Introduction to Digital Forensics Lecture Notes

Mobile Device Forensics 4 Understanding Mobile Device Forensics • Items stored on cell phones: – Calendars and address books – Social media account information – GPS data – Voice recordings and voicemail • A search warrant may be needed to examine mobile devices because they can contain so much information – This is a legal challenge rather than technical • Investigating cell phones and mobile devices is one of the more challenging tasks in digital forensics – No single standard exists for how and where phones store messages – New phones come out about every six months and they are rarely compatible with previous models The 3G standard was developed by the International Telecommunications Union (ITU) under the United Nations – It is compatible with CDMA, GSM, and TDMA – The Enhanced Data GSM Environment (EDGE) standard was developed specifically for 3G Main components used for communication: – Base transceiver station (BTS) – Base station controller (BSC) – Mobile switching center (MSC) Inside Mobile Devices • Phones store system data in electronically erasable programmable read-only memory (EEPROM) – Enables service providers to reprogram phones without having to physically access memory chips • OS is stored in ROM – Nonvolatile memory – Available even if the phone loses power • Personal digital assistants (PDAs) have been mostly replaced by iPods, iPads, and other mobile devices • Their use has shifted to more specific markets – Such as medical or industrial PDAs • Peripheral memory cards used with PDAs: – Compact Flash (CF) – MultiMediaCard (MMC) – Secure Digital (SD) • • Subscriber identity module (SIM) cards – Found most commonly in GSM devices – Consist of a microprocessor and internal memory – GSM refers to mobile phones as “mobile stations” and divides a station into two parts: • The SIM card and the mobile equipment (ME) – Portability of information makes SIM cards versatile Subscriber identity module (SIM) cards (cont’d) – The SIM card is necessary for the ME to work and serves these additional purposes: • Identifies the subscriber to the network • Stores service-related information • Can be used to back up the device Understanding Acquisition Procedures for Cell Phones and Mobile Devices • The main concerns with mobile devices are loss of power, synchronization with cloud services, and remote wiping • All mobile devices have volatile memory – Making sure they don’t lose power before you can retrieve RAM data is critical • Mobile device attached to a PC via a USB cable should be disconnected from the PC immediately – Helps prevent synchronization that might occur automatically and overwrite data • Depending on the warrant or subpoena, the time of seizure might be relevant • Messages might be received on the mobile device after seizure • Isolate the device from incoming signals with one of the following options: – Place the device in airplane mode – Place the device in a paint can – Use the Paraben Wireless StrongHold Bag – Turn the device of • SANS DFIR Forensics recommendations: – If device is on and unlocked - isolate it from the network, disable the screen lock, remove passcode – If device is on and locked - what you can do varies depending on the type of device – If device is of - attempt a physical static acquisition and turn the device on Due to the growing problem of mobile devices being stolen, service providers have started using remote wiping to remove a user’s personal information stored on a stolen device – Creates a forensic challenge during an investigation • Memory storage on a mobile device is usually a combination of volatile and nonvolatile memory – Requires a diferent approach for each condition Information that can be retrieved falls into four categories: • – Service-related data, such as identifiers for the SIM card and the subscriber – Call data, such as numbers dialed – Message information – Location information If power has been lost, PINs or other access codes might be required to view files Mobile Forensics Equipment • Mobile forensics is an evolving science • Biggest challenge is dealing with constantly changing phone models • Procedures for working with mobile forensics software: 1. Identify the mobile device & service provider 2. Make sure you have required mobile device forensics software 3. Attach the phone to power and connect cables 4. Start the forensics software and extract information • SIM card readers 1. A combination hardware/software device used to access the SIM card 2. General procedure is as follows: • Remove the back panel of the device • Remove the battery • Remove the SIM card from holder • Insert the SIM card into the card reader 3. A variety of SIM card readers are available Some are forensically sound and some are not • NIST guidelines list six types of mobile forensics methods: 1. Manual review – may not be considered “forensic” 2. Physical extraction – hardware/software based 3. Logical extraction – hardware/software based 4. Hex dumping & Joint Test Action Group (JTAG) extraction – hardware based 5. Chip-of – hardware based - most intrusive/destructive 6. Micro read – hardware based - most intrusive/destructive File system – Gives OS a road map to data on a disk • Type of file system an Operating System uses, determines how data is stored on the disk Understanding the Boot Sequence • Complementary Metal Oxide Semiconductor (CMOS) – Computer stores system configuration and date and time information in the CMOS • When power to the system is of • Basic Input/Output System (BIOS) or Extensible Firmware Interface (EFI) – Contains programs that perform input and output at the hardware level (circuit board) Disk drive components – Geometry – Head – Tracks – Cylinders – Sectors All flash memory devices have a feature called wear-leveling – An internal firmware feature used in solid-state drives that ensures even wear of read/writes for all memory cells In Microsoft file structures, sectors are grouped to form clusters – Storage allocation units of one or more sectors Clusters range from 512 bytes up to 32,000 bytes each Exploring Microsoft File Structures • Clusters are numbered sequentially starting at 0 in NTFS and 2 in FAT – First sector of all disks contains a system area, the boot record, and a file structure database • OS assigns these cluster numbers, called logical addresses • Sector numbers are called physical addresses • Clusters and their addresses are specific to a logical disk drive, which is a disk partition Disk Partitions • A partition is a logical drive • Windows OSs can have three primary partitions followed by an extended partition that can contain one or more logical drives • Hidden partitions or voids – Large unused gaps between partitions on a disk • Partition gap – Unused space between partitions Examining FAT Disks • File Allocation Table (FAT) – File structure database that Microsoft originally designed for floppy disks • FAT database is typically written to a disk’s outermost track and contains: – Filenames, directory names, date and time stamps, the starting cluster number, and file attributes • Three current FAT versions – FAT16, FAT32, and exFAT (used by Xbox game systems) • Microsoft OSs allocate disk space for files by clusters – Results in drive slack • Unused space in a cluster between the end of an active file and the end of the cluster • Drive slack includes: – RAM slack and file slack • An unintentional side efect of FAT16 having large clusters was that it reduced fragmentation – As cluster size increased • When you run out of room for an allocated cluster – OS allocates another cluster for your file, which creates more slack space on the disk • As files grow and require more disk space, assigned clusters are chained together – The chain can be broken or fragmented • When the OS stores data in a FAT file system, it assigns a starting cluster position to a file – Data for the file is written to the first sector of the first assigned cluster Deleting FAT Files • In Microsoft OSs, when a file is deleted – Directory entry is marked as a deleted file • With the HEX E5 character replacing the first letter of the filename • FAT chain for that file is set to 0 • Data in the file remains on the disk drive • Area of the disk where the deleted file resides becomes unallocated disk space – Available to receive new data from newly created files or other files needing more space Examining NFTS Disks • • • • • • • • • • • NT File System (NTFS) – Introduced with Windows NT – Primary file system for Windows 8 Improvements over FAT file systems – NTFS provides more information about a file – NTFS gives more control over files and folders NTFS was Microsoft’s move toward a journaling file system – It records a transaction before the system carries it out In NTFS, everything written to the disk is considered a file On an NTFS disk – First data set is the Partition Boot Sector – Next is Master File Table (MFT) NTFS results in much less file slack space Clusters are smaller for smaller disk drives NTFS also uses Unicode – An international data format MFT contains information about all files on the disk – Including the system files the OS uses In the MFT, the first 15 records are reserved for system files Records in the MFT are called metadata – Metadata is information about a file or Data about data Registry A database that stores hardware and software configuration information, network connections, user preferences, and setup information All NTFS computers perform the following steps when the computer is turned on: – Power-on self test (POST) – Initial startup – Boot loader – Hardware detection and configuration – Kernel loading – User logon Contamination Concerns with Windows XP – When you start a Windows XP NTFS workstation, several files are accessed immediately • The last access date and time stamp for the files change to the current date and time – Destroys any potential evidence • That shows when a Windows XP workstation was last used