Mobile Forensics. Luis Rivera, Michael Zanchelli, Julio Poblete. Capstone: System Security IASP-470. Dr. John Yoon. Due 30 April, 2018

Transcription

1 1 Mobile Forensics Luis Rivera, Michael Zanchelli, Julio Poblete Capstone: System Security IASP-470 Dr. John Yoon Due 30 April, 2018

2 2 Abstract Cell Phones have become an essential part of any person s life. Cell Phones or smartphones can perform computing tasks instead of just making calls. A smartphone can send/receive s and text messages in seconds. It also has the capability of creating and editing diverse types of documents. But at the same time, a smartphone can be used to commit a crime. For example, it can be used to take pictures of important documents and them within seconds. Also, it can be used to download or upload documents to computers and servers. Cell Phones have become a powerful tool to commit crimes, and us as forensic analysts must deal with this issue.

3 3 Table of Content Introduction 4 Scenario 5 Arriving at the scene 6 Evidence Gathering 6 Acquisition Tools 7-10 Log Analysis Outcome 18 Conclusion 19

4 4 Introduction PRZ forensics is a small forensics company located in Dobbs Ferry NY. The company is owned by Michael Zanchelli, Julio Poblete and Luis Rivera. They are well known for its efficiency, professionalism and accuracy. PRZ has been providing quality digital forensic service to the tri-state area for many years. Their expertise ranges from the extraction of data from a locked mobile device or a broken hard drive, to the examination of physical and digital evidence needed to uncover deleted information and possible crimes. So what is Mobile Forensics? Mobile forensics is a fairly new field, dating back to late 90 s early 2000 s. It is a branch of Digital Forensics relating to the recovery of digital evidence from a mobile device. Mobile devices can be described as Smart Phones, tablets, GPS, portable music players, Amazon Alexa, among others. Using Mobile Forensics, we can recover personal information such as: contacts, text messages, threads, photos, videos, calendars, notes, web-browsing information and much more. It is a very challenging field, due to constant changes made by phone manufacturers to remain competitive among other manufacturers. Some of these changes include form factors, operating system file structures, data storage, services, etc. As a result of the constant changes, forensic examiners find themselves in the need of continuous and extensive training to understand how forensic tools work and learn new acquisition methods.

5 5 Scenario On Saturday April 14th 2018 at 5:00 am the body of a middle aged female victim was discovered in the town Spring Valley NY. The victim was identified as Susan McCarthy age 36 from 12 Main st Garnerville NY. The victim was found bound with an electrical cord, gagged and shot 4 times. Evidence suggests that the victim was murdered in a separate location and the body was dumped in the dark alley where it was discovered by two teenagers walking by. Besides being bound and shot the victim also showed blunt force trauma to her face and chest area. The only evidence recovered from the crime scene was the victim s Android phone. In search for more clues about this horrendous crime local police requested the assistance of PRZ forensics.

6 6 Arriving at the Scene Luis Rivera was dispatched to the crime scene to assess the scene and collect any digital evidence that could be analysed. Upon arrival, the appropriate garment was put on ( Disposable Jumpsuit, Disposable Shoe Covers, Disposable Anti-Odor Masks, Latex Gloves, etc) to avoid contamination of the crime scene. An incident response kit was also brought along to the scene containing A digital camera, faraday bags, evidence bags, chain of custody forms and other devices to record and safeguard any evidence recovered from the scene. Evidence Gathering In this case the only digital evidence that was recovered was the victim s cell phone, pictures of the phone were taken and the phone was turned off to preserve the current tower location information, call logs and save the remaining battery power. Then it was put inside Faraday bag to prevent any signals from getting to the mobile device, once inside the bag it was sealed and marked as evidence. After the digital evidence was collected a chain of custody form was filled to ensure the accountability and proper handling of the evidence.

7 7 Acquisition Tools Android devices are built that there kernels are not part of the system partition, it is a seperate part of the device which means the investigator are able to extract the data from the devices more easily than other operating systems. The Sleuth Kit this is a library and collection of command line tools that would allow the investigator to look into disk images. It allows one to analyze the system s data. This framework allows plug-in so that one would be able to use additional modules, such as, Autopsy, to analyze file contents. Autopsy is a powerful open source software mobile forensic tool that allows one to extract information off an android device, even if it locked with a passcode. The investigator would use a graphical interface to the command line investigation tool in The Sleuth kit. Autopsy has a module called Android analyzer. The Android Analyzer allows The android analyzer module allows one to analyze the SQLite, text messages, Call logs, Contacts, tango messages, words with friend messages, GPS locations from the browser and Google maps and able to extract the GPS cache.wifi and cache.cell files. In order to use the module in Autopsy the investigator there will be a window that displays for the investigator to walk through before any information is extract, the step-by-step instruction are:

8 8 1. add data source, a pop-up window will display then the investigator would 2. chose the victim s device image, select the correct time zone, click next, 3. then step 2: Macrep Configure Ingest Modules, a list of modules will display, choosing from the list the investigator would select the Android Analyzer module, then would click next 4. wait for the software to extract the data from the device s image, wait for the extraction is completed Once the extraction is completed then the investigator is able to access the android analyzer module, the investigator would be able to access all the device s information and go through the victim s device. FTK Imager is used for data preview and an imaging tool for acquiring data for evidence. It creates copies of data without making any changes to the original evidence. After the extraction it creating an image the investigator is able to perform create forensic images of the local hard drives, CDs and DVDs, thumb devices or other USB devices, entire folders, or individual files from various places within the media. With FTK Imager the investigator is also able to preview files and folders of the local and network hard drives, the thumb device and other USB devices. Preview the content of the forensic images stored on the local machine or on the network drive. FTK Imager is capable of mounting an image for a read-only view that would leverage Windows Internet Explorer to see the content on screen exactly as the user originally saw it, also able to export files and folders from the forensic images. See and recover files that have been deleted from the Recycle bin, that has

9 9 not been overwritten yet on the drive. It can generate hash reports for regular files and disk images that the investigator would be able to access later on, if they needed for proof the integrity of the evidence. When FTK Imager images an entire drive, a hash is generated that can be verified by the image hash and that drive hash match after the image is created, so the investigator would know that the drives would remain unchanged since the acquisition. When the hash files are created FTK checks the integrity of the data by using two hash functions, Message Digest 5 (MD5) and Secure Hash Algorithm (SHA-1). MOBILedit - supports about thousands of phones including most of the common manufacturers like Samsung, HTC, LG and Motorola. Also, it supports all the operating system including Android, iphone, Blackberry, and Windows mobile. A feature that is include in Mobiledit, a bypass the PIN code with an integrated SIM cloning tool which allows to remove the requirements of a PIN for the original SIM card of the phone that is being investigated. It also removes the obsolete and the unreliable Faraday bags, a designed to shield a mobile phone or small digital device from radio waves entering the bag and reaching the device. Now the investigator can now clone the SIM card, they are able to create a new SIM card altogether with any ICCID, or just format the SIM card to renew for the next use. Also, there is a powerful SIM analyzer that would be able to retrieve Location Area Information, and to review and export a list of all SIM card applications that was used on the device; able to read deleted text messages from the SIM card as well. MOBILedit give complete support to access contact accounts to the following application that the user has used on their device, Skype, Gmail, Facebook and MS Exchange. The forensic tool

10 10 would be to retrieve passwords, even though it may be impossible to get that information from the services, but this tool gains the investigator access to that sort of information and is able to get the full report of all people the suspect would have been in connected with. A nice feature MOBILedit has is that if an Android device is getting the investigator any trouble connecting to the computer then it would be possible to extract information via Wi-Fi. The GUI layout is hassle-free for the investigator because it is to help give a quick way to looking into suspect s device and immediately see the complete version of the device s information along with the compatible data cable supporting the device and its position in the Connection Kit feature. Even if the investigator is not sure of the model number of the device, the picture would be able help the investigator identify which is the right one. There is also, a very well organized view of the devices media files, it divided the suspect s photos, recording and videos up into different folders to help have an easier sorting the evidences and inside the folders that have a nice filtering feature to save more time going to unnecessary files. There is unique driver detection and repair system built into the forensic tool so as the investigator is connecting the device to the computer, there may be a time where Windows would be problematic, if the device driver was not installed correctly. So what this feature would automatically downloads and install the correct driver, while repairing the the wrong one that was preinstalled by Windows. MOBILedit has another side called forensic express. This is all-in-one tool used to gather evidence from phones. It contains camera ballistics, it can used to identify which images present on the analyzed phone were actually taken, it also get more information of the photo such as, make, model, GPS, camera setting, mean square error, fingerprint presence result probability and

11 11 correlation would be organized into a well designed into a PDF report suitable for submission as evidence. Log Analysis Mobile phones have become quite important tools in the modern world. Rather than just placing calls, most phones allow users to perform additional tasks, including Short Message Service (SMS) messaging, Multi-Media Messaging Service (MMS) messaging, Instant Messaging (IM), electronic mail, and Web browsing. Because of everything that they can do, cell phones and cellular devices can also be involved in a crime or other incidents. The fast-changing technology in mobile devices has led to a challenge of how to analyze their data quickly and efficiently. The variety of forensic software that deal with mobile devices is vast and diverse. Forensic specialists will require special tools to analyze and retrieve data that is present on the cellphone. There are many forensic tools available in the market, but on this occasion, we decided to use MobilEdit forensics. Mobiledit forensics is a tool design by Compelson Labs, whom provide the ability to view, search, examine and report data from GSM/CDMA/PCS cell phone devices. It s an excellent tool due to its advanced application analyzer, deleted data recovery and wide range of supported phones including old feature phones. Mobiledit connects to cell phone devices via an Infrared (IR) port, a Bluetooth link, Wi-Fi, or a cable interface. After connectivity has been established, the phone model is identified by its manufacturer, model number, and serial number (IMEI) with a corresponding picture of the phone. Data acquired from cell phone devices are stored in the.med file format. This data includes call history,

12 12 phonebook, text messages, multimedia messages, files, calendars, notes, reminders and raw application data. It will also retrieve all phone information such as IMEI, operating systems, firmware including SIM details (IMSI), ICCID and location area information. Where possible, Mobiledit Forensic is also able to retrieve deleted data from phones and bypass the passcode, PIN and phone backup encryption. We found that Mobiledit Forensic was the tool that we needed to do our investigation. The reason why is because Mobiledit gives you a wide variety of phones to work with and it has a user-friendly interface. I will be documenting the steps on how to obtain all the necessary data using Mobiledit. Verification Before starting my investigation, the first step is to start documenting. Basic verification can be performed on this device to ensure the correct phone is being analyzed. The victim s

13 13 phone was turned off to recover call logs and to preserve the phone in the same condition it was found. In order to confirm the cellphone s number, we can simply navigate to Settings -> about Phone -> status -> SIM status. This displays the number assigned to the phone and the carrier. A query to Sprint for cell phone number yields the victim s name. Even if the phone was off, it can be powered on to retrieve this information. System Description Now that the device in question is known to be the suspect s, gathering key information continues, and Mobiledit makes this process easier. It only takes a few minutes to note the following: Make: Motorola Moto X IMEI: SIM: Carrier: Sprint

14 14

15 15 Evidence Acquisition The first step in evidence acquisition is to hash the phone s memory contents. Hashing is used to validate the data integrity. Hashing algorithms are used to create a reproducible string of characters that can be used to validate if a file has changed or not. We used FTK imager to create the MD5 and SHA1 hash. Once we obtained the hash we began searching for evidence in the cell phone, we connected the cellphone to the investigators laptop using a USB cable. Once the cell phone is connected, Mobiledit will be able to extract all the data that is stored within the cell phone.

16 16 The first thing we had to do was to find how the suspect got in contact with the victim and we searched for any incoming s from the suspects address. We found a good amount of s going out from the victim to the suspect. The s showed that the suspect was trying to sell a Playstation 4 device to the victim. The suspect then proceeds to ask for a cellphone number to contact the user via text message.

17 17 We extracted all text messages from the cellphone using Mobile edit and we found all the text messages between the suspect and the victim. We found one very incriminating text message in which the suspect asked the victim to meet her at a location at late hours of the night so he can sell her the Playstation 4.

18 18 We also found that the victim s cell phone had geo location history turned on. This was very helpful in our investigation because it pinpoints the exact location where the victim was last seen. Google geolocation history is turn on by default in all android smartphones. Google uses this data to find services around you while you are traveling, and it provides updates on google maps. Using Mobiledit we were able to find a lot of incriminating evidence that will be very helpful in the case against the suspect. Outcome of investigation Thanks to all the incriminating evidence that was giving to the police, they were able to locate and successfully arrest the perpetrator. After searching the perpetrator s home, police found a lamp that was missing its power cord and signs of a struggle. A 9mm firearm model Glock 19 was also recovered from the scene. Police were able to determine that the crime had taken place at the perpetrator s home. Due to the mounting evidence, the perpetrator confessed to this crime and told police how he lured the victim into his home. Allegedly Susan McCarthy (the victim) wanted to purchase a PlayStation 4 for her son and saw an ad on craigslist and ed the perpetrator. After some s were exchanged she called the him and arranged the meeting for the purchase. However there was a never a PS4, the criminal merely owned an empty PS4 box that he used to create the fake ad to lure the victim.

19 19 Conclusion Mobile phones play an important part in our society, and they have become an important tool in the life of many people. Modern mobile phones not only allow you to make calls, but they allow users to send text messages and s in an instant. Also, they can be used to access and edit important documents on the go. On the other hand, mobile phones can be used to commit crime, thus becoming a crucial evidence in many criminal cases. Mobile phones yield an abundance of information including call logs, text messages, and geo location. As mobile forensic investigators, our job is to find the evidence by using especial software and make it available for the people in charge of pursuing the criminal cases.

20 20 References A Simplified Guide to Digital Evidence. (2018). Retrieved 13 April 2018, from Tahiri, S. (2018). Mobile Forensics: Investigation Process Model. Retrieved 29 April 2018, from Orozco, Ana, et al. "Theia: A Tool for the Forensic Analysis of Mobile Devices Pictures." Computing, vol. 98, no. 12, Dec. 2016, pp EBSCOhost, doi: /s Lewis, Rebecca L. "Cell Phone Forensics Can Play a Key Role in Gathering Intelligence." Corrections Today, vol. 77, no. 3, May/Jun2015, pp EBSCOhost, search.ebscohost.com/login.aspx?direct=true&db=aph&an= &site=ehost-live. Carrier, Brian. Open Source Digital Forensics. The Sleuth Kit (TSK) & Autopsy: Open Source Digital Forensics Tools, 2003, Basis Technology. Android Analyzer. Autopsy User Documentation: Android Analyzer, 19 Oct. 2015, sleuthkit.org/autopsy/docs/user-docs/3.1/android_page.html. AccessData. FTK Imager FTK Imager 3.4.2, 2017, marketing.accessdata.com/ftkimager Compelson Labs. MOBILedit Forensic. MOBILedit, 2018, Compelson Labs. Forensic Express. MOBILedit, 2018,