10/21/2013. The ubiquity of social media has lead inevitably to the involvement of digital evidence in nearly every segment of Criminal Practice

Transcription

1 Adam Zion Director of Information Technology Office of the Kings County District Attorney The ubiquity of social media has lead inevitably to the involvement of digital evidence in nearly every segment of Criminal Practice It has become incumbent upon attorneys to have some understanding of how the and digital media work in order to comprehend evidence relating to audit trails or traces. Typically social media web services are accessed from either a personal computer or a mobile device (smartphone or tablet) There are exceptions (gaming systems, high end cameras, Smart TV s, automotive systems, etc.) Each device has to hit the net somehow 1

2 There are two paths you can go by A) From a Computer Network to the - Protocol is the main method or language B) From a Cellular Network to the - a cellular radio protocol (CDMA, GSM, 4G, etc.) to Protocol translation is required Computer Network to connection Most Common: private internet access - to the Carrier s central office - to the The Private access Home access via plain old telephone line, cable TV line, or installed fiber-optic cable (FIOS) Office access via business class telecom line, cable TV line, or installed fiber-optic cable (dedicated access, dark fiber, etc.). Usually involves a private Domain Courtesy Access via Wi-Fi network (extension of office access listed above). Wi-Fi is not Cellular (Wi- Fi uses standards). 2

3 Cellular network to connection Second Most Common: mobile device - to cellular tower - to carrier central office router - to Service Provider Domain Name System Backbone (Wiring) Address Allocation System Protocol is a logical plan used for allowing computers on a network however large to communicate with each other For our purposes, it s most important feature is the creation and assignment of numerical addresses to every endpoint on a computer network (each computer) Two Types of IP addresses: Public Facing and Internal IP Addresses Four Sets of decimals: External: (TWCNYC) Internal: (classic Campus LAN ten dot ) 3

4 Static Assignment A permanent IP address. Typical for entire Domains (Google.com), or for servers on a network (i.e. a file sharing, or database server) Dynamic Assignment Less permanent, often seen as a lease from a DHCP (Dynamic Host Configuration Protocol) server on a network. Most users have a dynamically assigned IP address FaceBook ISP YouTube Home WiFi Router Public Facing Dynamic IP ( ) Corp LAN Public Facing Static IP ( ) & Internal Network IP Structure ( ) PC Int IP ( ) iphone Int IP ( ) Laptop Int IP ( ) The Cell Phone Number Assigned by the carrier to the account when you signed up for service WLAN MAC Address Wireless Local Area Network Media Access Control number Unique hardware alpha-numeric identifier on the device given by the manufacturer for Wi-Fi networks MEID Mobile Equipment Identification unique to device, given by manufacturer Similar to MAC Address, but for Cellular Networks Consists of Regional Code, Manufacturer Code, Manufacturer Serial # Decimal representation 5 x 5 x 4 x 4 Hex: Alphanumeric - 8 x 6 4

5 When a mobile device accesses the it does so by virtue of a Wireless Carrier (Verizon, T-Mobile, etc.) The Carrier passes the radio transmission to it s internet gateway or Proxy device. It is the gateway which possesses an IP number and which passes the mobile device s request out to the. The gateway talks IP. In some instances, the carrier gateway passes the data to a third party, like Research in Motion, who then routes your data to the internet (all Blackberry internet traffic passes through RIM, and then to the ) The destination site (YouTube, Twitter, etc.) will log the IP address associated with the Cellular service or the intermediate 3 rd party gateway not the handheld device! Unless the Carrier passes information about the device, the destination website will have no data on the mobile device. It will have user account information, but probably none about the device used In order to obtain information about which device was used (and potentially verify the source of the transaction), you must seek it from the Carrier, who s IP will have been logged by the website It is an open issue as to what transactions the Carrier logs and (more importantly) what logs they maintain and for how long! Do they have MEID, Cell #, an internal digital signature (combo of both), web logs? Trend is to have some info for a few days, but its hard to walk the data back 5