Upload File

data, pda and cell phone forensics. 2 introduction it is important to understand how the technology...

  • Home
  • Documents
  • Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the
31
Data, PDA and Cell Phone Forensics

Upload: caroline-bates

Post on 26-Dec-2015

216 views

Category:

Documents


0 download

Report

Tags:

TRANSCRIPT

Page 1: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

Data, PDA and Cell Phone Forensics

Page 2: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

2

Introduction

It is important to understand how the technology works in order to properly gather evidence from the different media devices.

This chapter gives you • the requisite understanding and • the tools to help in gathering the evidence from those devices.

Page 3: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

CMOS Jumpers

3

Page 4: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

4

Basic Hard Drive Technology

Composition of hard drives Platters (made of aluminum, ceramic or even glass. Heads (read/write heads- Every platter has two

heads to read/write both the top and bottom of platter)

Cylinders (Vertical grouping of tracks) Sectors

Locating hard drive geometry information Information on label on hard drive

contains drive geometry

Page 5: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

Hard Drives

© Pearson Education Computer Forensics: Principles and Practices 5

Page 6: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

Cylinders

© Pearson Education Computer Forensics: Principles and Practices 6

Page 7: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

7

Basic Hard Drive Technology (Cont.) Hard drive standards

ATA (advanced technology attachment) (Standardizes everything from connections to hard drive speeds) (ATA 1-7)

ATAPI (advanced technology attachment programmable interface) (Allows devices other than hard drives such as compact disk or tape drives to use ATA connections).

E IDE (Allows up to four ATA devices) IDE (integrated drive electronics) (Supported only two drives) PIO (programmable input/output) (Used for transferring data

between hard drive and RAM ATA 1) UDMA (ultra direct memory access) (Transfer data between

hard drive and RAM for ATA2 to 5) ATA speed rating SATA (serial advanced technology attachment) (achieves

speeds up to 150MBps)

Page 8: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

8

Other Storage Technologies

Floppy disks Tape drive technologies

QIC, DAT, DLT ZIP and other high-capacity drives

Optical media structures Single session vs. multisession CDs DVDs

USB Flash drives

Page 9: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

9

Personal Digital Assistant Devices (PDAs) Seven major PDA operating systems:

BlackBerry Open Embedded (Linux) PalmSource (Palm OS) Symbian (Psion) Windows Mobile (Pocket PC) Apple iOS Android

Page 10: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

10

Cellular Phones

PDA functionality Text messaging

SMS, EMS, MMS, IM Single photo and/or

movie video capable Phonebook Call logs

Subscriber identity module

Global positioning systems

Video streaming Audio players

New phones are low-end computers with the following capabilities:

Page 11: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

11

Drive and Media Analysis

Acquiring data from hard drives Bit-stream transfer Disk-to-disk imaging

Page 12: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

12

Drive and Media Analysis (Cont.)

Acquiring data from removable media Document the scene Use static-proof container and label container with

Type of media Where media was found Type of reader required for the media

Transport directly to lab Do not leave any media in a hot vehicle or

environment Store media in a secure and organized area

Page 13: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

13

Drive and Media Analysis (Cont.)

Acquiring data from removable media (cont.) Once at the lab, make a working copy of the drive

Make sure the media is write-protected Make a hash to document of the original drive and the

duplicate Make a copy of the duplicate to work from Store the original media in a secure location

Page 14: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

14

Drive and Media Analysis (Cont.)

Acquiring data from USB flash drives Write protect the drive Software may be needed to write protect Essentially recognized much like a regular hard

drive by the operating system

Page 15: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

15

In Practice: PDA-Configured iPod Reveals Employee Theft Review of bank fees revealed that Joe had

been skimming money Suspicion fell on iPod that Joe had on his

desk every day iPod had been partitioned to hold both data

and music

Page 16: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

16

PDA Analysis

Guidelines for seizing PDAs: If already off, do not turn it on Seal in an envelope before putting it in an

evidence bag to restrict access Attach the power adapter through the evidence

bag to maintain the charge Keep active state if PDA is on when found

Page 17: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

17

PDA Analysis (Cont.)

Guidelines for seizing PDAs (cont.): Search should be conducted for associated

memory devices Any power leads, cables, or cradles relating to the

PDA should also be seized, as well as manuals Anyone handling PDAs before their examination

should treat them in such a manner that gives the best opportunity for any recovered data to be admissible as evidence in any later proceedings

Page 18: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

18

PDA Chain of Custody

Documentation of the chain of custody should answer the following: Who collected the device, media, and associated

peripherals? How was the e-evidence collected and where was

it located? Who took possession of it? How was it stored and protected while in storage? Who took it out of storage and why?

Page 19: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

19

Secured PDA Device

Ask the suspect what the password is Contact the manufacturer for backdoors or

other useful information Search the Internet for known exploits for

either a password crack or an exploit that goes around the password

Call in PDA professional who specializes in data recovery

Page 20: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

20

Cellular Phone Analysis

Determine which forensic software package will work with the suspect cellular phone

Ascertain the connection method Some devices need to have certain protocols

in place before acquisition begins Physically connect the cellular phone and the

forensic workstation using the appropriate interface

Page 21: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

21

Cellular Phone Analysis (Cont.)

Before proceeding, make sure all equipment and basic data are in place

Most software packages are GUI based and provide a wizard

Once connected, follow the procedures to obtain a bit-stream copy

Search for evidence and generate reports detailing findings

Page 22: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

22

Disk Image Forensic Tools

Guidance software Paraben® software FTK™ Logicube

Page 23: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

23

PDA/Cellular Phone Forensic Software Tools for examining PDAs

EnCase and Palm OS software PDA Seizure Palm dd (pdd) POSE (Palm OS Emulator) PDA memory cards (sd-cf-ms)

Page 24: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

24

PDA/Cellular Phone Forensic Software (Cont.)

Tools for examining cellular phones Bit PM CDMA Cable Cell Seizure GSM-TDMA-CDMA Cable Oxygen PM GSM Cable Pilot-link PALM OS Cable Forensic SIM External SIM acq. Cable SIMCon Ext. SIM acq. Ext. card reader SIMIS Ext. SIM acq. Ext. card reader

Page 25: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

OxyGen PM Supports more than 2000 mobile device Extract

SIM card data, contacts list, caller groups, call logs, calendar events, etc.

Keyword and filter Devices used:

iPhone 4 (ver.4.2.1; jailbroken), iPhone 3G (ver.2.7; jailbroken), and HTC Evo

25

Page 26: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

OxyGen PM Iphone

Provide easy and manageable way to view the entire file structure

View device information, images, attachments and previously deleted messages

HTC Not Recognized.

26

Page 27: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

Others BitPIM (LG Env3)

Likewise OxyGen except for the SMS text messages

Cell Seizure (LG Env3, HTC DROID, RIM BlackBerry Bold 9700) Is able to extract all information from all the

phones, but costs more than 2K

27

Page 28: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

28

PDA/Cellular Phone Forensic Software (Cont.) Tools for examining both PDAs and cellular

phones Paraben software Logicube

Page 29: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

29

Summary

You are most likely to encounter media devices such as: Hard drives Optical media (CDs) USB drives PDAs Cellular phones

Page 30: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

30

Summary (Cont.)

You learned how data is stored on these devices and methods for acquiring the data

General guidelines for data acquisition are the same for most devices

There are also specific guidelines depending on the type of device

Page 31: Data, PDA and Cell Phone Forensics. 2 Introduction It is important to understand how the technology works in order to properly gather evidence from the

31

Summary (Cont.)

Guidance, Paraben, AccessData, and Logicube are suppliers of forensic software Some software is specific to PDAs Some can be used for several different types of

data


Persistierender Ductus Arteriosus (PDA) PDA, PFO.pdf · HERZKIND e.V. PDA / PFO Persistierender Ductus Arteriosus (PDA), Persistierendes Foramen Ovale (PFO) Peristierender Ductus

Computer Forensics – Tracking the Cyber vandals Forensics

Malware Analysis - iswatlab.eu · Malware Sample Gather intelligence from reports and IOCs Basic Static Analysis Dynamic Analysis Forensics Report Delivery Advanced Analysis Sandbox

Forensics & Anti- Forensics

Digital Evidence and Computer Forensics Oct 7-8 2013/Tab 02 Oct 7-8... · Digital Evidence and Computer Forensics COMPUTER FORENSICS FORENSICS FORENSICS

iPhone Forensics Methodology and Tools · Forensics methodologies, iPhone forensics, forensics tools, digital forensics evidence handling, INTRODUCTION iPhone mobile phone is becoming

PDA Technical Report No. 39 Revised 2007 PDA

€¦ · Computer Forensics and Cyber Crime The Computer Forensic is the application of investigation and analysis techniques to gather and preserve evidence from a particular computing

Preventive Digital Forensics: Creating Preventive Digital Forensics

Taller de Feedback PDA ¿Qué es el PDA Assessment?

Reporte Anual 2017 - worldvision.pe ANUAL 2017.pdf · PDA Emprendedores Cusco PDA Mosoq Ayllu PDA K’ana PDA Urin Qosqo PDA Ausangate PDA Ocongate Proyectos de atención a emergencias

Forensics & Anti- Forensics - Power Of Communitypowerofcommunity.net/poc2007/casper.pdf · Anti-Forensics • Wipe can reply all Host Forensics Tools • Counterfeit Evidence •

COE589: Digital Forensics - ccse.kfupm.edu.saahmadsm/coe589-122/00_Overview_Logisti… · Digital Forensics computer forensics mobile forensics network forensics ... COE589 - Ahmad

PDA TR26rev07 Update PDA Australia - Parenteral Drug Association

pda forensics

What’s behind a cyber attack? · from IBM, QRadar Incident Forensics, investigators can not only gather network information, they can also proactively search for possible breaches

PDA EXECUTIVE OFFICERS€¦ · comhdháil bhliantúil PDA i Luimneach. 4 1 President’sT Message October 2014 Brian Ó Maoilchiaráin, PDA President. PDA EXECUTIVE OFFICERS Brian

Professionisti a tutela della verità - P&P Investigazioni...Digital & Mobile Forensics Digital Forensics Network Forensics Embedded & Software Forensics Metodologia d’Intervento

Memory Forensics - publish.illinois.edupublish.illinois.edu/.../files/2014/03/acc-forensics.pdfWhat is Computer Forensics? Mobile Device Forensics Network Forensics Memory & Data Forensics

Acquisizione Laboratorio Disk forensics Network forensics

ACQUITY UPLC PDA and PDA λe Detectors - Waters · PDF file · 2011-12-20ACQUITY UPLC PDA and PDA λe Detectors ... PDA Detector for routine analysis and method development and the

1 Equivalence of PDA, CFG Conversion of CFG to PDA Conversion of PDA to CFG

Digital Forensics or Cyber Forensics My Contribution

Anti-Forensics and Anti-Anti-Forensics

Cloud Storage Forensics - SANS Computer Forensics

Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

Mobile Device Data Population MOTO-E · 2018-10-11 · many different avenues (e.g., PDA Forensics, Cell Phone Forensics, Network Forensics, and Stand Alone machine Forensics.

USB FORENSICS -PRODISCOVER USB FORENSICS –ENCASE V7csc.csudh.edu/cae/.../2013/11/All-is-not-Lost-Forensics-on-a-USB-Ale… · USB FORENSICS -PRODISCOVER USB FORENSICS -PRODISCOVER

Implementation of Forensic Analysis Procedures for ...Android Forensics, Instant Messenger Forensics, Viber Forensics, WhatsApp Forensics. 1. INTRODUCTION ... communication medium

PDA Forensics: Tool Evaluation

CS Forensic Investigationcysecure.org/530/online/fc02investiga.pdf · Preparing a Computer Investigation Role of computer forensics professional is to gather evidence to prove that

PDA 1252 PDA 1252 Portable Power Analyzer

COMPUTER FORENSICS - Boise Chapter€¦ · 3 Mobile device forensics 4 Other 5 References Computer forensics Main article: computer forensics ... 1.19 Computer Forensics Solution

© The Forensics Files Lincoln-Douglas Debate The Forensics Files The Forensics Files

Charlton Village District Priority Development Area (PDA) PDA … · 2015-05-27 · Charlton Village District Priority Development Area (PDA) PDA Assessment Report Prepared by the