Presenter Name. Date

Transcription

1 Presenter Name Date

2 Smartphone Forensics! Henry E. Saint-Fleur Antenna NFC microchip Presenter Name Date

3 Smartphone Forensics Background Henry Saint-Fleur! Background! Computer Science / Network Administration / Computer Programing! Forensics! Certified Computer & Mobile Forensic Examiner, Linux Forensic / Canadian Police College! Digital Investigations / Court! Fraud, Mischief to data and unauthorized use of computers, computer examination!

4 Smartphone Forensics

5 Potentially a rich source of evidence Smartphone Forensics The Cell Network Handheld mobile devices Hardware Operating System Security / Apps Data Extraction Process Forensic tools Live DEMO & warrant issues

6 Smartphone Forensics What is a Cell Phone? An electronic device used for mobile telecommunications, i.e. wireless telephony, text messaging or data transmission, through a cellular network. What about the definition of Computer systems Sec 342.1cc!

7 Smartphone Forensics Computer System? What about the definition of Computer systems under Sec cc!

8 !! DATA?! Smartphone Forensics

9 Smartphone Forensics Investigations! Death! National Security! Gangsterism Criminal Organization Offences! Threats, Criminal Harassment! Extortion! Drugs! Fraud! Identity theft! e-vidence Proceeds of Crime (custom excise)!! E-vidence! Communications! "- Voice & multimedia! Documents! Financial records! Location services! "- navigation systems! Internet activities! Logs! Personal life management!

10 Capabilities Smartphone Forensics! Multimedia! Multimedia features: Camera, Voice-audio, Geotagging! Internet access / Wi-Fi connectivity! Social Networking (Live IM, Self-contained)! Games! Tools (Life management, Calendar, To-Do, financial coach)! Banking transaction(s) and payment system(s)! NFC (Near field Communication Tracking

11 Camera Phones Smartphone Forensics Suspects will take their own photos with the evidence and sometime at the crime scene!?!

12 Introduction to Cell Phone Technology Geo Tag example / not Absolute

13

14 The Network o Each phone will have a unique ID o Each transaction creates a record o Tower dumps / Tracking Introduction to Cell Phone Technology!

15 Introduction to Cell Phone Technology! The Network o Tower dumps / Tracking

16 Smartphone Forensics, Handheld Devices

17 Smartphone Forensics, Extraction Process Acquisition TYPES 2007 Sam Brothers

18 Smartphone Forensics, Handheld Devices Circumvent Security? Devices case by case!

19 Smartphone Forensics, Extraction Process Cursory examination?! 1. Sever Network connectivity - Disable all radio transmission 2. Extraction of data 1. Commercial Tools 2. In-circuit 3. Data Chip removal 4. Manual examination 5. Reporting

20 Smartphone Forensics, Extraction Process Selective Extraction & Warrant issues! Selective extraction is not always feasible! What about data embedded in to data SMS in Pic

21 Automated process of Commercial tools " Data format on Mobile Phones! Stored in various formats Smartphone Forensics, Data Process! No consistency between Vendors/models or OS versions! Investigators require some understanding of these formats (binary, Hexadecimal, ASCII or Unicode)

22 Automated process of Commercial tools " Data format on Mobile Phones Smartphone Forensics, Data Process! Some data like the phone number, may be stored onto the phone using the reverse nibble format :! For instance, the phone number is F5! This means that each byte in the number is in reverse order and F is padding to complete the data structure.! Also (little vs Big endian; little-endian 32-bit UNIX date time stamp (Mon Oct 31 10:06: GMT-4) is HEX 4E AE AB 6F and would be stored as 6F AB AE 4E on a Motorola device

23 Smartphone Forensics, Data Process SMS time stamp at arrival! Short Message 6: Status : received - read Service Center Type of Number : international Service Center Numbering plan : E.164 ISDN Service Center Number : 17057****** Message Type (TP-MTI) : SMS-DELIVER Reply Path (TP-RP) : no RP More Messages Indicator (TP-MMS) : no more messages Status Report Indication (TP-SRI) : status report shall be returned Originator Type of Number : international Originator Numbering plan : E.164 ISDN Originating Address (TP-OA) : 17052****** Protocol Identifier (TP-PID) : mobile-mobile Data Coding Scheme-Coding : GSM Data Coding Scheme-Class : Immediate display Data Coding Scheme-Class : Service Centre Time Stamp : 11 Oct 08 20:25:37 GMT+00:00 Information Element 1 : Concatenated message, reference 238. Segment 1 of 3. Text : i dont know what to say cuz lately u havent been knocking it down its been going up. since u were in jail i brought the price down. and ur bro wont pay u

24 Smartphone Forensics, Data Process SMS date/time discrepancies when comparing two + seized devices! Short Message receiving phone: Short Message sending phone: Status : received - read Status : sent Service Center Type of Number : international Service Center Type of Number : Service Center Numbering plan : E.164 ISDN international Service Center Number : 17057****** Service Center Numbering plan : E.164 ISDN Message Type (TP-MTI) : SMS-DELIVER Service Center Number : 17057****** Reply Path (TP-RP) : no RP Message Type (TP-MTI) : SMS More Messages Indicator (TP-MMS) : no more Reply Path (TP-RP) : no RP messages More Messages Indicator (TP-MMS) : Status Report Indication (TP-SRI) : status report Status Report Indication (TP-SRI) : shall be returned Sending Address : ***** Originator Type of Number : international Originator Type of Number : international Originator Numbering plan : E.164 ISDN Originator Numbering plan : E.164 ISDN Originating Address (TP-OA) : 17052****** Protocol Identifier (TP-PID) : mobile-mobile Protocol Identifier (TP-PID) : mobile-mobile Data Coding Scheme-Coding : GSM Data Coding Scheme-Coding : GSM Data Coding Scheme-Class : Immediate Data Coding Scheme-Class : Immediate display display Data Coding Scheme-Class : Data Coding Scheme-Class : Service Centre Time Stamp : 11 Oct 08 Service Centre Time Stamp : 11 Oct 08 20:23:12 GMT+00:00 20:25:37 GMT+00:00 Information Element 1 : Concatenated Information Element 1 : Concatenated message, reference 238. Segment 2 of 3. message, reference 238. Segment 2 of 3. Text : and he gave u a sled Text : and he gave u a sled instead of paper. that doesnt help any one but instead of paper. that doesnt help any one but him. i just dont understand where my paper is him. i just dont understand where my paper is going. if u loose that bike then what. going. if u loose that bike then what.

25 Smartphone Forensics, Data Process Date-Time Stamp Note the Received: from line contains an IP address in the form we have already learned. Note the IP Address as well as the date & time. Four numbers separated by dots.

26 !! Smartphone Forensics, Data Analysis! Questions? Demo and report! - logs! - SMS / MMS (deleted unread)! - Embedded data (in App databases )! - Notes (date created) Calendar entry! - App analysis (Skype, facebook, maps, breadcrumb trail, Malware)! - Location Services (Consolidated.db, wi-fi / Cell Tower / GPS coordinates )!

27 Smartphone Forensics