Seeking the Truth from Mobile Evidence - Basic Fundamentals, Intermediate and Advanced Overview of Current Mobile Forensic Investigations

Seeking the Truth from Mobile Evidence: Basic Fundamentals, Intermediate and Advanced Overview of Current Mobile Forensic Investigations will assist those who have never collected mobile evidence and augment the work of professionals who are not currently performing advanced destructive techniques. This book is intended for any professional that is interested in pursuing work that involves mobile forensics, and is designed around the outcomes of criminal investigations that involve mobile digital evidence. Author John Bair brings to life the techniques and concepts that can assist those in the private or corporate sector. Mobile devices have always been very dynamic in nature. They have also become an integral part of our lives, and often times, a digital representation of where we are, who we communicate with and what we document around us. Because they constantly change features, allow user enabled security, and or encryption, those employed with extracting user data are often overwhelmed with the process. This book presents a complete guide to mobile device forensics, written in an easy to understand format. Provides readers with basic, intermediate, and advanced mobile forensic concepts and methodology. Thirty overall chapters which include such topics as, preventing evidence contamination, triaging devices, troubleshooting, report writing, physical memory and encoding, date and time stamps, decoding Multi-Media-Messages, decoding unsupported application data, advanced validation, water damaged phones, Joint Test Action Group (JTAG), Thermal and Non-Thermal chip removal, BGA cleaning and imaging, In-System-Programming (ISP), and more. Popular JTAG boxes - Z3X and RIFF/RIFF2 are expanded on in detail. Readers have access to the companion guide which includes additional image examples, and other useful materials Title page......Page 2 Table of Contents......Page 3 Copyright......Page 15 Dedication......Page 18 Foreword......Page 19 Preface......Page 23 Acknowledgment......Page 26 Introduction......Page 28 Part 1. Basic, Fundamental Concepts......Page 36 Chapter 1. Defining Cell Phone Forensics and Standards......Page 37 Introduction......Page 38 Defining Cell Phone Forensics......Page 39 Chapter Summary Key Points......Page 50 Chapter 2. Evidence Contamination and Faraday Methods......Page 52 Introduction......Page 53 Evidence Contamination......Page 54 Faraday Origins......Page 58 Faraday Methods......Page 63 Chapter Summary Key Points......Page 71 Introduction—Chapter Disclosure......Page 74 The Legal Process......Page 75 Mobile Network Operators......Page 79 Mobile Virtual Network Operators......Page 80 Determining Target Number......Page 82 Chapter Summary Key Points......Page 87 Search Warrant Language......Page 91 Destructive Court Orders......Page 104 Chapter Summary Key Points......Page 109 Introduction to the Cellular Network......Page 112 Code Division Multiple Access......Page 114 Global Systems for Mobile Communications and Time Division Multiple Access......Page 115 Integrated Digital Enhanced Network......Page 116 Long-Term Evolution......Page 117 International Mobile Equipment Identity......Page 120 Subscriber Identity Module......Page 124 International Mobile Subscriber Identity......Page 125 Integrated Circuit Card Identifier......Page 126 How a Call Is Routed Through a Global System for Mobile Communications Network......Page 127 Chapter Summary Key Points......Page 133 Chapter 6. Subscriber Identity Module......Page 136 SIM Sizes......Page 137 Internal Makeup......Page 140 Where Is My Evidence?......Page 143 SIM Security......Page 149 Forensic SIM Cloning......Page 152 Chapter Summary Key Points......Page 154 Chapter 7. Device Identification......Page 157 Handset Communication Types......Page 158 The Form Factors......Page 164 Common Operating Systems......Page 171 Steps for Device Identification (Free)......Page 176 Removable Storage......Page 177 Chapter Summary Key Points......Page 178 Chapter 8. Triaging Mobile Evidence......Page 182 Introduction......Page 183 Devices Powered On......Page 184 Devices Powered Off......Page 193 Locked Devices Powered On......Page 199 Forensic Processing Triage Forms......Page 202 Chapter Summary Key Points......Page 204 Chapter 9. The Logical Examination......Page 207 Introduction—A “Logical” Home......Page 208 Computer Forensics and Mobile Forensics......Page 209 Connection Interfaces......Page 210 Agent or Client......Page 211 Communication Protocols......Page 215 Attention Terminal Commands......Page 216 Port Monitoring......Page 230 Chapter Summary Key Points......Page 236 Chapter 10. Troubleshooting Logical Examinations......Page 240 History of Common Problems......Page 241 Truck and Trailer Analogy......Page 244 Device Manager......Page 248 Advanced Tab (Device Manager)......Page 250 Using Log Files......Page 252 General Troubleshooting Steps......Page 254 Chapter Summary Key Points......Page 255 Chapter 11. Manual Examinations......Page 258 History......Page 259 Reasons for the Manual Examination......Page 260 Hardware Tools for Manual Extractions......Page 264 Software Solutions......Page 270 An Alternative Solution to Hardware and Software Vendors......Page 271 Chapter Summary Key Points......Page 274 Chapter 12. Report Writing......Page 277 History—Our Forensic Wheel......Page 278 A Final Report Example......Page 279 General Questions to Answer/Include in Your Report......Page 281 Initial Contact......Page 282 Documenting Other Initial Issues (DNA/Prints/Swabbing)......Page 284 Specific Tools and Versions Used......Page 286 Listing Parsed Data......Page 287 Reporting Issues and Anomalies......Page 289 Validation......Page 292 Methods of Reporting......Page 293 Other Formats and Proprietary Readers......Page 295 Hashing......Page 296 The Archive Disk......Page 297 Chapter Summary Key Points......Page 299 Part 2. Intermediate Concepts......Page 302 Chapter 13. Physical Acquisitions......Page 303 History......Page 304 Flasher Boxes......Page 305 Pros and Cons—Flasher Box Usage......Page 309 Bootloaders......Page 311 Current Popular Boxes......Page 312 Early Physical Examination Vendors and Tools......Page 314 MSAB and Cellebrite......Page 316 Chapter Summary Key Points......Page 318 Chapter 14. Physical Memory and Encoding......Page 321 NAND and NOR......Page 322 NAND Blocks, Spare Area, Operation Rules, Wear Leveling, Garbage Collection, and the SQLite Databases......Page 325 Encoding......Page 328 Chapter Summary Key Points......Page 341 Chapter 15. Date and Time Stamps......Page 344 Introduction “In the Beginning...”......Page 345 Epoch, GMT, and UTC......Page 347 Integers......Page 349 Formats......Page 350 Chapter Summary Key Points......Page 367 Chapter 16. Manual Decoding MMS......Page 370 Introduction—Lab Work......Page 371 Susteen—SV Strike and Burner Breaker......Page 372 MMS Carving......Page 375 Containers for MMS......Page 386 Chapter Summary Key Points......Page 388 Chapter 17. Application Data......Page 391 Introduction—A Last Argument......Page 392 Applications......Page 393 Supported Decoding—The Tip of the Iceberg......Page 395 Database Naming—It Does Not Always Stay Original......Page 397 Validating Database Content......Page 401 Sanderson Forensics SQLite Forensic Browser......Page 406 Write-Ahead Log Files......Page 412 Journal Files......Page 413 Blobs and Attachments......Page 415 Chapter Summary Key Points......Page 416 Introduction......Page 419 USB Monitoring—Can You Hear Me Now?......Page 421 UltraCompare Professional......Page 425 Chapter Summary Key Points......Page 436 Part 3. Advanced Concepts......Page 439 Chapter 19. Android User Enabled Security: Passwords and Gesture......Page 440 Introduction—Security on Androids......Page 441 Simple Security Values......Page 442 The Password Lock......Page 444 Hashcat......Page 445 The Pattern Lock (Gesture)......Page 453 SHA-1 Exercise......Page 455 Chapter Summary Key Points......Page 459 Chapter 20. Nondestructive Hardware and Software Solutions......Page 462 Introduction......Page 463 MFC Dongle......Page 464 IP Box......Page 466 Best Smart Tool......Page 467 FuriousGold......Page 470 XPIN Clip......Page 472 Other Methods......Page 476 Chapter Summary Key Points......Page 479 Chapter 21. Phone Disassembly and Water-Damaged Phones......Page 481 Fastening Methods......Page 482 Tools Used......Page 486 Removing Moisture (Water Damage)......Page 487 Suggestions—Saltwater Exposure......Page 493 Chapter Summary Key Points......Page 494 Chapter 22. JTAG (Joint Test Action Group)......Page 496 Introduction......Page 497 Joint Test Action Group......Page 498 How Joint Test Action Group Works......Page 499 Test Access Port......Page 500 Molex (Connections)......Page 507 Joint Test Action Group Issues......Page 508 Chapter Summary Key Points......Page 509 Chapter 23. JTAG Specialized Equipment......Page 511 Introduction—Slow and Deliberant......Page 512 Pogo Pins and Jigs......Page 513 Molex Parts......Page 514 Wires and Wire Harnesses......Page 516 JTAG Finder......Page 518 Precise Soldering Units......Page 522 Hot Glue, Rubber Bands, and Cardboard......Page 524 Chapter Summary Key Points......Page 526 Chapter 24. RIFF Box Overview......Page 529 Introduction......Page 531 RIFF Box Components......Page 532 JTAG Manager Software......Page 533 Saving the Binary Scan......Page 543 Manual Probing Test Access Ports......Page 545 RIFF 2 Overview......Page 547 Software and Driver Install......Page 548 DLLs and Account Manage......Page 550 Connector Pinout Locations......Page 552 General Purpose Input/Output......Page 553 eMMC/SD Access Tab......Page 554 Advanced Settings......Page 558 Chapter Summary Key Points......Page 559 Chapter 25. Z3X Box (Easy JTAG) Overview......Page 563 Easy-JTAG W/Cables and ISP Adaptor......Page 564 Software and Driver Install......Page 565 Additional Activations......Page 573 Easy JTAG Tool (Z3X EasyJtag Box JTAG Classic Suite)......Page 574 Reading Target Flash......Page 577 Chapter Summary Key Points......Page 581 Chapter 26. Thermal Chip Removal......Page 584 Introduction—Chain of Command Knowledge Phenomenon......Page 585 Research the Phone and Chip......Page 587 Is the Chip Encrypted?......Page 592 Prepping the Board......Page 593 Using Heat for Memory Removal......Page 595 Basic Removal Steps When Using Heat......Page 600 Chapter Summary Key Points......Page 603 Chapter 27. Nonthermal Chip Removal......Page 606 Removal Through a Cold Process......Page 607 Removing the Chip From the Board......Page 609 Milling......Page 614 Lap and Polishing......Page 615 ULTRAPOL Basic......Page 616 Chapter Summary Key Points......Page 620 Chapter 28. BGA Cleaning......Page 623 Introduction—Your First Car......Page 624 Examples From Thermal Use......Page 625 Equipment Used in Cleaning (Thermal)......Page 626 Steps Involved in Cleaning (Thermal Removed)......Page 628 The Re-tinning Process......Page 630 Reballing......Page 635 Case Example (Thermal Cleaning) Steps......Page 636 Chapter Summary Key Points......Page 638 Chapter 29. Creating an Image......Page 640 Introduction—Fish On!......Page 641 Reading the Memory......Page 642 Using the UP 828 and 828P Programmers......Page 644 SD Adaptors......Page 650 DediProg NuProg-E Programmer......Page 652 Imaging......Page 656 Regular Expression Searching......Page 671 Common Email Regular Expressions......Page 673 Chapter Summary Key Points......Page 677 Chapter 30. eMMC Reading and In-System Programming......Page 680 Introduction—Model Building......Page 681 How Does Communication Occur?......Page 682 Understand eMMC Support Versus ISP......Page 683 Researching ISP Connections......Page 686 Probing In-System Programming Connections......Page 689 Probing Example......Page 695 Undocumented Phones......Page 698 Wires and Jumper Boards......Page 706 Medusa Pro and Octoplus Pro JTAG......Page 707 Chapter Summary Key Points......Page 708 Closing Remarks......Page 710 Index......Page 712