There is no doubt that mobile devices have become part of our lives and have revolutionized the way we do most of our activities. As a result, a mobile device is now a huge repository that holds sensitive and personal information about its owner. This has, in turn, led to the rise of mobile device forensics, a branch of digital forensics that deals with retrieving data from a mobile device. This book will help you understand forensic techniques on three main platforms—Android, iOS, and Windows. We will go through various methods that can be used to collect evidence from different mobile devices.
In this chapter, we will cover the following topics:
- The need for mobile forensics
- Understanding mobile forensics
- Challenges in mobile forensics
- The mobile phone evidence extraction process
- Practical mobile forensic approaches
- Potential evidence stored on mobile phones
- Examination and analysis
- Rules of evidence
- Good forensic practices
According to Statista reports (statista.com), the number of mobile phone users in the world is expected to pass 5 billion by 2020. The world is witnessing technology and user migration from desktops to mobile phones. Most of the growth in the mobile market can be attributed to the continued demand for smartphones.
According to an Ericsson report, global mobile data traffic will reach 71 exabytes per month by 2022, from 8.8 exabytes in 2017, a compound annual growth rate of 42 percent. Smartphones of today, such as Apple's iPhone and the Samsung Galaxy series, are compact forms of computers with high performance, huge storage, and enhanced functionality. Mobile phones are the most personal electronic device that a user accesses. They are used to perform simple communication tasks, such as calling and texting, while still providing support for internet browsing, email, taking photos and videos, creating and storing documents, identifying locations with GPS services, and managing business tasks.
As new features and applications are incorporated into mobile phones, the amount of information stored on devices is continuously growing.
Mobile phones have become portable data carriers, keeping track of all your movements. With the increasing prevalence of mobile phones in people's daily lives and in crime, data acquired from phones has become an invaluable source of evidence for investigations relating to criminal, civil, and even high-profile cases. It is rare to conduct a digital forensic investigation that does not include a phone. Mobile device call logs and GPS data were used to help solve the attempted bombing in Times Square, New York, in 2010.
The science behind recovering digital evidence from mobile phones is called mobile forensics, and we will be looking into it in the next section. Digital evidence is defined as information and data that is stored on, received by, or transmitted by an electronic device that is used for investigations. Digital evidence encompasses any and all digital data that can be used as evidence in a case.
Digital forensics is a branch of forensic science focusing on the recovery and investigation of raw data residing in electronic or digital devices. The goal of the process is to extract and recover any information from a digital device without altering the data present on the device. Over the years, digital forensics has grown along with the rapid growth of computers and various other digital devices. There are various branches of digital forensics based on the type of digital device involved, such as computer forensics, network forensics, and mobile forensics.
Mobile forensics is a branch of digital forensics that deals with the acquisition and recovery of evidence from mobile devices. Forensically sound is a term used extensively in the digital forensics community to qualify and justify the use of a particular forensic technology or methodology. One of the core principles that drive sound forensic examination is that the original evidence must not be altered in any form. This is extremely difficult with mobile devices. Some forensic tools require a communication vector with the mobile device, and thus standard write protection will not work during forensic acquisition.
Other forensic acquisition methods may involve detaching a chip or installing a custom bootloader on the mobile device prior to extracting data for forensic examination. In cases where examination or data acquisition is not possible without changing the configuration of the device, the procedure and the changes must be carefully tested and documented for later reference. Following proper methodology and guidelines is crucial in examining mobile devices as doing so yields the most valuable data. As with any evidence gathering, not following the proper procedure during the examination can result in loss or damage of evidence or render it inadmissible in court.
The mobile forensics process is broken down into three main categories—seizure, acquisition, and examination/analysis. Forensic examiners face some challenges while seizing the mobile device as a source of evidence. At the crime scene, if the mobile device is found switched off, you as the examiner should place the device in a Faraday bag to prevent changes should the device automatically power on. Faraday bags are specifically designed to isolate a phone from a network.
If the phone is found switched on, switching it off has a lot of concerns attached to it. If the phone is locked by a PIN or password, or encrypted, you will be required to bypass the lock or determine the PIN to access the device. Mobile phones are networked devices and can send and receive data through different sources, such as telecommunication systems, Wi-Fi access points, and Bluetooth. So, if the phone is in a running state, a criminal could securely erase the data stored on the phone by executing a remote wipe command. When a phone is switched on, it should be placed in a Faraday bag. If possible, prior to placing a mobile device in a Faraday bag, you should disconnect it from the network to protect the evidence by enabling flight mode and disabling all network connections (Wi-Fi, GPS, hotspots, and so on). This will also preserve the battery, which will drain while in a Faraday bag, and protect against leaks in the Faraday bag. Once the mobile device is seized properly, the examiner may need several forensic tools to acquire and analyze the data stored on the phone.
Mobile device forensic acquisition can be performed using multiple methods, which will be defined later. Each of these methods affects the amount of analysis required, which will be discussed in greater detail in the upcoming chapters. Should one method fail, another must be attempted. Multiple attempts and tools may be necessary in order to acquire the maximum amount of data from the mobile device.
Mobile phones are dynamic systems that present a lot of challenges for us in extracting and analyzing digital evidence. The rapid increase in the number of different kinds of mobile phones from different manufacturers makes it difficult to develop a single process or tool to examine all types of devices. Mobile phones are continuously evolving as existing technologies progress and new technologies are introduced. Furthermore, each mobile is designed with a variety of embedded operating systems. Hence, special knowledge and skills are required from forensic experts to acquire and analyze the devices.
One of the biggest forensic challenges when it comes to the mobile platform is the fact that data can be accessed, stored, and synchronized across multiple devices. As data is volatile and can be quickly transformed or deleted remotely, more effort is required for the preservation of this data. Mobile forensics is different from computer forensics and presents unique challenges to forensic examiners.
Law enforcement and forensic examiners often struggle to obtain digital evidence from mobile devices. The following are some of the reasons for this:
- Hardware differences: The market is flooded with different models of mobile phones from different manufacturers. Forensic examiners may come across different types of mobile models that differ in size, hardware, features, and operating system. Also, with a short product development cycle, new models emerge very frequently. As the mobile landscape changes with each passing day, it is critical for you to adapt to all challenges and remain updated on mobile device forensic techniques across various devices.
- Mobile operating systems: Unlike personal computers, where Windows has dominated the market for years, mobile devices widely use more operating systems, including Apple's iOS, Google's Android, RIM's BlackBerry OS, Microsoft's Windows Phone OS, HP's webOS, and many others. Even within these operating systems, there are several versions, which makes your task even more difficult.
- Mobile platform security features: Modern mobile platforms contain built-in security features to protect user data and privacy. These features act as a hurdle during forensic acquisition and examination. For example, modern mobile devices come with default encryption mechanisms from the hardware layer to the software layer. You might need to break through these encryption mechanisms to extract data from the devices. The FBI versus Apple encryption dispute was a watershed moment in this regard, where the security implementation of Apple prevented the FBI from breaking into an iPhone seized from an attacker in the San Bernardino case.
- Preventing data modification: One of the fundamental rules in forensics is to make sure that data on the device is not modified. In other words, any attempt to extract data from the device should not alter the data present on that device. But this is not practically possible with mobiles, because just switching on a device can change the data on that device. Even if a device appears to be in an off state, background processes may still run. For example, in most mobiles, the alarm clock still works even when the phone is switched off. A sudden transition from one state to another may result in the loss or modification of data.
- Anti-forensic techniques: Anti-forensic techniques, such as data hiding, data obfuscation, data forgery, and secure wiping, make investigations on digital media more difficult.
- Passcode recovery: If the device is protected with a passcode, the forensic examiner needs to gain access to the device without damaging the data on the device. While there are techniques to bypass the screen lock, they may not always work on all versions of the OS.
- Lack of resources: As mentioned earlier, with the growing number of mobile phones, the amount of tools required by a forensic examiner also increases. Forensic acquisition accessories, such as USB cables, batteries, and chargers for different mobile phones, have to be maintained in order to acquire those devices.
- Dynamic nature of evidence: Digital evidence may be easily altered either intentionally or unintentionally. For example, browsing an application on a phone might alter the data stored by that application on the device.
- Accidental reset: Mobile phones provide features to reset everything. Resetting a device accidentally while examining it may result in the loss of data.
- Device alteration: The possible ways to alter devices may range from moving application data or renaming files to modifying the manufacturer's operating system. In this case, the expertise of the suspect should be taken into account.
- Communication shielding: Mobile devices communicate over cellular networks, Wi-Fi networks, Bluetooth, and infrared. As device communication might alter the device data, the possibility of further communication should be eliminated after seizing the device.
- Lack of availability of tools: There is a wide range of mobile devices. A combination of tools needs to be used, because a single tool may not support all the devices or perform all the necessary functions. So, choosing the right tool for a particular phone might be difficult.
- Malicious programs: The device might contain malware or malicious software, such as a virus or a Trojan. These programs may try to spread over other devices over either a wired interface or a wireless one.
- Legal issues: Mobile devices might be involved in crimes that cross geographical boundaries. In order to tackle these multi-jurisdictional issues, the forensic examiner should be familiar with the nature of the crime and the regional laws.
Let's have a look at the process of evidence extraction in the next section.
Evidence extraction and the forensic examination of different mobile devices may differ based on various factors. However, following a consistent examination process will help the forensic examiner to ensure that the evidence gathered from each phone is well documented and that the results are reliable. There is no well-established standard process for mobile forensics.
However, the following diagram provides an overview of process considerations for the extraction of evidence from mobile devices. All methods used when extracting data from mobile devices should be tested, validated, and well documented:
As shown in the preceding diagram, forensics on a mobile device includes several phases, from the evidence intake phase to the archiving phase. The following sections provide an overview of various considerations across all the phases.
The evidence intake phase is the starting phase and involves paperwork that captures ownership information and the type of incident the mobile device was involved in, and outlines the kind of data the requester is seeking. Developing specific objectives for each examination is the critical part of this phase. It serves to clarify your goals. Before the physical seizure process begins, you should be familiar with federal, state, and local laws pertaining to an individual's rights. If the right procedures are not followed, the investigation may be considered illegal in a court of law. The procedure and the legality may vary based on whether you are a government agent or a private party. For example, in the US, fourth amendment rights prevent any searching or seizure by a government agent without having a proper search warrant. The search warrant should clearly authorize the seizure of the mobile device as well as the kind of data that needs to be collected. After a successful seizure, care should be taken to ensure that a chain of custody is established not only for the device but also for the data collected.
Also, while seizing the device, care should be taken not to modify any data present on the device. At the same time, any opportunity to help the investigation should not be missed. For example, at the time of seizing the device, if the device is unlocked, then try to disable the passcode.
The forensic examiner should identify the following details for every examination of a mobile device:
- The legal authority
- The data that needs to be extracted
- The make, model, and identifying information for the device
- Data storage media
- Other sources of potential evidence
We will discuss each of these in the following sections.
It is important for the forensic examiner to determine and document what legal authority exists for the acquisition and examination of the device, as well as any limitations placed on the media prior to the examination of the device. For example, if the investigation on the device is being conducted based on a warrant, the search should be limited only to those areas that are defined in the warrant. In short, prior to the device seizure, you need to answer the following questions:
- If a search warrant does not exist, has the device owner consented to the search?
- If a search warrant exists, is the device included within the original warrant?
- If the device is included in the warrant, does it also define what data can be collected?
- If it's a corporate investigation, is the device owned by an individual or his or her employer?
- Does the corporate policy allow collection and subsequent analysis?
You will identify how in-depth the examination needs to be based upon the data requested. The goal of the examination makes a significant difference in selecting the tools and techniques to examine the phone and increases the efficiency of the examination process.
As part of the examination, identifying the make and model of the phone assists in determining what tools would work with the phone. When available, it is recommended to capture the following details of the seized device:
- The device manufacturer
- The device model number
- The mobile device serial number
- The color of the device
- The wallpaper visible on the device screen or lock screen wallpaper
- The presence of any hardware components (such as front camera, headphone jack, and so on)
- A description of any specific details unique to the device (scratches, broken screen, and so on)
Next, let's look at data storage media.
Many mobile phones provide an option to extend memory with removable storage devices. In cases when such removable media is found in a mobile phone that is submitted for examination, the storage card should be removed and processed using traditional digital forensic techniques. It is wise to also acquire the card while in the mobile device to ensure that data stored on both the handset memory and card are linked for easier analysis. This will be discussed in detail in the upcoming chapters.
Mobile phones act as good sources of fingerprint and other biological evidence. Such evidence should be collected prior to the examination of the mobile phone to avoid contamination issues, unless the collection method will damage the device. Examiners should wear gloves when handling the evidence.
Once the mobile phone model is identified, the preparation phase involves research regarding the particular mobile phone to be examined and the appropriate methods and tools to be used for acquisition and examination. This is generally done based on the device model, underlying operating system, its version, and so on. Also, the tools that need to be used during an examination will have to be determined based on the device in question as well as on the scope and goals of the examination.
Mobile phones are, by design, intended to communicate via cellular phone networks, Bluetooth, infrared, and wireless (Wi-Fi) network capabilities. When a phone is connected to a network, new data is added to the phone through incoming calls, messages, and application data, which modifies the evidence on the phone.
Complete destruction of data is also possible through remote access or remote wipe commands. For this reason, isolation of the device from communication sources is important prior to the acquisition and examination of the device. Network isolation can be done by placing the phone in radio frequency shielding cloth and then putting the phone in airplane or flight mode. Airplane mode disables a device's communication channels, such as cellular radio, Wi-Fi, and Bluetooth. However, if the device is screen-locked, then this is not possible. Also, since Wi-Fi is now available in airplanes, some devices now have Wi-Fi access enabled in airplane mode.
An alternate solution is isolation of the phone through the use of Faraday bags, which block radio signals to or from the phone. Faraday bags contain materials that block external static electrical fields (including radio waves). Thus, Faraday bags shield seized mobile devices from external interference to prevent wiping and tracking. To work more conveniently with seized devices, Faraday tents and rooms also exist.
Once a phone has been isolated from communication networks, the actual processing of the mobile phone begins. One of the challenges that you will face in this phase is identifying which tools to use, as this is affected by a variety of factors such as price, ease of use, applicability, and so on. Mobile forensic software is highly expensive, and unlike with computer forensics, you may sometimes have to use multiple tools to access data. While selecting a tool, ensure that it has built-in features to maintain forensic integrity. Maintaining forensic integrity requires a tool that packages collected data in a format that probably cannot be easily modified or altered.
The phone should be acquired using a tested method that is repeatable and is as forensically sound as possible. Physical acquisition is the preferred method as it extracts the raw memory data and the device is commonly powered off during the acquisition process. On most devices, the smallest number of changes occur to the device during physical acquisition. If physical acquisition is not possible or fails, an attempt should be made to acquire the filesystem of the mobile device. A logical acquisition should always be performed as it may contain only the parsed data and provide pointers to examine the raw memory image. These acquisition methods are discussed in detail in later chapters.
After processing the phone, you need to verify the accuracy of the data extracted from the phone to ensure that data has not been modified. The verification of the extracted data can be accomplished in several ways:
- Comparing the extracted data to the handset data: Check whether the data extracted from the device matches the data displayed by the device if applicable. The data extracted can be compared to that on the device itself or a logical report, whichever is preferred. Remember, handling the original device may make changes to the only evidence—the device itself.
Using multiple tools and comparing the results: To ensure accuracy, use multiple tools to extract the data and compare results.
Using hash values: All image files should be hashed after acquisition to ensure that data remains unchanged. If filesystem extraction is supported, you can extract the filesystem and then compute hashes for the extracted files. Later, any individually extracted file hash is calculated and checked against the original value to verify the integrity of it. Any discrepancy in hash values must be explicable (for example, the device was powered on and then acquired again, so the hash values are different).
The forensic examiner is required to document, throughout the examination process, everything related to what was done during acquisition and examination. Once you complete the investigation, the results must go through some form of peer review to ensure that the data is checked and the investigation is complete. Your notes and documentation may include information such as the following:
- The examination start date and time
- The physical condition of the phone
- Photos of the phone and individual components
- Phone status when received—turned on or turned off
- Phone make and model
- Tools used for the acquisition
- Tools used for the examination
- Data found during the examination
- Notes from peer review
Throughout the investigation, it is important to make sure that the information extracted and documented from a mobile device can be clearly presented to any other examiner or to a court. Documentation is one of your most important skills. Creating a forensic report of data extracted from a mobile device during acquisition and analysis is important. This may include data in both paper and electronic format.
Your findings must be documented and presented in a manner that means that the evidence speaks for itself when in court. The findings should be clear, concise, and repeatable. Timeline and link analysis, features offered by many commercial mobile forensic tools, will aid in reporting and explaining findings across multiple mobile devices. These tools allow you to tie together the methods behind the communication of multiple devices.
Preserving the data extracted from a mobile phone is an important part of the overall process. It is also important that the data is retained in a usable format for the ongoing court process, for future reference, should the current evidence file become corrupt, and for record-keeping requirements. Court cases may continue for many years before a final judgment is arrived at, and most jurisdictions require that data be retained for long periods of time for the purposes of appeals. As the field and methods advance, new methods for pulling data out of a raw, physical image may surface, and then you can revisit the data by pulling a copy from the archives.
Now that we have understood how the evidence extraction process works, we will be looking into the different approaches in practical mobile forensics.
Similar to any forensic investigation, there are several approaches that can be used for the acquisition and examination/analysis of data from mobile phones. The type of mobile device, the operating system, and the security setting generally dictate the procedure to be followed in a forensic process. Every investigation is distinct with its own circumstances, so it is not possible to design a single definitive procedural approach for all cases. The following details outline the general approaches followed in extracting data from mobile devices.
One of the major factors in the data acquisition and examination/analysis of a mobile phone is the operating system. From low-end mobile phones to smartphones, mobile operating systems have come a long way with a lot of features. Mobile operating systems directly affect how you can access the mobile device. For example, Android gives terminal-level access whereas iOS does not give such an option.
A comprehensive understanding of the mobile platform helps the forensic examiner make sound forensic decisions and conduct a conclusive investigation. While there is a large range of smart mobile devices, with the demise of Blackberry, currently two main operating systems dominate the market, namely Google Android and Apple iOS (followed by Windows Phone at a distant third). More information can be found at https://www.idc.com/promo/smartphone-market-share/os. This book covers the forensic analysis of these three mobile platforms. We will provide a brief overview of the leading mobile operating systems.
Android is a Linux-based operating system, and it's a Google open source platform for mobile phones. Android is the world's most widely used smartphone operating system. Sources show that Apple's iOS stands second (https://www.idc.com/promo/smartphone-market-share/os). Android was developed by Google as an open and free option for hardware manufacturers and phone carriers. This makes Android the software of choice for companies who require a low-cost, customizable, lightweight operating system for their smart devices without developing a new operating system from scratch.
Android's open nature has further encouraged developers to build a large number of applications and upload them onto Google Play. Later, end users can download the applications from Android Market, which makes Android a powerful operating system. It is estimated that the Google Play Store has 3.3 million apps at the time of writing this book. More details on Android are covered in Chapter 7, Understanding Android.
iOS, formerly known as the iPhone operating system, is a mobile operating system developed and distributed solely by Apple Inc. iOS is evolving into a universal operating system for all Apple mobile devices, such as iPad, iPod Touch, and iPhone. iOS is derived from macOS and hence is based on a Unix-like operating system. iOS manages the device hardware. The technologies required to implement native applications are also provided by iOS. It also ships with various system applications, such as Mail and Safari, which provide standard system services to the user. iOS-native applications are distributed through the App Store, which is closely monitored by Apple. More details about iOS are covered in Chapter 2, Understanding the Internals of iOS Devices.
Windows Phone is a proprietary mobile operating system developed by Microsoft for smartphones and pocket PCs. It is the successor to Windows Mobile and is primarily aimed at the consumer market rather than the enterprise market. The Windows Phone operating system is similar to the Windows desktop operating system, but it is optimized for devices with a small amount of storage. Windows Phone basics and forensic techniques are discussed in Chapter 12, Windows Phone Forensics.
Mobile phone forensic acquisition and analysis involves manual effort and the use of automated tools. There are a variety of tools that are available for performing mobile forensics. All the tools have their pros and cons, and it is fundamental that you understand that no single tool is sufficient for all purposes. So, understanding the various types of mobile forensic tools is important for forensic examiners.
When identifying the appropriate tools for the forensic acquisition and analysis of mobile phones, a mobile device forensic tool classification system developed by Sam Brothers (shown in the following diagram) comes in handy for examiners:
The objective of the mobile device forensic tool classification system is to enable an examiner to categorize forensic tools based on the examination methodology of the tool. As you move from the bottom of the pyramid to the top, the methods and tools used for analysis generally become more technical and sophisticated and require longer analysis times. There are advantages and disadvantages of different techniques used at each layer. The forensic examiner should be aware of these issues before he or she applies a particular technique. Evidence can be destroyed completely if the given method or tool is not properly utilized. This risk increases as you move up in the pyramid. Thus, proper training is required to obtain the highest success rate in data extraction from mobile devices.
Each existing mobile forensic tool can be classified under one or more of the five levels. The following sections contain a detailed description of each level.
The manual extraction method involves simply scrolling through the data on the device and viewing the data on the phone directly through the use of the device's keypad or touchscreen. The information discovered is then photographically documented. The extraction process is fast and easy to use, and it will work on almost every phone. This method is prone to human error, such as missing certain data due to unfamiliarity with the interface. At this level, it is not possible to recover deleted information and grab all the data.
There are some tools, such as Project-A-Phone, that have been developed to help an examiner to easily document a manual extraction. However, this might also result in the modification of data. For example, viewing an unread SMS will mark it as read.
Logical analysis involves connecting the mobile device to forensic hardware or to a forensic workstation via a USB cable, an RJ-45 cable, infrared, or Bluetooth. Once connected, the computer initiates a command and sends it to the device, which is then interpreted by the device's processor. Next, the requested data is received from the device's memory and sent back to the forensic workstation. Later, you can review the data.
Most of the forensic tools currently available work at this level of the classification system. The extraction process is fast and easy to use and requires little training for you. On the flip side, the process may write data to the mobile and might change the integrity of the evidence. In addition, deleted data is not generally accessible with this procedure.
A hex dump, also referred to as a physical extraction, is achieved by connecting a device to a forensic workstation and pushing unsigned code or a bootloader into the phone and instructing the phone to dump memory from the phone to the computer. Since the resulting raw image is in binary format, technical expertise is required to analyze it. The process is inexpensive, provides more data to the examiner, and allows the recovery of deleted files from the device-unallocated space on most devices.
Chip-off refers to the acquisition of data directly from the memory chip present in the device. At this level, the chip is physically removed from the device and a chip reader or a second phone is used to extract data stored on it. This method is more technically challenging, as a wide variety of chip types are used in mobiles. The process is expensive and requires hardware-level knowledge as it involves the desoldering and heating of the memory chip. Training is required to successfully perform a chip-off extraction. Improper procedures may damage the memory chip and render all data unsalvageable. When possible, it is recommended that the other levels of extraction are attempted prior to chip-off, since this method is destructive in nature. Also, the information that comes out of memory is in a raw format and has to be parsed, decoded, and interpreted. The chip-off method is preferred in situations where it is important to preserve the state of memory exactly as it exists on the device. It is also the only option when a device is damaged but the memory chip is intact.
The chip on a device is often read using the Joint Test Action Group (JTAG) method. The JTAG method involves connecting to Test Access Ports (TAPs) on a device and forcing the processor to transfer the raw data stored on the memory chip. The JTAG method is generally used with devices that are operational but inaccessible using standard tools. Both of these techniques also work even when the device is screen-locked.
The micro read process involves manually viewing and interpreting data seen on the memory chip. The examiner uses an electron microscope and analyzes the physical gates on the chip and then translates the gate status to 0s and 1s to determine the resulting ASCII characters. The whole process is time-consuming and costly, and it requires extensive knowledge and training on memory and the filesystem. Due to the extreme technicalities involved in micro read, it is only attempted for high-profile cases equivalent to a national security crisis after all other levels of extraction techniques have been exhausted. The process is rarely performed and is not well documented at this time. Also, there are currently no commercial tools available to perform a micro read.
Data acquisition is the process of imaging or otherwise extracting information from a digital device and other attached media. Acquiring data from a mobile phone is not as simple as a standard hard drive forensic acquisition. The following points break down the three types of forensic acquisition methods for mobile phones: physical, logical, and manual. These methods may have some overlap with a couple of levels discussed in the mobile forensics tool leveling system. The amount and type of data that can be collected will vary depending on the type of acquisition method being used. While we cover these methods in detail in the upcoming chapters, the following is a brief description of them.
Physical acquisition of a mobile device is nothing but a bit-by-bit copy of the physical storage. With direct access to flash memory, information can be acquired from the device through physical extraction. Flash memory is non-volatile memory and is primarily used in memory cards and USB flash drives as solid-state storage. The process creates a bit-for-bit copy of an entire filesystem, similar to the approach taken in computer forensic investigations. Physical acquisition is able to acquire all of the data present on a device, including the deleted data, and access to unallocated space on most devices.
Logical acquisition is about extracting logical storage objects, such as files and directories, that reside on a filesystem. The logical acquisition of mobile phones is performed using the device manufacturer's application programming interface to synchronize the phone's contents with a computer. Many forensic tools can perform a logical acquisition. It is much easier for a forensic tool to organize and present data extracted through logical acquisition. However, the forensic analyst must understand how the acquisition occurs and whether the mobile was modified in any way during the process. Depending on the phone and forensic tools used, all or some of the data is acquired. A logical acquisition is easy to perform and only recovers the files on a mobile phone and does not recover data contained in unallocated space.
With mobile phones, physical acquisition is usually the best option, and logical acquisition is the second-best option. Manual extraction should be the last option when performing the forensic acquisition of a mobile phone. Both logical and manual acquisition can be used to validate findings in the physical data. During manual acquisition, the examiner utilizes the user interface to investigate the contents of the phone's memory. The device is used normally through keypad or touchscreen and menu navigation, and the examiner takes pictures of each screen's contents. Manual extraction introduces a greater degree of risk in the form of human error, and there is a chance of deleting evidence. Manual acquisition is easy to perform and only acquires the data that appears on a mobile phone.
Next, let's look at the amount of information that can be extracted from mobile phones.
The range of information that can be obtained from mobile phones is detailed in this section. Data on a mobile phone can be found in a number of locations—SIM card, external storage card, and phone memory, for example. In addition, the service provider also stores communication-related information. This book primarily focuses on data acquired from a phone's memory. Mobile device data extraction tools recover data from a phone's memory. Even though data recovered during forensic acquisition depends on the mobile model, in general, the following data is common across all models and useful as evidence. Note that most of the following artifacts contain timestamps:
- Address book: This contains contact names, phone numbers, email addresses, and so on.
- Call history: This contains dialed, received and missed calls and call duration.
- SMS: This contains sent and received text messages.
- MMS: This contains media files such as sent and received photos and videos.
- E-mail: This contains sent, drafted, and received email messages.
- Web browser history: This contains the history of websites that have been visited.
- Photos: This contains pictures that were captured using the mobile phone camera, those downloaded from the internet, and those transferred from other devices.
- Videos: This contains videos that are captured using the mobile camera, those downloaded from the internet, and those transferred from other devices.
- Music: This contains music files downloaded from the internet and those transferred from other devices.
- Documents: This contains documents created using the device's applications, those downloaded from the internet, and those transferred from other devices.
- Calendar: This contains calendar entries and appointments.
- Network communication: This contains GPS locations.
- Maps: This contains places the user visited, looked-up directions, and searched and downloaded maps.
- Social networking data: This contains data stored by applications, such as Facebook, Twitter, LinkedIn, Google+, and WhatsApp.
- Deleted data: This contains information deleted from the phone.
Next, we will have a quick look at the final step of investigation: examination and analysis.
This is the ultimate step of the investigation, and it aims to uncover data that is present on the device. Examination is done by applying well-tested and scientific methods to conclusively establish results. The analysis phase is focused on separating relevant data from the rest and probing for data that is of value to the underlying case. The examination process starts with a copy of the evidence acquired using some of the techniques described previously, which will be covered in detail in coming chapters. Examination and analysis using third-party tools is generally performed by importing the device's memory dump into a mobile forensics tool that will automatically retrieve the results. Understanding the case is also crucial to performing a targeted analysis of the data. For example, a case about child pornography may require focusing on all of the images present on the device rather than looking at other artifacts.
It is important that you have a fair knowledge of how the forensic tools that are used for examination work. Proficient use of the features and options available in a tool will drastically speed up the examination process. Sometimes, due to programming flaws in the software, a tool may not be able to recognize or convert bits into a format comprehensible by you. Hence, it is crucial that you have the necessary skills to identify such situations and use alternate tools or software to construct the results. In some cases, an individual may purposefully tamper with the device information or may delete/hide some crucial data. Forensic analysts should understand the limitations of their tools and sometimes compensate for them to achieve the best possible results.
Courtrooms rely more and more on the information inside a mobile phone as vital evidence. Prevailing evidence in court requires a good understanding of the rules of evidence. Mobile forensics is a relatively new discipline, and laws dictating the validity of evidence are not widely known, and they also differ from country to country. However, there are five general rules of evidence that apply to digital forensics and need to be followed in order for evidence to be useful. Ignoring these rules makes evidence inadmissible, and your case could be thrown out. These five rules are admissible, authentic, complete, reliable, and believable:
- Admissible: This is the most basic rule and a measure of evidence validity and importance. The evidence must be preserved and gathered in such a way that it can be used in court or elsewhere. Many errors can be made that could cause a judge to rule a piece of evidence as inadmissible. For example, evidence that is gathered using illegal methods is commonly ruled inadmissible.
- Authentic: The evidence must be tied to the incident in a relevant way to prove something. The forensic examiner must be accountable for the origin of the evidence.
- Complete: When evidence is presented, it must be clear and complete and should reflect the whole story. It is not enough to collect evidence that just shows one perspective of an incident. Presenting incomplete evidence is more dangerous than not providing any evidence at all, as it could lead to a different judgment.
- Reliable: Evidence collected from the device must be reliable. This depends on the tools and methodology used. The techniques used and evidence collected must not cast doubt on the authenticity of the evidence. If you used some techniques that cannot be reproduced, the evidence is not considered unless those considering the evidence, such as the judge and jury, are directed to do so. This would include possible destructive methods such as chip-off extraction.
- Believable: A forensic examiner must be able to explain, with clarity and conciseness, what processes they used and how the integrity of the evidence was preserved. The evidence presented by you must be clear, easy to understand, and believable by the jury.
Now let's look at best practices.
Good forensic practices apply to the collection and preservation of evidence. A lack of sound forensic practices may even render the evidence collected useless before a court of law. The modification of evidence, either intentional or accidental, can affect a case. So, understanding best practices is critical for forensic examiners.
With advanced smartphone features such as Find My iPhone and remote wipes, securing a mobile phone in a way such that it cannot be remotely wiped is of great importance. Also, when the phone is powered on and has service, it constantly receives new data. To secure the evidence, use the right equipment and techniques to isolate the phone from all networks. With isolation, the phone is prevented from receiving any new data that would cause active data to be deleted. Depending on the case, other forensic techniques such as fingerprint matching may need to be employed to establish a connection between the device and its owner. If the device is not handled in a secure manner, physical evidence may be unintentionally tampered with and may be rendered useless.
It is also important to collect any peripherals, associated media, cables, power adapters, and other accessories that are present at the scene. At the scene of investigation, if the device is found to be connected to a personal computer, pulling it directly would stop the data transfer. Instead, it is recommended to capture the memory of the personal computer before pulling the device, as this contains significant details in many cases.
As evidence is collected, it must be preserved in a state that is acceptable in court. Working directly on the original copies of evidence might alter it. So, as soon as you recover a raw disk image or files, create a read-only master copy and duplicate it. In order for evidence to be admissible, there must be a scientific method to validate that the evidence submitted is exactly the same as the original collected. This can be accomplished by creating a forensic hash value of the image.
After duplicating the raw disk image or files, compute and verify the hash values for the original and the copy to ensure that the integrity of the evidence is maintained. Any changes in hash values should be documented and explicable. All further processing or examination should be performed on copies of the evidence. Any use of the device might alter the information stored on the handset. So, only perform the tasks that are absolutely necessary.
Whenever possible, a record of all visible data should be created. It is recommended to photograph the mobile device along with any of the other media found, such as cables, peripherals, and so on. This will be helpful if questions arise later on about the environment. Do not touch or lay hands on the mobile device when photographing it. Ensure that you document all the methods and tools that are used to collect and extract the evidence. Detail your notes so that another examiner can reproduce them. Your work must be reproducible; if it is not, a judge may rule it inadmissible. It's important to document the entire recovery process, including all the changes made during the acquisition and examination. For example, if the forensic tool used for the data extraction sliced up the disk image to store it, this must be documented. All changes to the mobile device, including power cycling and syncing, should be documented in your case notes.
Reporting is the process of preparing a detailed summary of all the steps taken and conclusions reached as part of an examination. Reporting should include details about all the important actions performed by you, the results of the acquisition, and any inferences drawn from the results. Most of the forensic tools come with built-in reporting features that will autogenerate the reports while providing scope for customization at the same time. In general, a report may contain the following details:
- Details of the reporting agency
- Case identifier
- Forensic investigator
- Identity of the submitter
- Date of evidence receipt
- Details of the device seized for examination including serial number, make, and model
- Details of the equipment and tools used in the examination
- Description of steps taken during examination
- Chain of custody documentation
- Details of findings or issues identified
- Evidence recovered during the examination, ranging from chat messages, browser history, and call logs to deleted messages, and so on
- Any images captured during the examination
- Examination and analysis information
- Report conclusion
Modern mobile devices store a wide range of information, such as SMS, call logs, browser history, chat messages, location details, and so on. Hence they are often a key factor in several criminal cases, reconstruction of events, corporate and legal cases, and more. Mobile device forensics also comes with its own challenges and concepts that fall outside the boundaries of traditional digital forensics. Extreme care should be taken while handling the device, right from the evidence intake phase to the archiving phase. Examiners responsible for mobile devices must understand the different acquisition methods and the complexities of handling data during analysis. Extracting data from a mobile device is half the battle. The operating system, security features, and type of smartphone will determine the amount of access you have to the data. It is important to follow sound forensic practices and make sure that the evidence is unaltered during the investigation.
The next chapter will provide an insight into iOS forensics. You will learn about the filesystem layout, security features, and the way files are stored on an iOS device.