smart phones & the internet
DESCRIPTION
In this webinar presentation, Mike Harrington of Teel Technologies talked about the relationship between smartphone-based evidence and Internet-based evidence, and why investigators need to collect each.TRANSCRIPT
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Smart Phones and the Internet ::Societal Shi3s and the Age of the App
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Topics
• How and why smartphones are changing the game for online evidence
• What evidence can be found on smartphones and how does it work with “tradi<onal” online evidence gathering
• Sugges<ons for how far to go with smart-‐ phone evidence and how to work in conjunc<on with devices and online evidence gathering
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Societal ShiAs
• Research by Ericsson ConsumerLab suggests that people are finding it increasingly difficult to live without a connec<on to the cloud
• Prior to smartphones people used the internet in chunks – now they “jacked in” constantly
• Consumers are forming habits integra<ng internet use into everyday life through apps-‐cloud dependency!
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Societal ShiAs
• To date 35 percent of US Android/iPhone users interact with non-‐voice applica<ons on their smartphones before gePng out of bed – The most common ac<vity checking Facebook – 18 percent of social networking users log in while their heads are s<ll on the pillow
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Societal ShiAs
• AAer gePng out of bed 23% of smartphone users access the internet via their browsers, 24% check their email and 22% check Facebook
• 29% use Google Maps or other nav tools on morning commute and 28% listen to music
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Societal ShiAs
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Societal ShiAs
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Societal ShiAs
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Societal ShiAs
• Smartphones are becoming hubs through which people manage their social lives
• Ericsson ConsumerLab reports smartphone users are spending considerable <me using “everyday” apps -‐integra<ng internet use into a more basic level of everyday life
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Societal ShiAs
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Societal ShiAs
• Ericsson’s research suggests “Consumers expect, and increasingly depend on, the ability to access online services easily at low cost and complexity from mul<ple loca<ons during the day.”
• Among Americans using portable storage devices – 54 percent were interested in synchronizing the portable storage from anywhere
– 51 percent want direct exchange between portable devices and online secure storage
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Societal ShiAs
• The overwhelming purpose for use of the smartphone is personal – 80-‐90% of respondents
• Consumers connect to apps on an emo<onal level – Feeling of be`er control of life – Feeling of belonging
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Market
• Smart phone market expected to grow over 55% in 2011 – 472 million expected shipped in 2011 – 982 by the end of 2015
• Growth is four <mes faster than that of tradi<onal mobile phones
• Emerging markets key – Asia/Pacific, La<n America
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Market
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Android Market Share
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Considera<ons
• Working with other inves<gators • How far to go?
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Evidence
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Third Party Applica<ons
• Over 300k apps for sale in App Store • There are many unauthorized applica<ons from jailbroken phones
• Can contain important informa<on
• Store their informa<on using – Plists – Sqlite databases – Text files
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Twi`er
• Two directories – Documents
– Library • Documents
– Com.atebits.twee<e.applica<on-‐state • Account informa<on and followers
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Twi`er
• Documents (cont’d) – Com.atebits.twee<e.compose.a`achments
• Hashed numbers as file names -‐ actual a`achments sent with tweets
– Com.atebits.twee<e.streams • One or more property lists
– tweet handles (user names) and tweets
» date and <me values in absolute <me
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Twi`er
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Twi`er
Username/Date Stamp
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Twi`er
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
• In iOS most informa<on stored on server • Important files -‐ /Library/Applica<ons/Facebook
– Friends.db – Com.facebook.Facebook.plist
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Skype
• Allows for VOIP calls on iOS devices connected by Wi-‐Fi – /Library/Skype/Applica<on Support/$user/ – Phone Logs – Chat logs – Account details
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Skype
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
iOS GPS Ar<facts -‐ Maps
• Maps App – P to P direc<ons – Locate Points of Interest (POI)
• More info
• Direc<ons – Loca<on: /Library/Maps
• History.plist • Direc<ons.plist • Bookmark.plist
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
iOS GPS Ar<facts -‐ Maps
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
iOS GPS Ar<facts -‐ Maps
• Bookmarks.plist – Not easily viewable in plist editor
• Data is base 64 encoded – Contains loca<on
• Cell ID – This is Google’s cell ID (cell tower) loca<on database
• Details – telephone number – URL
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
iOS GPS Ar<facts -‐ Maps
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
iOS GPS Ar<facts -‐ Maps
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
iOS GPS Ar<facts -‐ Maps
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
iOS GPS Ar<facts -‐ Maps
• Direc<ons.plist – User requested point to point direc<ons
• Start and stop end points • Turn by turn direc<ons
– Viewed in the plist editor the data is base 64 encoded
– Can be decoded in a hex or text editor • Online base 64 decoders
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
iOS GPS Ar<facts -‐ Maps
h8p://www.opinionatedgeek.com/dotnet/tools/base64decode/
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Geotags
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Geotags -‐ iOS
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Geotags -‐ iOS • Videos in iOS store Geo Data at the end of the file
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Geotags -‐ iOS • Quick<me can be used to format Geo data in videos for quick viewing
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Cellular Data
• =< iOS 4.0 – Located in /Library/caches/loca<ond
• Cells.plist • Clients-‐b.plist • H-‐cells.plist • H-‐wifi.plist
• =>4.0 • Located in /Library/caches/loca<ond
– Clients.plist – Consolidated.db
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Cellular Data
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Cellular Data
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
Upcoming Training Advanced Smartphone Forensics
• Smartphone Forensics Mississauga, Ontario September 19th -‐ 23rd
Device Repair and Chip-‐off Forensics • Repair + Chip-‐Off Forensics
Wild PCS Training Facility Las Vegas Sept. 26th -‐ 30th
Advanced BlackBerry Forensics Training • BlackBerry Forensics
Manchester, England October 3rd -‐ 7th
Advanced Mobile Forensics / Flasher Box Forensics
• Advanced + Flasher Box Forensics SAIC -‐ McLean, Virginia October 11th -‐ 13th
Device Repair and Chip-‐off Forensics • Repair + Chip-‐Off Forensics
Wild PCS Training Facility Las Vegas Nov. 7th -‐ 11th
16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com
QuesOons?