each cellular network is made of individual cells, each of which uses a predetermined range of frequencies to provide service to a distinct geographic area o The size and shape of each cell varies, depending on the type of terrain Figure 1: The layout of a typical cellular network ➢ Components of a Cellular Network - Notice from Figure 1 that base stations are located at the edges of the cells, so that cells can be passed on from one to another - Sammons describes the components of a cellular network: o A base station consists of antennas for receiving and transmitting o The Base Station Controller (BSC) regulates the signals between base stations o The Mobile Switching Centre (MSC) processes calls within the network, an important evidence source o The Visitor Location Register (VLR) is a database that is linked to an MSC. All mobile devices currently being controlled by that MSC are recorded in the VLR o Information about individual subscribers is collected in the Home Location Register (HLR), including subscriber identification, billing, and services received, along with the current location of the device - Finally, SMS messages are controlled by the Short Message Service Centre (SMSC), but how long they are stored there varies between service providers ➢ Cellular Networks and Digital Forensics - The network can provide information about when a suspect (or their phone) was at a particular location, which can in turn associate them with a particular crime scene, or provide them with an alibi - If a prepaid phone (‘burner phone’) has been used, location information will still be available, but potentially very little user information ➢ Types of Cellular Network - Worldwide, the most common network type is GSM (Global System for Mobile communications). Phones use SIM cards which can be swapped between phones and contain subscriber information - In the USA, some networks still use CDMA (Code Division Multiple Access). CDMA phones don’t have SIM cards but use electronic identification - iDEN (Integrated Digitally Enhanced Network) is used to ‘push to talk’ phones, not so common in Europe ➢ Different Operating Systems (OS) - There are 3 main OSs used now: o Apple iOS o Android o Windows Phone - Each system presents its own challenges to DF investigators but iOS presents particular challenges ➢ Cell Phone Evidence - Sammons identifies the main evidence that may be recovered from a cell phone in the following table Call History Text Messages Email Pictures & Video Deleted Text Messages Browser History Contacts Local Information GPS Chat Sessions Calendar Voice Memos Documents - A PIN number may have been set to protect access to the phone, which may be locked after 3 unsuccessful attempts, requiring a PUK (Pin Unlock Key) to unlock the phone ➢ Predictive Text and Digital Forensics - Predictive Text was originally developed for the original mobile phones that didn’t have a full keyboard, but it is a standard feature now - As well as auto-completing words, it learns the words that are typed most frequently (including email addresses and URLs) and adds them to a local database on the device - This can be very useful for DF investigators investigating a phone to see if it has been used in a crime ➢ Call Detail Records (CDRs) - Although CDRs are kept by service providers to assess their network’s performance, they are potentially useful to DF investigators, providing: o The date/time the call started and ended o The number making the call and the number called o How long the call lasted o Whether the call was incoming or outgoing o The originating and terminating towers - But on their own they don’t say who made the call. Here subscriber information is needed - Any information may be kept for a limited time though ➢ Locating a Cell Phone - The most common method for locating a cell phone is by triangulation, where the distance from 3 masts is calculated by the signal delay to the masts - Other methods include using a directional antenna, or via GPS ➢ Collecting and Handling Evidence - The following procedure should be adopted when a cell phone is a potential source of evidence: o Isolate it from the network, either by using a Faraday bag or an arson can (basically a clean empty paint can) o If it is on, leave it on, and connect to a portable power source if the battery is low o If the phone is off, the battery and SIM card can be removed. The identification numbers located under the SIM card can be recorded (including the IMEI number, International Mobile Equipment Identity), as well as the make and model of the phone (these latter steps also apply to a phone that is turned on, once it has been analysed) o Essentially the same procedure is then used as for a computer, making a clone of the data on the phone rather than looking at the original o The main difference is the existence of the SIM card ➢ SIM Cards (Subscriber Identity Modules) - SIM cards can provide a lot of important and useful evidence, including: o Subscriber information (ISMI, International Mobile Subscriber Identity) o Service provider o Card identity (ICC-ID, Integrate Circuit Card ID, which identifies the SIM itself) o Language preference o Phone location (when it was powered off) - Other information may be there depending on user’s actions: o Stored phone numbers o Numbers dialled by the user (possibly stored by default) o SMS text messages, including deleted ones ➢ Cell Phone Data Acquisition: Physical vs Logical Approaches - If a cell phone is available for forensic analysis, the data can be acquired in two ways o Physically, which captures all the data (a bit-for-bit copy or clone) o Logically, which captures just the files and folders (this can be done using non-forensic tools and is equivalent to synchronising the phone with a PC) - The difference is that physical acquisition can recover deleted data, which might be crucial in an investigation ➢ Cell Phone Forensic Tools - It is noted that the best way to retrieve information is to acquire a forensic image (a bitstream or bit-for-bit copy of the phone’s memory) since this allows everything to be retrieved including deleted text messages → physical extraction - However, this may not always be possible and alternative approaches exist ➢ Extract from NIST Guidelines - Manual extraction involves looking at the device page by page and taking pictures with an external camera - Logical extraction involves making a copy of the data on the phone for subsequent analysis – but note that it is copying existing files and not the whole memory - Hex dumping and Chip-off are both methods of extracting information from the phone memory at different levels - Micro read: when all else fails, look at the chips with an electron microscope! ➢ Case Study - ‘Guide to Computer Forensics and Investigations’, 5th edition, chapter 12 - This case study involves the tracking of e-mails sent between two people (referred to as Randall and Sarah) in different companies suspected of intellectual property theft from the company Flashbills, where Randall is CIO - The mobile phone of one of the suspects, Sarah, was taken and a DF investigator attempted to carry out a logical acquisition of the data on the phone, but it was found to be code locked so access was impossible - The investigator then applied for, and obtained a warrant to get a copy of the cloud backups of the mobile phone of both suspects. They were supplied in the form or image files - Summary: o Logical acquisition of data from the suspects’ phones proved impossible was they were locked by a code o Cloud backups were provided by the service provider (following acquisition of a search warrant) o OSForensics was used to recover and read the emails and to look for incriminating content