COMP116 Final Project. Shuyan Guo Advisor: Ming Chow

Size: px
Start display at page:

Download "COMP116 Final Project. Shuyan Guo Advisor: Ming Chow"

Transcription

1 Digital Forensics with ios Devices COMP116 Final Project Shuyan Guo Advisor: Ming Chow

2 Abstract This project focuses on ios device forensics. The study provides a general overview of the digital forensic principles, framework and proposes a technique the raw extract data images directly from the low level ios devices NAND flash memory chips. The supporting video demonstrates how the forensic analysis can be used in iphone investigations. Introduction Digital forensics is a branch of forensic science focusing on the recovery and investigation of raw data residing in electronic or digital devices. Mobile forensics is a branch of digital forensics related to the recovery of digital evidence from mobile devices. Forensically sound is a term used extensively in the digital forensics community to qualify and justify the use of particular forensic technology or methodology. The main principle for a sound forensic examination of digital evidence is that the original evidence must not be modified. The data in mobile phones are basically electronic record. As long as mobile phones are processed by acceptable means that is digital forensics. Digital forensics investigates digital evidence, the data extracted from mobile phones, which includes phone calls, text messages, phone logs, media files, browsing record, GPS and e- mail. According to NIST, mobile phone forensic procedures can be divided into four phases: Preservation, Acquisition, Examination and Analysis and Reporting. Due to the prevalence of ios devices such as iphones and ipads, they have been the subjects of various research efforts in the past few years. One of the key challenges in acquiring deleted data from ios devices is the use of the hierarchical encrypted file system in these devices. To circumvent the security mechanisms in ios devices, Zdziarski et al. proposed using tethered jailbreaking and imaging techniques in order to acquire electronic evidence from these devices.

3 All ios devices use a NAND flash drive for their main storage. NAND/NOR flash storage is widely used in mobile devices, USB flash drives, and solid- state drives (SSDs) owing to its excellent performance and reasonable cost. However, because of the various file translation layers (FTLs), forensic analysis on an ios device differs from an SSD; thus, the two should be treated separately. To the community: With the continuing releases and development of mobile devices, smart phones have become the necessary devices in human's lives. Aside from the traditional audio communication and texting, they equip the functions of internet, GPS, digital cameras, multi- media as well and they also provide higher volume of storage space and diverse apps. Therefore, the mobile device forensics is widely used in the field of administration of justice with rising needs. Evidences discovered on smart phones may have a direct impact on the final verdict of the case. One of the biggest forensic challenges when it comes to the mobile platform is the fact that data can be accessed, stored, and synchronized across multiple devices. As the data is volatile and can be quickly transformed or deleted remotely, more effort is required for the preservation of this data. Mobile forensics is different from computer forensics and presents unique challenges to forensic examiners. Applications: ios forensics Procedures Step 1: Preparation The preparation step plays a fundamental role to determine the possible location, type of storage media, format of digital evidence and its cryptographic key. In cases involving mobile devices, the likely sources and types of digital evidence include video files, Internet browsing histories and GPS (Global Positioning System)

4 locations. It is, therefore, crucial that during the preparation step, digital forensic practitioners inspect the seized exhibit to obtain product information and record all the work performed. In ios forensics, digital forensic practitioners would need to understand the electronic components of an ios device and how they work. For instance, the ios device s camera captures the scene through the charge- coupled device and converts it to electrical signal. The signal is then converted to digital using an analogue- to- digital converter. The image data is then formatted in a file container with specific codec and encrypted with a 256- bit per- file key. This is then wrapped with a data protection class key and stored in the image file s metadata. The latter is then encrypted with the data partition key (EMF key), which is generated from the unique hardware UID. The encrypted image file is stored in the flash storage media. Therefore from an operational perspective, digital forensic practitioners would need to seek additional expertise to ensure he has the requisite knowledge and tools to recover the evidential data. Step 2: Forensic copy The second step of the proposed technique is to create a forensic copy of the ios device to a securely wiped spare hard disk (all sectors written with zeros) and hashing (to create a hash signature). The hashing process, using MD5 (Message Digest 5), is a requirement in the preservation step to verify the integrity of a forensic copy. It would also be advisable to check the time offset (the difference between the actual and displayed digital evidence time) of the ios device. If the ios device is faulty or damaged, attempts should be made to repair the device. Such repair works should, of course, be noted in the chain of custody register and/or other case file. It should be noted that devices containing digital evidence to be processed may not

5 be received in working condition, and creating a physical forensic copy of digital evidence can be challenging. Failing this, we will not be able to preserve and analyze the digital evidence, as forensic analysis needs to be conducted on a forensic copy. Figure 1. Mobile phone evidence extraction process Step 3: Forensic analysis In this step, digital forensic practitioners will attempt to recover deleted image file(s) from the forensic copy based on the device s journal information as well as the per- file key (uniquely associated with an image file). From the preparation work undertaken in Step 1, digital forensic practitioners would have an understanding of the ios device file system, and facilitate the analysis, searching, extraction as well as the choice of an appropriate application to view the deleted image file(s). The challenge of recovering the image file from an ios device is mainly due to the

6 underlying file system and (hierarchical) encryption system, as well as the image s internal unique format. This forensic analysis will determine the image file per- file key value for data decryption and viewing. Step 4: Reporting The fourth and final step is to ensure that the findings are explained in a manner that is understandable to investigators, judiciary (including juries), prosecutors and other decision makers. The report must cover the entire ios forensics process from Step 1 to Step 3 (as per the record of work performed in the ios forensics technique). In addition, when a number of parties have been involved in the possession of the digital evidence, it is critical that the chain of custody log records the details of the individuals (e.g. digital forensic practitioners and investigation officers). ios Data Encryption and Recovery 1. ios Data Encryption Since version 3.0, ios has developed a comprehensive security mechanism that includes full disk encryption and quick disk wipe. ios 7.x introduced many new techniques. Such security mechanisms are intended to defend against data theft and attackers but have also made lawful forensic works more difficult. Data recovery must circumvent ios data encryption first. The passcode plays a crucial part in ios security. The passcode key then decrypts the class keys that unlock the file systems and other sensitive key chains. Thus, without the passcode, forensics is impossible. It also turns out that brute- force attacks are more complicated than they seem. A

7 device- specific secret, called the UID key, which is used in the key- derivation function, is embedded in the on- chip Advanced Encryption Standard (AES) engine and isn t directly exposed to the software. Therefore, currently available techniques can t extract the UID key from the device, making offline brute- force attacks impractical. However, on- device attacks are possible by running a customized brute- force program in device firmware upgrade (DFU) mode, a technique that s sufficient for four- to six- digit passcodes. Note that only the key- derivation function must be performed on the device. Once the key bag containing the class keys is unlocked, the rest of the analysis can be done offline. Also, ios employs a complex key- management scheme to ensure data is not accessible when it s not needed. It categorizes data into different classes by when it s needed. Using separate class keys for each class ensures different levels of access control for example, files in the NSFileProtectionComplete class will become inaccessible shortly after a user locks the screen, whereas NSFileProtectionCompleteUnlessOpen allows the file to remain accessible, even after screen lock, as long as the file has already been opened. The passcode key, derived from the passcode, encrypts these class keys, which are stored in a key bag file called systembag.kb. The key bag file s contents are encrypted twice, first by the BAG1 key (stored in AppleEffaceableStorage), then by an ordinary file key. AppleEffaceableStorage is removed completely upon data wipe, after which the key bag can t be unlocked. 2. ios Data Recovery with NAND Images NAND flash memory chips are designed for block- erase and block- write actions. New data can be written only after the destination block is erased entirely. Logically, data is allocated in pages, but physically, data operation is performed using a block as its unit. Therefore, in the physical layer, the only way to erase one bit is to erase its entire block. Figure 2 shows NAND s structure in a 16- Gbyte iphone 4.

8 Figure 2. NAND layout in a 16- Gbyte iphone 4. Logically, data is allocated in pages, but physically, data operation is performed using a block as its unit. The spare area where additional metadata is stored contains the physical page corresponding to the logical page number (LPN) and the update sequence number. To hide the implementation details of specific NAND flash memory from upper file systems, reading and writing must operate through the FTL, which applies several translations to locate the physical block, as Figure 3 shows. Figure 3. ios file translation layer (FTL) structure. FTL is a crucial data structure that maps logical pages to the physical pages that actually store the data. When data needs to be updated, the storage system writes a new copy of the updated data to a new flash memory block, redirects the logical address to point to the new data block, and leaves the original block with its outdated data. The FTL erases the original block during its idle time. This means that, most of the time, data isn t immediately wiped on the physical level upon deletion. From a forensics

9 viewpoint, this proves valuable in data recovery. YaFTL (yet another flash translation layer) organizes data in allocation units called super blocks, each containing FTL context blocks, index blocks, and user data blocks. The last few blocks of each full user data block (the exact number varies among device models and block allocation) comprise the block table of contents (BTOC), which records the LPN of each page in the super block in case of a consistency check during an abnormal shutdown. However, if a user data block isn t fully occupied, there is no BTOC. 3. Data Recovery Algorithm for NAND Images To locate the physical pages that actually store the data to be recovered, we need to find each logical page s corresponding physical pages and extract the mapping. A logical page might have multiple corresponding physical pages because some might contain outdated versions of the data. To find these pages, we traverse all the user data blocks. If there s a BTOC, we traverse it to get the LPN of each physical page in this block. If there s no BTOC, this block hasn t run out, so we traverse each physical page in this block and read the LPN field from the metadata in the spare area. In this way, we can get a complete mapping between physical and logical pages. We can then use ordinary HFS+ file system data recovery techniques for further analysis. Next, we retrieve the catalog node ID (CNID) from the catalog file s deleted files by obtaining the catalog and attribute file s logical address, then finding all corresponding versions of the physical pages. We compare the data in these physical pages and find the CNIDs that are missing in the latest version of the catalog file. The file records corresponding to these CNIDs are the deleted files we re looking for. Finally, using a previously obtained file record from the catalog file, we can recover

10 its data blocks. The data blocks are organized as a link list, each containing a pointer to the next data block. To recover all data blocks, we simply find the first data block address in the file record, and then iterate through the link list until the end of the file. Conclusion Given the increase in mobile devices in everyday life, digital forensics is increasingly being used in the courts. This project proposed an operational technique for ios devices forensics, and validated it using an iphone5 as case study. Also, a data recovery tactic was provided. I hope the findings from this project would help digital forensic practitioners involved in criminal investigations and civil litigation matters involving ios devices. In the future, I will extend the research to ios 8 s new security features and analyze the possible forensic implications surrounding these enhancements. Supplementary Material: A supplementary video demonstrating ios forensic analysis on an iphone 5 posted to the following link: References: [1] N. Seriot, iphone Privacy, Black Hat DC 2010, USA, [2] W. Jansen and R. Ayers, Guidelines on Cell Phone Forensics, National Institute of Standards and Technology, May [3] A. Hoog and K. Strzempka, iphone and ios Forensics: Investigation, Analysis and Mobile Security for Apple iphone, ipad, and ios Devices, Elsevier Science Ltd, 2011, pp

11 [4] S. Morrissey, ios Forensic Analysis for iphone, ipad, and ipod touch, Springer- Verlag New York Inc, 2010, pp [5] J. Zdziarski, Hacking and Securing ios Applications: Stealing Data, Hijacking Software, and How to Prevent It, Oreilly & Associates Inc, 2012, pp [6] J. Zdziarski, iphone Forensics, Oreilly & Associates Inc, 2008, pp

Logical acquisition of iphone without Jail Breaking

Logical acquisition of iphone without Jail Breaking 2018 IJSRST Volume 4 Issue 9 Print ISSN : 2395-6011 Online ISSN : 2395-602X Themed Section: Science and Technology Logical acquisition of iphone without Jail Breaking Priyank Parmar 1, Dr. Ravi Sheth 2

More information

DATA RECOVERY FROM PROPRIETARY- FORMATTED CCTV HARD DISKS

DATA RECOVERY FROM PROPRIETARY- FORMATTED CCTV HARD DISKS Chapter 15 DATA RECOVERY FROM PROPRIETARY- FORMATTED CCTV HARD DISKS Aswami Ariffin, Jill Slay and Kim-Kwang Choo Abstract Digital video recorders (DVRs) for closed-circuit television (CCTV) commonly have

More information

OVERCOMING ios DATA PROTECTION TO RE-ENABLE

OVERCOMING ios DATA PROTECTION TO RE-ENABLE OVERCOMING ios DATA PROTECTION TO RE-ENABLE iphone FORENSICS ANDREY BELENKO CHIEF SECURITY RESEARCHER ELCOMSOFT CO. LTD Copyright (c) 2011 ElcomSoft Co.Ltd. CONTENTS Summary 3 iphone Forensics Before ios

More information

MOBILE DEVICE FORENSICS

MOBILE DEVICE FORENSICS MOBILE DEVICE FORENSICS Smart phones and other handheld electronics have become an important part of our everyday lives and the ever changing technology is making these devices a major source of digital

More information

Running Head: IPHONE FORENSICS 1. iphone Forensics Jaclyn Sottilaro Monica Figueroa-Santos Antonina Spinella Saint Leo University

Running Head: IPHONE FORENSICS 1. iphone Forensics Jaclyn Sottilaro Monica Figueroa-Santos Antonina Spinella Saint Leo University Running Head: IPHONE FORENSICS 1 iphone Forensics Jaclyn Sottilaro Monica Figueroa-Santos Antonina Spinella Saint Leo University IPHONE FORENSICS 2 Abstract With an ever-growing evolution on technology,

More information

OHLONE COLLEGE Ohlone Community College District OFFICIAL COURSE OUTLINE

OHLONE COLLEGE Ohlone Community College District OFFICIAL COURSE OUTLINE OHLONE COLLEGE Ohlone Community College District OFFICIAL COURSE OUTLINE I. Description of Course: 1. Department/Course: CNET - 174 2. Title: Computer Forensics 3. Cross Reference: 4. Units: 3 Lec Hrs:

More information

iphone Encryption, Apple, and The Feds David darthnull.org

iphone Encryption, Apple, and The Feds David darthnull.org iphone Encryption, Apple, and The Feds David Schuetz @DarthNull darthnull.org NoVA Hackers October 13, 2014 Background Apple s new privacy page, On devices running ios 8 : Apple cannot bypass your passcode

More information

Vendor: ECCouncil. Exam Code: EC Exam Name: Computer Hacking Forensic Investigator Exam. Version: Demo

Vendor: ECCouncil. Exam Code: EC Exam Name: Computer Hacking Forensic Investigator Exam. Version: Demo Vendor: ECCouncil Exam Code: EC1-349 Exam Name: Computer Hacking Forensic Investigator Exam Version: Demo QUESTION 1 What is the First Step required in preparing a computer for forensics investigation?

More information

Incident Response Data Acquisition Guidelines for Investigation Purposes 1

Incident Response Data Acquisition Guidelines for Investigation Purposes 1 Incident Response Data Acquisition Guidelines for Investigation Purposes 1 1 Target Audience This document is aimed at general IT staff that may be in the position of being required to take action in response

More information

DIGITAL FORENSICS FORENSICS FRAMEWORK FOR CLOUD COMPUTING

DIGITAL FORENSICS FORENSICS FRAMEWORK FOR CLOUD COMPUTING 17.09.24 DIGITAL FORENSICS FORENSICS FRAMEWORK FOR CLOUD COMPUTING FORENSICS FRAMEWORK FOR CLOUD COMPUTING OUTLINE Abstract Introduction Challenges in cloud forensics Proposed solution Conclusion Opinion

More information

SECURIMAG IOS DATA PROTECTION 1. Albin PETIT. Grenoble INP Ensimag. DRUNE (Sogeti) and Jean SIGWALD (ESEC)

SECURIMAG IOS DATA PROTECTION 1. Albin PETIT. Grenoble INP Ensimag. DRUNE (Sogeti) and Jean SIGWALD (ESEC) SECURIMAG IOS DATA PROTECTION 1 Albin PETIT firstname.name@ensimag.fr Grenoble INP Ensimag 1 inspired by the presentation : iphone data protection in depth by Jean-Baptiste BÉ- DRUNE (Sogeti) and Jean

More information

Guide to Computer Forensics and Investigations Fourth Edition. Chapter 2 Understanding Computer Investigations

Guide to Computer Forensics and Investigations Fourth Edition. Chapter 2 Understanding Computer Investigations Guide to Computer Forensics and Investigations Fourth Edition Chapter 2 Understanding Computer Investigations Objectives Explain how to prepare a computer investigation Apply a systematic approach to an

More information

Digital Forensics. Also known as. General definition: Computer forensics or network forensics

Digital Forensics. Also known as. General definition: Computer forensics or network forensics TEL2813/IS2621 Security Management James Joshi Associate Professor Lecture 3 Jan 29, 2014 Introduction ti to Digital Forensics Digital Forensics Also known as Computer forensics or network forensics General

More information

Forensic Analysis Approach Based on Metadata and Hash Values for Digital Objects in the Cloud

Forensic Analysis Approach Based on Metadata and Hash Values for Digital Objects in the Cloud Forensic Analysis Approach Based on Metadata and Hash Values for Digital Objects in the Cloud Ezz El-Din Hemdan 1, Manjaiah D.H 2 Research Scholar, Department of Computer Science, Mangalore University,

More information

Running head: MOBILE FORENSICS 1

Running head: MOBILE FORENSICS 1 Running head: MOBILE FORENSICS 1 Mobile Forensics Taylor Bauer, Jason Delaney, and Michael Lee COM-452-CA01 1 November 2018 MOBILE FORENSICS 2 Abstract Nowadays, many mobile devices have become a valuable

More information

Certified Digital Forensics Examiner

Certified Digital Forensics Examiner Certified Digital Forensics Examiner ACCREDITATIONS EXAM INFORMATION The Certified Digital Forensics Examiner exam is taken online through Mile2 s Assessment and Certification System ( MACS ), which is

More information

Matt Danner Flashback Data

Matt Danner Flashback Data Preservation Strategies and Data Collection from a Forensic Expert's Point of View Best practices on executing preservation and administering collection protocols with emphasis on forensically sound methods

More information

Certified Digital Forensics Examiner

Certified Digital Forensics Examiner Certified Digital Forensics Examiner Course Title: Certified Digital Forensics Examiner Duration: 5 days Class Format Options: Instructor-led classroom Live Online Training Prerequisites: A minimum of

More information

Getting the best digital evidence is what matters XRY extracts more data faster, with full integrity

Getting the best digital evidence is what matters XRY extracts more data faster, with full integrity Getting the best digital evidence is what matters XRY extracts more data faster, with full integrity Successful investigations rely on fast, high quality extraction of data from mobile phones. Without

More information

Lamine Aouad, Tahar Kechadi, Justin Trentesaux and Nhien-An Le-Khac

Lamine Aouad, Tahar Kechadi, Justin Trentesaux and Nhien-An Le-Khac Chapter 11 AN OPEN FRAMEWORK FOR SMARTPHONE EVIDENCE ACQUISITION Lamine Aouad, Tahar Kechadi, Justin Trentesaux and Nhien-An Le-Khac Abstract The forensic processes and procedures for performing a bit-for-bit

More information

ANALYSIS AND VALIDATION

ANALYSIS AND VALIDATION UNIT V ANALYSIS AND VALIDATION Validating Forensics Objectives Determine what data to analyze in a computer forensics investigation Explain tools used to validate data Explain common data-hiding techniques

More information

Advancements in SSD Forensics

Advancements in SSD Forensics Advancements in SSD Forensics Jeff Hedlesky, Guidance Software David Sun, S34A Chris Bross, DriveSavers www.encase.com/ceic www.s34a.com www.drivesavers.com Presentation Overview Introduction Background

More information

A forensically robust method for acquisition of icloud data. Kurt Oestreicher Champlain College

A forensically robust method for acquisition of icloud data. Kurt Oestreicher Champlain College A forensically robust method for acquisition of icloud data Kurt Oestreicher Champlain College Background Data stored on cloud services increasingly important to forensic investigations As of June 2013:

More information

Operating System Specification Mac OS X Snow Leopard (10.6.0) or higher and Windows XP (SP3) or higher

Operating System Specification Mac OS X Snow Leopard (10.6.0) or higher and Windows XP (SP3) or higher BlackLight is a multi-platform forensic analysis tool that allows examiners to quickly and intuitively analyze digital forensic media. BlackLight is capable of analyzing data from Mac OS X computers, ios

More information

When Recognition Matters WHITEPAPER CLFE CERTIFIED LEAD FORENSIC EXAMINER.

When Recognition Matters WHITEPAPER CLFE CERTIFIED LEAD FORENSIC EXAMINER. When Recognition Matters WHITEPAPER CLFE www.pecb.com CONTENT 3 4 5 6 6 7 7 8 8 Introduction So, what is Computer Forensics? Key domains of a CLFE How does a CLFE approach the investigation? What are the

More information

Digital Forensics Validation, Performance Verification And Quality Control Checks. Crime Scene/Digital and Multimedia Division

Digital Forensics Validation, Performance Verification And Quality Control Checks. Crime Scene/Digital and Multimedia Division Validation, Performance Verification And Quality Control Checks 5. VALIDATION, PERFORMANCE VERIFICATION AND QUALITY CONTROL CHECKS 5.1. Purpose 5.1.1. The purpose of this procedure is to establish guidelines

More information

Break em and Build em ios

Break em and Build em ios Break em and Build em ios SecAppDev 2016 Ken van Wyk, @KRvW Leuven, Belgium 7-11 March 2016 Ken van Wyk, ken@krvw.com, @KRvW Part I - Break em! 2 Biggest issue: lost/stolen device Anyone with physical

More information

FDE itc: Encryption Engine (EE) cpp Functional and Assurance Requirements

FDE itc: Encryption Engine (EE) cpp Functional and Assurance Requirements FDEiTC-EE-English-00 v0. 0-0- 0 0 FDE itc: Encryption Engine (EE) cpp Functional and Assurance Requirements BEV (Border Encryption Value) - the key(s) (or secret(s)) that is passed from the AA to the EE

More information

ios Forensics: Overcoming Data Protection

ios Forensics: Overcoming Data Protection ios Forensics: Overcoming Data Protection Best Practices for Acquiring Data from ios Devices Copyright 2015 NowSecure, Inc. All Rights Reserved. Andrey Belenko Sr. Security Engineer M. Sc. in Computer

More information

AccessData offers a broad array of training options.

AccessData offers a broad array of training options. Forensics Training AccessData offers a broad array of training options. Our trainers have more than two centuries of cumulative experience in their respective fields. Take Advantage of the All Access Pass

More information

Course 832 EC-Council Computer Hacking Forensic Investigator (CHFI)

Course 832 EC-Council Computer Hacking Forensic Investigator (CHFI) Course 832 EC-Council Computer Hacking Forensic Investigator (CHFI) Duration: 5 days You Will Learn How To Understand how perimeter defenses work Scan and attack you own networks, without actually harming

More information

How To Reset Locked Ipod Touch To Factory Settings Without Computer

How To Reset Locked Ipod Touch To Factory Settings Without Computer How To Reset Locked Ipod Touch To Factory Settings Without Computer Most settings, The date and time unless your ipod lost power and reset when Don't reset your ipod if you plugged it into your computer

More information

ECCouncil Computer Hacking Forensic Investigator (V8)

ECCouncil Computer Hacking Forensic Investigator (V8) ECCouncil 312-49v8 ECCouncil Computer Hacking Forensic Investigator (V8) Version: 9.0 QUESTION NO: 1 ECCouncil 312-49v8 Exam What is the First Step required in preparing a computer for forensics investigation?

More information

COMPUTER FORENSICS (CFRS)

COMPUTER FORENSICS (CFRS) Computer Forensics (CFRS) 1 COMPUTER FORENSICS (CFRS) 500 Level Courses CFRS 500: Introduction to Forensic Technology and Analysis. 3 credits. Presents an overview of technologies of interest to forensics

More information

Digital Cameras. An evaluation of the collection, preservation and evaluation of data collected from digital

Digital Cameras. An evaluation of the collection, preservation and evaluation of data collected from digital Ronald Prine CSC 589 - Digital Forensics New Mexico Institute of Mining and Technology October 17, 2006 Digital Cameras Executive Summary An evaluation of the collection, preservation and evaluation of

More information

Mobile Devices Villanova University Department of Computing Sciences D. Justin Price Spring 2014

Mobile Devices Villanova University Department of Computing Sciences D. Justin Price Spring 2014 Mobile Devices Villanova University Department of Computing Sciences D. Justin Price Spring 2014 INTRODUCTION The field of computer forensics has long been centered on traditional media like hard drives.

More information

SPECIAL ISSUE, PAPER ID: IJDCST-09 ISSN

SPECIAL ISSUE, PAPER ID: IJDCST-09 ISSN Digital Forensics CH. RAMESH BABU, Asst.Proffessor, Dept. Of MCA, K.B.N.College, Vijayawada Abstract: The need for computer intrusion forensics arises from the alarming increase in the number of computer

More information

COMPUTER HACKING Forensic Investigator

COMPUTER HACKING Forensic Investigator COMPUTER HACKING Forensic Investigator H.H. Sheik Sultan Tower (0) Floor Corniche Street Abu Dhabi U.A.E www.ictd.ae ictd@ictd.ae Course Introduction: CHFIv8 presents a detailed methodological approach

More information

Sentient Storage: Do SSDs have a mind of their own? Tom Kopchak

Sentient Storage: Do SSDs have a mind of their own? Tom Kopchak Sentient Storage: Do SSDs have a mind of their own? Tom Kopchak :: @tomkopchak About me Why we're here Current forensic practices for working with hard drives are well-defined Solid state drives behave

More information

Digital Forensics Mobile Device Data Extraction. Crime Scene/Digital and Multimedia Division

Digital Forensics Mobile Device Data Extraction. Crime Scene/Digital and Multimedia Division Mobile Device Data Extraction 12. MOBILE DEVICE DATA EXTRACTION PROCEDURE 12.1. Purpose 12.1.1. The purpose of this procedure is to extract data from mobile devices and/or removable media utilizing the

More information

Getting the best digital evidence is what matters XRY extracts more data faster, with full integrity

Getting the best digital evidence is what matters XRY extracts more data faster, with full integrity Getting the best digital evidence is what matters XRY extracts more data faster, with full integrity Successful investigations rely on fast, high quality extraction of data from mobile phones. Without

More information

A Formal Logic for Digital Investigations: A Case Study Using BPB Modifications.

A Formal Logic for Digital Investigations: A Case Study Using BPB Modifications. A Formal Logic for Digital Investigations: A Case Study Using BPB Modifications. Abstract I. Mitchell Middlesex University, UK A Formal Logic is developed and the following presented: i) Notation for Formal

More information

Forensics for Cybersecurity. Pete Dedes, CCE, GCFA, GCIH

Forensics for Cybersecurity. Pete Dedes, CCE, GCFA, GCIH Forensics for Cybersecurity Pete Dedes, CCE, GCFA, GCIH WHO AM I? Pete Dedes, Forensics Analyst, Sword & Shield Enterprise Security Education Bachelor s of Science Computer Science, University of Tennessee

More information

Digital Forensics UiO

Digital Forensics UiO Digital Forensics UiO About Me I am: Eivind Utnes, M.Sc. I work for: Watchcom Security Group AS I work as: Information Security Consultant Security Audits Digital Forensics / Incident Response Education

More information

ios Forensics with Open-Source Tools Andrey Belenko

ios Forensics with Open-Source Tools Andrey Belenko ios Forensics with Open-Source Tools Andrey Belenko AGENDA Basics ios Security ios Data Protection Hands-On! FORENSICS 101 Acquisition Analysis Reporting GOALS: 1. Assuming physical access to the device

More information

Applications for Preservation and Production in our Digital World

Applications for Preservation and Production in our Digital World Applications for Preservation and Production in our Digital World Gavin W. Manes, Ph.D. President, Digital Forensics Professionals, Inc. Research Assistant Professor, The University of Tulsa Background

More information

Putting It (almost) all Together: ios Security. Konstantin Beznosov

Putting It (almost) all Together: ios Security. Konstantin Beznosov Putting It (almost) all Together: ios Security Konstantin Beznosov BSD based OS Chain of trust during boot Secure Enclave Effaceable Storage (Secure deletion) Touch Id (Usable authentication) Per file

More information

Digital Forensics UiO. Digital Forensics in Incident Management. About Me. Outline. Incident Management. Finding Evidence.

Digital Forensics UiO. Digital Forensics in Incident Management. About Me. Outline. Incident Management. Finding Evidence. Digital Forensics UiO Outline Incident Management Digital Forensics Finding Evidence 3 About Me I am: Eivind Utnes, M.Sc. I work for: Watchcom Security Group AS I work as: Information Security Consultant

More information

Progressive Authentication in ios

Progressive Authentication in ios Progressive Authentication in ios Genghis Chau, Denis Plotnikov, Edwin Zhang December 12 th, 2014 1 Overview In today s increasingly mobile-centric world, more people are beginning to use their smartphones

More information

Digital Forensics Lecture 01- Disk Forensics

Digital Forensics Lecture 01- Disk Forensics Digital Forensics Lecture 01- Disk Forensics An Introduction to Akbar S. Namin Texas Tech University Spring 2017 Digital Investigations and Evidence Investigation of some type of digital device that has

More information

COMPUTER HACKING FORENSIC INVESTIGATOR (CHFI) V9

COMPUTER HACKING FORENSIC INVESTIGATOR (CHFI) V9 COMPUTER HACKING FORENSIC INVESTIGATOR (CHFI) V9 Course Code: 3401 Prepare for the CHFI certification while learning advanced forensics investigation techniques. EC-Council released the most advanced computer

More information

MOBILedit Forensic Express

MOBILedit Forensic Express MOBILedit Forensic Express All-in-one phone forensic tool from pioneers in the field MOBILedit Forensic Express is a phone and cloud extractor, data analyzer and report generator all in one solution. A

More information

Exam Number/Code: Exam Name: Computer Hacking. Version: Demo. Forensic Investigator.

Exam Number/Code: Exam Name: Computer Hacking. Version: Demo. Forensic Investigator. Exam Number/Code:312-49 Exam Name: Computer Hacking Forensic Investigator Version: Demo http://www.it-exams.com QUESTION NO: 1 When an investigator contacts by telephone the domain administrator or controller

More information

DIGITAL EVIDENCE TOOL BOX

DIGITAL EVIDENCE TOOL BOX DIGITAL EVIDENCE TOOL BOX Toolbox Page 1 of 23 Introduction This guide is meant to provide a basic understanding of the industry standards, best practices and practical applications for the use of digital

More information

Chapter Two File Systems. CIS 4000 Intro. to Forensic Computing David McDonald, Ph.D.

Chapter Two File Systems. CIS 4000 Intro. to Forensic Computing David McDonald, Ph.D. Chapter Two File Systems CIS 4000 Intro. to Forensic Computing David McDonald, Ph.D. 1 Learning Objectives At the end of this section, you will be able to: Explain the purpose and structure of file systems

More information

10 th National Investigations Symposium

10 th National Investigations Symposium 10 th National Investigations Symposium AVOIDING FORENSIC PITFALLS First Responders Guide to Preserving Electronic Evidence 6 November 2014 Bronwyn Barker Electronic Evidence Specialist Investigation 5

More information

Preventing Corporate Espionage: Investigations, Data Analyses and Business Intelligence

Preventing Corporate Espionage: Investigations, Data Analyses and Business Intelligence Preventing Corporate Espionage: Investigations, Data Analyses and Business Intelligence Presented by Keith Barger and Audra A. Dial March 19, 2014 2014 Kilpatrick Townsend & Stockton LLP Protection of

More information

Cellebrite Digital Forensics for Legal Professionals (CDFL)

Cellebrite Digital Forensics for Legal Professionals (CDFL) Global forensic training Course description Level Intermediate Length Two days (14 hours) Training Track Investigative The two-day Cellebrite Digital Forensics for Legal Professionals course is designed

More information

Windows Forensics Advanced

Windows Forensics Advanced Windows Forensics Advanced Index: CF102 Description Windows Forensics - Advanced is the next step for forensics specialists, diving deeper into diverse processes on Windows OS serving computer investigators.

More information

Computer Information Systems (CIS) CIS 105 Current Operating Systems/Security CIS 101 Introduction to Computers

Computer Information Systems (CIS) CIS 105 Current Operating Systems/Security CIS 101 Introduction to Computers Computer Information Systems (CIS) CIS 101 Introduction to Computers This course provides an overview of the computing field and its typical applications. Key terminology and components of computer hardware,

More information

Digital Forensics UiO

Digital Forensics UiO Digital Forensics UiO About Me I am: Eivind Utnes, M.Sc. I work for: Watchcom Security Group AS I work as: Head of Security Senior Information Security Consultant Security Audits Digital Forensics / Incident

More information

Cyber Attack Investigative Tools and Technologies

Cyber Attack Investigative Tools and Technologies HTCIA Silicon Valley 7 May 2003 Cyber Attack Investigative Tools and Technologies Kevin O Shea Technical Analysis Group Institute for Security Technology Studies at Dartmouth College Hanover, NH For more

More information

The UNIX file system! A gentle introduction"

The UNIX file system! A gentle introduction ISA 785 Research in Digital Forensics The UNIX file system! A gentle introduction" ISA 785! Angelos Stavrou, George Mason University! File System Basics 2! Readings from the Textbook! Unix / EXT3! FAT/NTFS!

More information

ON THE SELECTION OF WRITE BLOCKERS FOR DISK ACQUISITION: A COMPARATIVE PRACTICAL STUDY

ON THE SELECTION OF WRITE BLOCKERS FOR DISK ACQUISITION: A COMPARATIVE PRACTICAL STUDY ON THE SELECTION OF WRITE BLOCKERS FOR DISK ACQUISITION: A COMPARATIVE PRACTICAL STUDY Mousa Al Falayleh College of Computer Info. Tech. American University in the Emirates Dubai, United Arab Emirates

More information

Digital Forensics UiO

Digital Forensics UiO About Me I am: Eivind Utnes, M.Sc. I work for: Watchcom Security Group AS Digital Forensics UiO I work as: Head of Security Senior Information Security Consultant Security Audits Digital Forensics / Incident

More information

Digital Forensics Lecture 02- Disk Forensics

Digital Forensics Lecture 02- Disk Forensics Digital Forensics Lecture 02- Disk Forensics Hard Disk Data Acquisition Akbar S. Namin Texas Tech University Spring 2017 Analysis of data found on a storage device It is more common to do dead analysis

More information

A Road Map for Digital Forensic Research

A Road Map for Digital Forensic Research 1 Outline of Today s Lecture! A Road Map for Digital Forensic Research o Report from the 1 st Digital Forensic Research Workshop (DFRWS) 2001! Defining Digital Forensic Examination and Analysis Tools o

More information

The UNIX file system! A gentle introduction"

The UNIX file system! A gentle introduction ISA 785 Research in Digital Forensics The UNIX file system! A gentle introduction" ISA 785! Angelos Stavrou, George Mason University! File System Basics 2! Readings from the Textbook! Unix / EXT3! FAT/NTFS!

More information

Trends in Mobile Forensics from Cellebrite

Trends in Mobile Forensics from Cellebrite Trends in Mobile Forensics from Cellebrite EBOOK 1 Cellebrite Survey Cellebrite is a well-known name in the field of computer forensics, and they recently conducted a survey as well as interviews with

More information

C HFI C HFI. EC-Council. EC-Council. Computer Hacking Forensic Investigator. Computer. Computer. Hacking Forensic INVESTIGATOR

C HFI C HFI. EC-Council. EC-Council. Computer Hacking Forensic Investigator. Computer. Computer. Hacking Forensic INVESTIGATOR Page: 1 TM C HFI Computer C HFI Computer Hacking Forensic INVESTIGATOR Hacking Forensic INVESTIGATOR TM v8 v8 Page: 2 Be the leader. Deserve a place in the CHFI certified elite class. Earn cutting edge

More information

CLOUD FORENSICS : AN OVERVIEW. Kumiko Ogawa

CLOUD FORENSICS : AN OVERVIEW. Kumiko Ogawa CLOUD FORENSICS : AN OVERVIEW Kumiko Ogawa What is Cloud Forensics Forensic Science - Application of science to the criminal and civil laws that are enforced by police agencies in a criminal justice system.

More information

How Do I Restore My Ipod Touch To Factory Settings While Its Locked

How Do I Restore My Ipod Touch To Factory Settings While Its Locked How Do I Restore My Ipod Touch To Factory Settings While Its Locked Learn how to reset your ipod if it doesn't respond when you press the buttons. Don't reset your ipod if you plugged it into your computer

More information

Source: https://articles.forensicfocus.com/2018/03/02/evidence-acquisition-using-accessdata-ftk-imager/

Source: https://articles.forensicfocus.com/2018/03/02/evidence-acquisition-using-accessdata-ftk-imager/ by Chirath De Alwis Source: https://articles.forensicfocus.com/2018/03/02/evidence-acquisition-using-accessdata-ftk-imager/ Forensic Toolkit or FTK is a computer forensics software product made by AccessData.

More information

Security+ Guide to Network Security Fundamentals, Third Edition. Chapter 11 Basic Cryptography

Security+ Guide to Network Security Fundamentals, Third Edition. Chapter 11 Basic Cryptography Security+ Guide to Network Security Fundamentals, Third Edition Chapter 11 Basic Cryptography Objectives Define cryptography Describe hashing List the basic symmetric cryptographic algorithms 2 Objectives

More information

Scientific Working Group on Digital Evidence

Scientific Working Group on Digital Evidence SWGDE Best Practices for Mobile Device Evidence Collection & Preservation, The version of this document is in draft form and is being provided for comment by all interested parties for a minimum period

More information

Computer forensics Aiman Al-Refaei

Computer forensics Aiman Al-Refaei Computer forensics Aiman Al-Refaei 29.08.2006 Computer forensics 1 Computer forensics Definitions: Forensics - The use of science and technology to investigate and establish facts in criminal or civil

More information

New Model for Cyber Crime Investigation Procedure

New Model for Cyber Crime Investigation Procedure New Model for Cyber Crime Investigation Procedure * *Dept. of IT & Cyber Police, Youngdong University, Rep. of Korea ydshin@youngdong.ac.kr doi:10.4156/jnit.vol2.issue2.1 Abstract In this paper, we presented

More information

Ipod Touch Password Manual Guide Ios 6. Software >>>CLICK HERE<<<

Ipod Touch Password Manual Guide Ios 6. Software >>>CLICK HERE<<< Ipod Touch Password Manual Guide Ios 6 Software You can turn on Restrictions, also known as parental controls, on your ios device to Apple Store Mac iphone Watch ipad ipod itunes Support You'll need this

More information

Computer Forensics: Investigating Data and Image Files, 2nd Edition. Chapter 3 Forensic Investigations Using EnCase

Computer Forensics: Investigating Data and Image Files, 2nd Edition. Chapter 3 Forensic Investigations Using EnCase Computer Forensics: Investigating Data and Image Files, 2nd Edition Chapter 3 Forensic Investigations Using EnCase Objectives After completing this chapter, you should be able to: Understand evidence files

More information

4MMSR-Network Security Student Seminar. iphone data protection in depth

4MMSR-Network Security Student Seminar. iphone data protection in depth 4MMSR-Network Security 2011-2012 Student Seminar iphone data protection in depth jean-baptiste.bedrune(at)sogeti.com jean.sigwald(at)sogeti.com Albin PETIT & Marion ROCARIES firstname.name@ensimag.fr Ensimag

More information

A revolutionary visual security and analytics solution

A revolutionary visual security and analytics solution A revolutionary visual security and analytics solution Vodafone Digital Buildings vodafone.com/iot/security The future is exciting. Ready? It s time to take visual surveillance to the next level Increasing

More information

VALLIAMMAI ENGINEERING COLLEGE SRM Nagar, Kattankulathur

VALLIAMMAI ENGINEERING COLLEGE SRM Nagar, Kattankulathur VALLIAMMAI ENGINEERING COLLEGE SRM Nagar, Kattankulathur 603 203. DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING QUESTION BANK VII SEMESTER CS 6004 CYBER FORENSICS Regulation 2013 Academic Year 2017 2018

More information

Tilak Maharashtra University Bachelor of Computer Applications (BCA) Third Year BCA 621- Project. Examination 1

Tilak Maharashtra University Bachelor of Computer Applications (BCA) Third Year BCA 621- Project. Examination 1 Tilak Maharashtra University Bachelor of Computer Applications (BCA) Third Year BCA 621- Project BCA 622 Unified Modeling Language (UML) 1. Getting started 1.1. Models 1.1.1. Importance of modeling 1.1.2.

More information

Chapter 4 After Incident Detection

Chapter 4 After Incident Detection Chapter 4 After Incident Detection Ed Crowley Spring 10 1 Topics Incident Response Process SANs Six Step IR Process 1. Preparation 2. Identification 3. Containment 4. Eradication 5. Recovery 6. Lessons

More information

Digital Forensics for Attorneys

Digital Forensics for Attorneys Lars E. Daniel, EnCE, ACE, AME, CTNS Digital Forensics Examiner Digital Forensics for Attorneys Overview of Digital Forensics Digital Forensics For Attorneys Overview of Digital Forensics Types of Digital

More information

Product Questions: 486 Version: 12.0

Product Questions: 486 Version: 12.0 Vendor: Eccouncil Exam Code: 312-49 Exam Name: Computer Hacking Forensic Investigator Exam v9 Version: DEMO Question: 1 Product Questions: 486 Version: 12.0 This organization maintains a database of hash

More information

Hashing Techniques for Mobile Device Forensics

Hashing Techniques for Mobile Device Forensics SMALL SCALE DIGITAL DEVICE FORENSICS JOURNAL, VOL. 3, NO. 1, JUNE 2009 ISSN# 1941-6164 1 Hashing Techniques for Mobile Device Forensics Shira Danker Rick Ayers Richard P. Mislan Abstract- Previous research

More information

How the Leopard hides his Spots. OS X Anti-Forensics

How the Leopard hides his Spots. OS X Anti-Forensics How the Leopard hides his Spots OS X Anti-Forensics the.grugq@gmail.com Introduction Strategies Tactics Conclusion Overview Introduction the grugq Independent security researcher

More information

Scientific Working Group on Digital Evidence

Scientific Working Group on Digital Evidence Disclaimer: As a condition to the use of this document and the information contained therein, the SWGDE requests notification by e-mail before or contemporaneous to the introduction of this document, or

More information

Forensics on the Windows Platform, Part Two by Jamie Morris last updated February 11, 2003

Forensics on the Windows Platform, Part Two by Jamie Morris last updated February 11, 2003 SecurityFocus HOME Infocus: Forensics on the Windows Platform, Part Two 2003-02-17 12:56:05-0900 SFOnline Forensics on the Windows Platform, Part Two by Jamie Morris last updated February 11, 2003 Introduction

More information

Checklist for Rule 16(c) Pretrial Conference for Computer-Based Discovery

Checklist for Rule 16(c) Pretrial Conference for Computer-Based Discovery Checklist for Rule 16(c) Pretrial Conference for Computer-Based Discovery To aid and advance the ability for a litigation to successfully employ computer-based discovery, Rule 16(c) of the Federal Rules

More information

CE4024 and CZ 4024 Cryptography and Network Security

CE4024 and CZ 4024 Cryptography and Network Security CE4024 and CZ 4024 Cryptography and Network Security Academic s AY1819 Semester 2 CE/CZ4024 Cryptography and Network Security CE3005 Computer Networks OR CZ3006 Net Centric Computing Lectures 26 TEL Tutorials

More information

THINGS YOU NEED TO KNOW BEFORE DELVING INTO THE WORLD OF DIGITAL EVIDENCE. Roland Bastin Partner Risk Advisory Deloitte

THINGS YOU NEED TO KNOW BEFORE DELVING INTO THE WORLD OF DIGITAL EVIDENCE. Roland Bastin Partner Risk Advisory Deloitte Inside magazine issue 16 Part 03 - From a risk and cyber perspective perspective Roland Bastin Partner Risk Advisory Deloitte Gunnar Mortier Senior Manager Risk Advisory Deloitte THINGS YOU NEED TO KNOW

More information

Unification of Digital Evidence from Disparate Sources (Digital Evidence Bags)

Unification of Digital Evidence from Disparate Sources (Digital Evidence Bags) Unification of Digital Evidence from Disparate Sources (Digital Evidence Bags) Philip Turner QinetiQ, Digital Investigation Services, Trusted Information Management Department, St. Andrews Road, Malvern,

More information

IDENTIFYING VOLATILE DATA FROM MULTIPLE MEMORY DUMPS IN LIVE FORENSICS

IDENTIFYING VOLATILE DATA FROM MULTIPLE MEMORY DUMPS IN LIVE FORENSICS Chapter 13 IDENTIFYING VOLATILE DATA FROM MULTIPLE MEMORY DUMPS IN LIVE FORENSICS Frank Law, Patrick Chan, Siu-Ming Yiu, Benjamin Tang, Pierre Lai, Kam-Pui Chow, Ricci Ieong, Michael Kwan, Wing-Kai Hon

More information

WHITE PAPER. Data Erasure for Enterprise SSD: Believe It and Achieve It

WHITE PAPER. Data Erasure for Enterprise SSD: Believe It and Achieve It WHITE PAPER Data Erasure for Enterprise SSD: Believe It and Achieve It Solid state drives possess traits that make end of life data erasure absolutely necessary. But SSD data erasure also presents unique

More information

KillTest 䊾 䞣 催 ࢭ ད ᅌ㖦䊛 ᅌ㖦䊛 NZZV ]]] QORRZKYZ TKZ ϔᑈܡ䊏 ᮄ ࢭ

KillTest 䊾 䞣 催 ࢭ ད ᅌ㖦䊛 ᅌ㖦䊛 NZZV ]]] QORRZKYZ TKZ ϔᑈܡ䊏 ᮄ ࢭ KillTest Exam : 312-49v8 Title : ECCouncil Computer Hacking Forensic Investigator (V8) Version : Demo 1 / 6 1.What is the First Step required in preparing a computer for forensics investigation? A. Do

More information

NIST SP Notes Guide to Integrating Forensic Techniques into Incident Response

NIST SP Notes Guide to Integrating Forensic Techniques into Incident Response NIST SP800-86 Notes Guide to Integrating Forensic Techniques into Incident Response Authors: Karen Kent, Suzanne Chevalier, Tim Grance, Hung Dang, August 2006 Computer Forensics The application of science

More information

Computer Forensics US-CERT

Computer Forensics US-CERT Computer Forensics US-CERT Overview This paper will discuss the need for computer forensics to be practiced in an effective and legal way, outline basic technical issues, and point to references for further

More information

Financial CISM. Certified Information Security Manager (CISM) Download Full Version :

Financial CISM. Certified Information Security Manager (CISM) Download Full Version : Financial CISM Certified Information Security Manager (CISM) Download Full Version : http://killexams.com/pass4sure/exam-detail/cism required based on preliminary forensic investigation, but doing so as

More information