9/20/2015. Cell Phone Data Retrieval and Its Legal Implications COPYRIGHT NOTICE

Transcription

1 Cell Phone Data Retrieval and Its Legal Implications COPYRIGHT NOTICE This presentation includes the creative works of others which are being used by permission, license or under a claim of fair use (17 U.S.C. 107). This presentation was prepared under the Fair Use Guidelines for multimedia presentations, and further use or distribution of it is not permitted. WARNING: This presentation contains a lot of nerd talk. We know it is early in the morning, but please stop us if you want to talk about any forensic topics you don t understand. 1

2 What is JTAG ing and Chip Off Current case law regarding cell phones Search Warrants Ethical Issues destruction of evidence How to From the Wiki Joint Test Action Group (JTAG) is the common name for the IEEE Standard Test Access Port and Boundary Scan Architecture. It was initially devised by electronic engineers for testing printed circuit boards using boundary scan and is still widely used for this application. Today, JTAG is also widely used for IC debug ports. In the embedded processor market, essentially all modern processors implement JTAG when they have enough pins. Embedded systems development relies on debuggers communicating with chips with JTAG to perform operations like single stepping and breakpointing. 2

3 Android Phones USB Debugging Not enabled by default Need to enable it to access the phone and move data across the USB. Pattern Locked Phones Broken or damaged USB port Windows Phones No way to bypass locked screen No Physical Dump Apple Phones No JTAG or Chip Off Support Encryption How to you process a phone? Cellebrite? RCFL? JTAG Can recover a full physical image from devices which may provide more Information than a logical image. Forensic desoldering Desolder the non volatile memory chip Connect the chip to a chip reader Benefits Device doesn t need to be functioning Can copy data without changes Risks Possible total data destruction Possible to destroy the chip and contents 3

4 Bypass a security code (not encryption) Data can be recovered if phone is not functional Data can be recovered if phone is physically destroyed (but chip still intact) Phone doesn t need power to chip off All phones are tested by the FCC Need to know what processor and how much memory Get the FCC ID Use the links from ADD screen shots of those sites with example phone i717 as example Currently there are no specific cases addressing JTAG or Chip Off in a published opinion (checked 9/20/15) in any jurisdiction 4

5 Riley v. California, 134 S.Ct (2014) Search incident to arrest interest in protecting officers safety did not justify dispensing with warrant requirement for searches of cell phone data; interest in preventing destruction of evidence did not justify dispensing with warrant requirement for searches of cell phone data. People v. Omwanda, 338 P.2d 1145 (Colo.App.2014) Search incident to arrest Consent to search the car found drugs paraphernalia (electronic scales, pill bottle with cocaine) Officer read 3 text messages on the phone Remanded for further hearing on independent source This cases is effectively overruled: People v. Taylor, 2012 COA 91 (Colo.App. 2012) (June 7, 2012) 5

6 Remember the independent source doctrine Illegal discovery did not affect the officer s decision to seek a warrant that provided independent source The redacted warrant established probable cause People v. Arapu, 2012 COA 42, 283 P.3d 680 (Colo.App.2012) People v. Nelson, 2012 COA 80, 296 P.3d 294 (Colo.App.2012) Crim.P. 41 and C.R.S Must provide a nexus between information sought and what is being searched Text messages (preparation of crime, correspondence with witnesses) Pictures (drugs, scoping of crime scene, weapons) GPS coordinates (contained within apps and photos) and map apps Timeline of events (using text messages or other apps) Due consideration should be given to LE s experience and training. People v. Dunkin, 888 P.2d 305, 309 (Colo.App.1994) Destruction of Evidence Constitutional Statutory 6

7 Constitutional People v. Greathouse, 742 P.2d 334 (Colo.1987) 3 part test The evidence was suppressed or destroyed by prosecution The evidence possessed an exculpatory value that was apparent before it was destroyed The defendant was unable to obtain comparable evidence by other reasonably available means See California v. Trombetta, 467 U.S. 479 (1984) Defendant has duty to prove all 3 prongs Constitutional Absent bad faith on the part of law enforcement, failure to preserve useful evidence does not constitute a due process violation. People v. Wyman, 788 P.2d 1278 (Colo.1990) People v. Scarlett, 985 P.2d 36 (Colo.App.1998) where police did not willfully destroy evidence and was only negligent, no due process violation (storage of vehicle). People v. Abdu, 215 P.3d 1265 (Colo.App.2009) evidence must have apparent exculpatory value to be considered. Constitutional Greathouse: when police conduct scientific tests, they must preserve samples to permit the defendant to accomplish independent testing, permit the defendant s expert to monitor the police testing, or provide some other suitable means to allow the defendant to verify independently the appropriateness of the procedures and the accuracy of the results of the testing. 7

8 Statutory C.R.S When evidence is seized in so small a quantity or unstable condition that qualitative laboratory testing will not leave a sufficient quantity of the evidence for independent analysis by the defendant s expert and when a state agent can reasonably foresee that the evidence might be favorable to the defendant, the trial court shall not suppress the prosecution s evidence if the court determines that the testing was performed in good faith and in accordance with regular procedures designed to preserve the evidence which might have been favorable to the defendant. Statutory Factors for the Court to consider: Whether or not a suspect has been identified, arrested, or retained counsel Whether the state should have used an available test more likely to preserve the results of seized evidence Whether, when test results are susceptible to subjective interpretation, the state should have photographed or otherwise documented the test results as evidence Whether the state should have preserved the used test samples Whether it was necessary for the state agency to conduct quantitative analysis of the evidence Whether there is a sufficient sample for the defendant s expert to utilize for analysis and the suspect or defendant has made a specific request to preserve such sample. Whether it was reasonable for the state to have contacted the defendant to determine if he wished his expert to be present during the testing. Statutory When evidence (or potential evidence) has an unknown evidentiary value, it cannot possess an exculpatory value that was apparent before it is lost. People v. Austin, 799 P.2d 408 (Colo.App.1990) 8

9 Evidence will be inaccessible (Chip Off) Evidence may be destroyed (if chip is destroyed) Is there an apparent exculpatory value? The evidence is probably unknown Is there another way to get the data? Possibly think of cloud back up of data Known data to Defendant that can be recreated Remember that chip off involves desoldering of the non volatile memory chip from the phone Chip Off work station Fancy hair dryer Stationary mount 9

10 Alcatel One Touch Rear case opened SIM Card SD Card Battery Removed FCC info Removal of case 10

11 SIM Card removed SD Card removed SIM Card Separate analysis can be done High tech tools! Guitar pick 11

12 Mother board Heat shield Chip sets Remove mother board Heat shield Chip set 12

13 Heat shield removed like a sardine can Battery removal 13

14 Battery removal Heat application to chip set Gently pry out chip 14

15 The chip is off Need to find correct reader for chip 15

16 Perfect fit Reader has found the chip and can read it Select the data to copy 16

17 Creating an image of the information contained in the chip Forensic tool to identify which case this image is associated with Starting to collect the contents of the physical drive 17

18 Sometimes this can take a while Chip Off Chip Off HTC Rezound Broken Power Broken Screen And bad USB 18

19 Chip Off HTC Rezound Chip Removed No going back Chip Off HTC Rezound Chip Off HTC Rezound 19

20 Chip Off HTC Rezound Remember you need to be able to power the phone and attach (solder) wires to the correct taps Cell phone board removed Power attached 20

21 Close up of JTAG contact points 21

22 Riff Box Flasher Box Lots of other Boxes About $200 Made for phone repair Such as IMEI Carrier unlocks Bricked phone Damaged Rooted phone Typically used to WRITE to memory of the phone But can also READ the full memory all ROMS (even more than cell phone forensics tools.) All we really want is ROM1 (User partition) Look for your phone 22

23 Phone information Info on chip size FCC info click on it Pick one often duplicate info on this site 23

24 Look for internal photos that has the best info Someone has done the work for us. Now we know what we ll find and where Samsung Galaxy Note i717 24

25 Samsung Galaxy Note i717 Smashed screen Samsung Galaxy Note i717 Samsung Galaxy Note i717 25

26 Samsung Galaxy Note i717 Power supply needed in JTAG Samsung Galaxy Note i717 This takes a LONG time Samsung Galaxy Note i717 26

27 Samsung Galaxy Note i717 Samsung Galaxy Note i717 Samsung Galaxy Note i717 27

28 Samsung Galaxy Note i717 Samsung Galaxy Note i717 Kyocera S

29 Kyocera S2150 Kyocera S2150 Kyocera S

30 Kyocera S2150 Additional Information / Resources JTAG Wiki Teel Technologies Class I took on JTAG GSM Forums All the different flasher boxes and repair dongles Wild PCS Mobile phone repair training JTAG repair and chip off repair kits Read more about it: iphones currently at 9.0 OS Will wipe the phone after 10 failed attempts Used to be able to write a search warrant Directly to Apple for unlocking Not since ios 8 ( Sept. 17 th, 2014) Apple no longer has backup encryption keys Apple devices since iphone 4S are encrypted Combo of hardware and software 30

31 What does Apple have? Still might have a Cloud Backup Phone could have been synced to a computer Apple might have IP logs to different services Always put into Airplane Mode Can be wiped remotely Timothy L. Johnson Deputy District Attorney 20 th Judicial District tjohnson@bouldercounty.org Detective Jeremy Shavin Boulder County Sheriff s Office jshavin@bouldercounty.org 31