Scribd Logo
Upload

Welcome to Scribd!

  • 547 views

    Mobile Forensics Lecture Slides

    Uploaded by

    V Yaswanth Kumar
    This document provides an overview of cell phone and mobile device forensics. It discusses the types of information commonly stored on mobile devices, challenges in investigating these devices due to varying standards and frequent new models, and the basics of mobile phone technology including components and generations. The document also outlines proper procedures for acquiring data from mobile devices, including isolating them from networks and avoiding remote wiping. It describes the types of forensic tools and methods used including logical extraction, physical acquisition, and SIM card readers.

    Copyright:

    © All Rights Reserved
    Download as PPT, PDF, TXT or read online from Scribd

    Mobile Forensics Lecture Slides

    Uploaded by

    V Yaswanth Kumar
    547 views25 pages
    This document provides an overview of cell phone and mobile device forensics. It discusses the types of information commonly stored on mobile devices, challenges in investigating these devices due to varying standards and frequent new models, and the basics of mobile phone technology including components and generations. The document also outlines proper procedures for acquiring data from mobile devices, including isolating them from networks and avoiding remote wiping. It describes the types of forensic tools and methods used including logical extraction, physical acquisition, and SIM card readers.

    Original Description:

    hjmf

    Copyright

    © © All Rights Reserved

    Available Formats

    PPT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document provides an overview of cell phone and mobile device forensics. It discusses the types of information commonly stored on mobile devices, challenges in investigating these devices due to varying standards and frequent new models, and the basics of mobile phone technology including components and generations. The document also outlines proper procedures for acquiring data from mobile devices, including isolating them from networks and avoiding remote wiping. It describes the types of forensic tools and methods used including logical extraction, physical acquisition, and SIM card readers.

    Copyright:

    © All Rights Reserved
    Download as PPT, PDF, TXT or read online from Scribd
    Download as ppt, pdf, or txt
    547 views25 pages

    Mobile Forensics Lecture Slides

    Uploaded by

    V Yaswanth Kumar
    This document provides an overview of cell phone and mobile device forensics. It discusses the types of information commonly stored on mobile devices, challenges in investigating these devices due to varying standards and frequent new models, and the basics of mobile phone technology including components and generations. The document also outlines proper procedures for acquiring data from mobile devices, including isolating them from networks and avoiding remote wiping. It describes the types of forensic tools and methods used including logical extraction, physical acquisition, and SIM card readers.

    Copyright:

    © All Rights Reserved
    Download as PPT, PDF, TXT or read online from Scribd
    Download as ppt, pdf, or txt
    of 25
    At a glance
    Powered by AI
    The key takeaways are that mobile devices store a wealth of personal information and investigating them is challenging due to lack of standards and constantly changing models and OS.

    The main components used for communication in mobile phones are the base transceiver station (BTS), base station controller (BSC), and mobile switching center (MSC).

    The main hardware components inside mobile devices are the microprocessor, ROM, RAM, digital signal processor, radio module, microphone, speaker, hardware interfaces, and LCD display.

    Special Topics in Digital

    Forensics and Investigations


    CPSC 6622
    Cell Phone and Mobile Devices
    Forensics

    Understanding Mobile Device


    Forensics
    People store a wealth of information on smartphones
    and tablets
    People dont think about securing them industry estimates
    somewhere between 30-60% lock their smartphones.
    iOS simple passcode = 4 digit pin

    Items stored on mobile devices:

    Incoming, outgoing, and missed calls


    Text and Short Message Service (SMS) messages
    E-mail
    App data & passwords - Twitter, facebook, tumbler, Pintrest, etc, etc.
    Web pages
    Pictures
    Personal calendars
    Address books
    Voicemail recordings

    Understanding Mobile Device


    Forensics
    Investigating cell phones and mobile devices is one
    of the more challenging tasks in digital forensics
    No single standard exists for how and where phones
    store messages
    New phones come out about every six months and
    they are rarely compatible with previous models

    Mobile Phone Basics


    Mobile phone technology has advanced rapidly
    By the end of 2008, mobile phones had gone
    through three generations:
    Analog
    Digital personal communications service (PCS)
    Third-generation (3G)

    Fourth-generation (4G) was introduced in 2009


    Several digital networks are used in the mobile
    phone industry
    4

    Mobile Phone Basics

    Mobile Phone Basics


    The 3G standard was developed by the
    International Telecommunications Union (ITU)
    under the United Nations
    It is compatible with CDMA, GSM, and TDMA
    The Enhanced Data GSM Environment (EDGE)
    standard was developed specifically for 3G

    Mobile Phone Basics


    4G networks can use the following technologies:
    Orthogonal Frequency Division Multiplexing
    (OFDM)
    Mobile WiMAX
    Ultra Mobile Broadband (UMB)
    Multiple Input Multiple Output (MIMO)
    Long Term Evolution (LTE)

    Mobile Phone Basics


    Main components used for communication:
    Base transceiver station (BTS)
    Base station controller (BSC)
    Mobile switching center (MSC)

    Inside Mobile Devices


    Mobile devices can range from simple phones to
    small computers
    Also called smart phones

    Hardware components
    Microprocessor, ROM, RAM, a digital signal
    processor, a radio module, a microphone and
    speaker, hardware interfaces, and an LCD display

    Most basic phones have a proprietary OS


    Although smart phones use the same OSs as PCs
    9

    Inside Mobile Devices


    Phones store system data in electronically
    erasable programmable read-only memory
    (EEPROM)
    Enables service providers to reprogram phones
    without having to physically access memory chips

    OS is stored in ROM
    Nonvolatile memory
    Available even if the phone loses power

    10

    Inside Mobile Devices


    Subscriber identity module (SIM) cards
    Found most commonly in GSM devices
    Consist of a microprocessor and internal memory
    GSM refers to mobile phones as mobile stations
    and divides a station into two parts:
    The SIM card and the mobile equipment (ME)

    SIM cards come in two sizes


    Portability of information makes SIM cards versatile

    11

    Inside Mobile Devices


    Subscriber identity module (SIM) cards (contd)
    The SIM card is necessary for the ME to work and
    serves these additional purposes:
    Identifies the subscriber to the network
    Stores service-related information
    Can be used to back up the device

    12

    Understanding Acquisition Procedures


    for Cell Phones and Mobile Devices
    The main concerns with mobile devices are loss of
    power, synchronization with cloud services, and
    remote wiping
    All mobile devices have volatile memory
    Making sure they dont lose power before you can
    retrieve RAM data is critical

    Mobile device attached to a PC via a USB cable


    should be disconnected from the PC immediately
    Helps prevent synchronization that might occur
    automatically and overwrite data
    13

    Understanding Acquisition Procedures


    for Cell Phones and Mobile Devices

    Depending on the warrant or subpoena, the time of seizure might be


    relevant
    Messages might be received on the mobile device after seizure
    Isolate the device from incoming signals with one of the following options:

    Place the device in airplane mode


    Place the device in a paint can
    Use the Paraben Wireless StrongHold Bag
    Turn the device off

    14

    Understanding Acquisition Procedures


    for Cell Phones and Mobile Devices
    The drawback of using these isolating options is
    that the mobile device is put into roaming mode
    Accelerates battery drainage

    SANS DFIR Forensics recommends:


    If device is on and unlocked - isolate it from the
    network, disable the screen lock, remove passcode
    If device is on and locked - what you can do varies
    depending on the type of device
    If device is off - attempt a physical static acquisition
    and turn the device on
    15

    Understanding Acquisition Procedures


    for Cell Phones and Mobile Devices
    Check these areas in the forensics lab :

    Internal memory
    SIM card
    Removable or external memory cards
    Network provider

    Checking network provider requires a search


    warrant or subpoena
    A new complication has surfaced because backups
    might be stored in a cloud provided by the carrier or
    third party
    16

    Understanding Acquisition Procedures


    for Cell Phones and Mobile Devices
    Due to the growing problem of mobile devices
    being stolen, service providers have started using
    remote wiping to remove a users personal
    information stored on a stolen device
    Memory storage on a mobile device is usually a
    combination of volatile and nonvolatile memory
    The file system for a SIM card is a hierarchical
    structure

    17

    Understanding Acquisition Procedures


    for Cell Phones and Mobile Devices
    Information that can be retrieved falls into four
    categories:
    Service-related data, such as identifiers for the SIM
    card and the subscriber
    Call data, such as numbers dialed
    Message information
    Location information

    If power has been lost, PINs or other access codes


    might be required to view files
    18

    Mobile Forensics Equipment


    Mobile forensics is an evolving science
    Biggest challenge is dealing with constantly changing
    phone models
    Procedures for working with mobile forensics software:
    Identify the mobile device
    Make sure you have installed the mobile device
    forensics software
    Attach the phone to power and connect cables
    Start the forensics software and download information
    19

    Mobile Forensics Equipment


    SIM card readers
    A combination hardware/software device used to
    access the SIM card
    General procedure is as follows:

    Remove the back panel of the device


    Remove the battery
    Remove the SIM card from holder
    Insert the SIM card into the card reader

    20

    Mobile Forensics Equipment


    NIST guidelines list six types of mobile forensics
    methods:
    Manual extraction
    Logical extraction
    Hex dumping and Joint Test Action Group (JTAG)
    extraction
    Chip-off
    Micro read

    21

    Mobile Forensics Equipment


    Roughly half of Facebook users access their
    accounts via mobile devices. Most all mobile apps
    store account authentication information.
    Following standard procedures, doing a logical
    acquisition followed by a physical acquisition, can
    yield solid evidence.

    22

    Mobile Forensics Tools in Action


    Cellebrite is often used by law enforcement
    You can determine the devices make and model,
    hook up the correct cable, turn the device on, and
    retrieve the data
    There are more than half a million aps for mobile
    devices and Cellebrite can analyze data from only a
    few hundred
    No one product can do it all, Multiple solutions are
    needed.

    23

    Mobile Forensics Tools in Action


    Many mobile forensics tools are available
    Most arent free

    Methods and techniques for acquiring evidence will


    change as market continues to expand and mature
    Subscribe to user groups and professional
    organizations to stay abreast of whats happening
    in the industry

    24

    Smartphone Basics

    Operation Modes - iDevices


    Normal Mode
    Recovery mode activating device, upgrading/downgrading or
    sometimes to perform a forensic physical acquisition.
    DFU mode Device Failsafe Utility mode. device firmware upgrades
    and some physical acquisitions

    25

    You might also like