A forensically robust method for acquisition of icloud data. Kurt Oestreicher Champlain College

Transcription

1 A forensically robust method for acquisition of icloud data Kurt Oestreicher Champlain College

2 Background Data stored on cloud services increasingly important to forensic investigations As of June 2013: 320 million user accounts 900 billion imessages 125 billion photo uploads (Kahn, 2013) With introduction of OS X 10.9 Mavericks, Apple continues to expand the capabilities of its cloud service

3 icloud Offerings Synchronization of contacts, calendars, , notes, and reminders across devices as well as access the data through the icloud.com web interface. Backups of devices to icloud, including music, apps, books, Camera Roll (photos and videos), device settings, and app data. iwork documents can be stored in icloud and pushed to all devices. These documents can now be edited through the icloud.com web interface. Third party developers that utilize the icloud Storage API can allow files from their applications to be stored in icloud If enabled, Photostream can automatically upload up to 1,000 photos from the user s device for storage and synchronization across platforms

4 Related Research Recent research examined retrieval of files and metadata stored on cloud services of Dropbox, Google Drive, and Microsoft SkyDrive. Results of this research indicated that, while MD5 values remained unchanged, the timestamp metadata was unreliable (Quick and Choo, 2013).

5 Research Problem: Create a forensically robust method for acquisition of icloud data Method needs to be developed to download icloud data to examination computer Integrity of acquired data must be verified icloud and Mavericks updates changed many of the data structures and locations in the file system.

6 Research Questions Where are the icloud- synched files located on the operating system? Are the files downloaded during the acquisition process identical to the original files? Are the MD5 hash values identical? If the values are different, compare the two files to attempt to establish what has changed. Has the timestamp metadata been changed? If the metadata has been changed is it forensically significant?

7 Legal Considerations Apple s data storage centers are located in multiple jurisdictions, creating complications for investigators seeking authorization to access this data. This research does not address these concerns and the assumption is made that all legal and jurisdictional authorities have been obtained prior to accessing cloud data.

8 Methodology VMWare Fusion used to create two identical virtual machines representing subject computer and examination computer. Clean install of Mac OS X 10.9 along with iphoto, Pages, Numbers, and Keynote applications. New icloud account established, new icloud data created on subject machine and synched with service. Snapshots taken at various times to locate icloud artifacts on OS. Examination virtual machine used to synch newly created content.

9 Application Data Examined Pre- installed Contacts Mail Calendar Reminders Non Pre- installed iphoto Pages Numbers Keynote Safari

10 VM Configuration Subject Examination

11 Initial Data Load Application Contacts v.8.0 (1365) Mail v.7.0 (1822) Calendar v.7.0 (1835) Reminders v.2.0 (187) Safari v.7.0 ( ) iphoto v (902.17) Pages v (1478) Numbers v (1483) Keynote v (1486) Action New contact created with name and phone number New created, addressed to sender, and sent New event created New reminder created Safari web browser opened, typed URL: publicdomanpictures.net entered, page bookmarked, right- click on photo and saved to iphoto. Automatically opened from Safari, downloaded picture selected and dragged to Photo Stream menu item. New Pages document created and saved to icloud New Numbers document created and saved to icloud New Keynote document created and saved to icloud.

12 Data Collection Since live acquisition, virtual machine window was video recorded using screen capture software: Voila v.3.6 Exam machine started, snapshot taken Exam machine logged into icloud Some apps do not synch until opened so each application was opened and data allowed to synch. Virtual machine shutdown and snapshot taken.

13 Locate Artifacts VisualDiffer v used to take two volumes and compare based on file timestamps and sizes to determine changes between snapshots. Problem: VMWare Fusion snapshots stored as.vmdk. VisualDiffer requires images to be mounted.

14 Mounting the Snapshots FTK Imager used to create RAW image from.vmdk After RAW file created, extension changed to.dmg so image could be mounted..dmg made read- only: Right- click on file Select Get Info Check the Locked option.

15 Snapshots Compared

16 Keynote Other

17 Application Data File Paths Application Contacts Mail Calendar Reminders Safari iphoto Pages Numbers Keynote Data File Path /Users/user/Library/Application Support/AddressBook/Sources/ /Users/user/Library/Mail/ /Users/user/Library/Calendars/ /Users/user/Library/Calendars/ /Users/user/Library/Safari/ /Users/user/Pictures/iPhoto Library.photolibrary/ /Users/user/Library/Mobile Documents/com~apple~Pages/Documents/ /Users/user/Library/Mobile Documents/com~apple~Numbers/ /Users/user/Library/Mobile Documents/com~apple~Keynote/

18 A n a l y s i s Color Key

19 Non- preinstalled Application MD5

20 Pre- installed Application MD5

21 Non- preinstalled Application Timestamp Analysis Application Version Created Accessed Modified iphoto Original 3:42:47 PM Acquired 3:42:47 PM Pages Original 3:44:20 PM Acquired 3:44:20 PM Numbers Original 3:45:00 PM Acquired 3:45:00 PM Keynote Original 3:45:41 PM Acquired 3:45:42 PM 3:42:47 PM 3:52:48 PM 3:44:22 PM 3:44:20 PM 3:45:03 PM 3:45:00 PM 3:45:45 PM 3:45:42 PM 3:42:47 PM 3:42:47 PM 3:44:20 PM 3:44:20 PM 3:45:00 PM 3:45:00 PM 3:45:42 PM 3:45:42 PM

22 Conclusions Same workflow can be used to identify artifacts in future versions of OS X or icloud (i.e. Yosemite). Video recording of live acquisition essential to meeting the documentation requirement. Non- preinstalled application data: MD5 hash and timestamps establish data integrity Forensically Sound Pre- installed application data requires more study. Textual content of the documents were unchanged. Differing MD5 values may present a challenge when attempting to satisfy courts of data integrity.

23 Further Work Research was limited to Mac OS X 10.9 synch with icloud Do same results occur between different Mac computer models or different versions of OS X? Effect of icloud synchronization with ios devices (iphone, ipad, ipod Touch) What is causing the MD5 values to differ for certain files? Why do some timestamps differ by 1-3 seconds?

24 Questions?