Investigation of Non-traditional Equipment: Autos, Washers,

Transcription

1 Investigation of Non-traditional Equipment: Autos, Washers, By: Ryan Ware Digital Forensics October 17, 2006

2 Executive Summary: Traditional digital forensics investigations usually involve the retrieval and examination of information from personal computers, mass storage devices such as tape drives and USB drives, and network related devices. So, most investigators will encounter cases in which information most relevant information is provided by those traditional devices. However, cases do arise and will arise in which traditional equipment does not provide sufficient evidence. Thus, the investigator may need to search for non-traditional sources of digital evidence. However, there are many potential sources most of which would not normally be thought of as an actual source of information. Also, for many of these devices, there do not exist any tools, policies, or procedures that will aide with the extraction of useful evidence from the devices. Research and work must be done to provide tools and policies for the extraction of digital evidence from nontraditional equipment.

3 Digital Forensics Problem: With the development of new and improved technology these days, the of use electronic equipment continues to grow. As everyone knows, personal computers are becoming better and better allowing criminals to use them with greater success in their illegal actions. These developments cause a significant problem for digital forensics investigators who not only have to keep up-to-date with new technology but must also become very familiar with both new and old forensics techniques. To complicate things further, personal computers are not the only source of digital evidence. In fact, there are so many potential sources that most people, even digital forensics investigators, do not often think of these non-traditional electronic equipment as sources of evidence. Since these sources often go unnoticed, some useful evidence may be missed entirely. Sources of Non-Traditional Forensics Evidence: Embedded systems probably present the widest variety of potential digital evidence. These embedded systems may be found almost anywhere. The most visible and well-known form of embedded systems are cell phones and hand-held devices such as PDAs. However, there are many more sources of digital evidence. Some other known sources include: printers, fax machines, copiers, scanners, and cameras. There are even more devices that people do not often think of as evidence providers. These machines may include: digital watches, global positioning systems (GPS), VCRs, answering machines, game consoles, automobiles, and common household appliances such as dish washers. Thankfully, most people, even criminals, do not often use these non-traditional storage devices to store information other than what was intended to be stored on those devices. So, this means that

4 most investigators will only deal with traditional devices such as personal computers. Unfortunately, this means that, when faced with some non-traditional devices as potential evidence, most digital forensics investigators will either be unable to properly extract the important information or not even consider the device as an important source of information. Also, this means that very few tools, policies, and procedures have been developed to extract information from these non-traditional sources of evidence. While these non-traditional devices do not always provide useful digital evidence, they must not be overlooked. These devices may provide important evidence that can make or break a case that did not have sufficient evidence based on evidence gather via traditional means. The information provided by these devices may often be untouched by the criminal because many people often overlook these devices. They may provide a time line, phone numbers, calendars, appointments, contact information, voice recordings, or even visual recordings. Most of these non-conventional sources of evidence will even store information about someone or something without that person's knowledge. Since these machines may provide useful information, investigators must keep these appliances in mind and understand most of their capabilities and the information that may be stored on them. Recently, several non-traditional devices have gained publicity on their potential for either criminal purposes or source of digital evidence for investigators. Some computer systems on newer automobiles have shown some significant potential for criminal exploitation. Game consoles have also been used to store some important information, and new appliances such as dish washers may possess some potential for exploitation.

5 Automobiles: Recently, more automobiles have been created with two rather interesting features. One feature involves the use of bluetooth devices to allow cell phones and other devices with bluetooth capabilities to interact with the car. The second feature is a marked increase in electronic equipment and software to allow for easier use of the car. Both of these increase the customer's comfort. However, they also increase potential for exploitation by a not so welcome person. The increased use of software and electronic equipment in newer cars has provided extra comfort and, to some degree, extra security. However, increased complexity within a system allows for more potential exploits. For example, the increased use of software and bluetooth devices makes some new cars vulnerable to viruses. According to Kaspersky Labs, a Russian anti-virus firm, Lexus vehicles and possibly other vehicles have the potential to be infected by viruses. These viruses may be introduced by infected cell phones on cars with operating systems similar to cell phone operating systems. The viruses may affect the navigation systems, security systems, or other electronic systems within a car [1]. Further, some automobiles with keyless entry and keyless ignition have been broken into wirelessly. Apparently, the security in these systems are not very strong due to the fact that they use embedded systems and, therefore, do not have the capability to utilize some of the stronger encryption algorithms and other security features [4]. If any of these automobile features were exploited in a crime, a digital forensics investigator must be able to retrieve any relevant information from any technology involved. There are currently several tools that can retrieve information from cell phones. One such tool is called Paraben's Device Seizure and is produced by Paraben Corporation. It supports hundreds of models of cell phones and PDAs [5]. Also, there are some ways to retrieve information from some

6 automobiles. For example, some cars store the status of the car several seconds before an impact. This information helped with the conviction of a man for vehicular manslaughter because it showed that he was going 104 miles per hour prior to the collision [2]. However, this information retrieval seems primarily focused on the physical status of the car instead of the electrical system and do not appear to be commercially available. Game Consoles: While game consoles do act like computers, most people may just pass over them when thinking about finding sources of digital evidence. For the most part, these consoles are used purely for gaming purposes. However, there are a few examples to the contrary. One example involves the use of an Xbox console. Some people have found a way to hack Xbox consoles such that they can install Linux onto the hard drive. Thus, the Xbox can be used almost exactly like a computer while still looking like a simple game console. A hacked Xbox can be used to hide important information that one would normally look for on a personal computer. Thus, a digital forensics investigator must know to look for game consoles and other similar devices that may have been modified to hide important information. Another example comes from a rather old game console, the Commodore 64. While this can be used as a personal computer, the Commodore 64 is most known for it being used as a game console. Also, this console was first introduced in 1982 and lost popularity in the early 1990's. So, most people neither have a Commodore 64 nor know how to operate one. This created a significant problem for Austrian police who discovered a Commodore 64 at a crime scene of a kidnapping. The police said that it would be difficult to properly transfer the evidence from the Commodore 64 to an investigation machine to be analyzed [3]. This shows a significant lack in software, procedures, and techniques to retrieve information from non-traditional digital evidence devices.

7 Household Appliances: As mentioned earlier, the use of better technology in household appliances has grown considerably in the last few decades. One example of this can be seen in the development of dish washers. They started out as rather primitive and rarely seen machines. Now they are high-tech and can be seen in almost every modern home. The dish washers have become so advanced that some washers can be connected to a printer or computer to display the status of the dish washer [6]. While these dish washers might not present a great potential for digital evidence, the trend of dish washers and other appliances portends an even greater potential in the very near future. Some people are speculating that household appliances will become so advanced that they will be connected to a network and notify the manufacturer when a part needs to be replaced. Digital forensics investigators must watch these appliances for they may start playing a significant role in digital forensics in the near future. Tools: There appear to be only a few tools with regards to extracting digital evidence from nontraditional equipment. As mentioned above, tools exist that gather information from most, if not all, types of cell phones and other hand held devices. There are also tools that gather some information from automobiles, but these tools do not seem to be publicly available. Beyond these tools, there are hardly any tools or even policies and procedures with regards to extracting data from other non-traditional digital devices. Future Research: Research in the field of extracting and examining digital evidence from non-traditional devices such as automobiles seems to be lacking significantly. Thus, more research must be done in this

8 field. There are two main avenues of research or study. One would be the continual examination of new devices. Digital forensics investigators must know what these new devices are capable of doing and how to extract evidence from these machines. Second, both current and old technologies must be examined more closely. If the Austrian police had more information about the Commodore 64 in a database, they might have been able to better extract and examine the evidence that existed on the console. While it would be unreasonable and unfeasible for digital forensics investigators to be experts on each device capable of providing digital evidence, databases must be built that will store information concerning the procedures necessary to extract information from most devices. Conclusion: While most digital forensics investigations involve only personal computers, the rapid development of other technologies must not go unnoticed by investigators. These non-traditional devices possess the potential contain information that may help solve an investigation. The problem with these devices is that there are too many devices that may contain pertinent information and are so common place that many people will more often than not ignore their potential for providing evidence. Further, very few tools exist that extract information from a small percentage of these digital devices. So, digital forensics investigators must become more of the potential of non-traditional devices and research must be invested in the development of tools and procedures to gather information from these appliances.

9 Bibliography: 1) Ilett, Dan. "Lexus a nexus between cars and phone viruses?". Jan. 27, < >. 2) Koerner, Brendan. "Spy Games". Readers Digest. July < >. 3) Oliver, Mark. "Kidnapper's retro computer offers scant clues". Guardian Unlimited. Sep. 5, < >. 4) "Gone in 20 Minutes: using laptops to steal cars". Leftlane News. < >. 5) "Paraben Forensics Tool". < >. 6) "User's Manual: FlaskScrubber Vantage Series Glassware Washers". < Manual.pdf+washer+manual&hl=en&gl=us&ct=clnk&cd=2&client=firefox-a >.