Mobile Phone Forensics

1. Mobile Phone Forensics David Benford MSc Forensic Computing & Security David Benford MSc Blackstage Forensics Limited

2. About me: • Criminal defence • Corporate • Security clearance • The Cavell Group • Charity Trustee David Benford MSc Blackstage Forensics Limited

3. ....the science of retrieving data from a mobile phone under forensically sound conditions.... David Benford MSc Blackstage Forensics Limited

4. Numbers: • 5.3 billion subscriptions by end of 2010 • (ITU.INT,2010) • Translates to 77% of world • 842 million subscribers in China • Asia-Pacific region including India and China account 47% of connections globally • 10 billion phones sold since ’94 • Nokia 3.4 billion • 30 million sold in UK annually “Five billion phones means there are more than three times as many phones as personal computers” Ben Wood Analyst, CCS Insight David Benford MSc Blackstage Forensics Limited

5. iPhone Sales Forecast to Hit 100 Million by 2011! (PCWorld.com, 2010) David Benford MSc Blackstage Forensics Limited

6. Digital Handheld Devices: • Smartphone • Basic Mobile Phone • SatNav & GPS • iPad, iPod & other Media Players • PDA & Pocket PC David Benford MSc Blackstage Forensics Limited

7. ACPO Guidelines: (www.acpo.police.uk) Principle 1:  No action taken by law enforcement agencies or their agents should change data held on a computer or storage media which may subsequently be relied upon in court. Principle 2:  In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions. Principle 3: An audit trail or other record of all processes applied to computer based electronic evidence should be created and preserved. An independent third party should be able to examine those processes and achieve the same result. Principle 4:  The person in charge of the investigation (the case officer) has overall responsibility for ensuring that the law and these principles are adhered to. David Benford MSc Blackstage Forensics Limited

8. Applications: • Criminal law • Civil law • Commercial law • Corporate applications – audits & tribunals • Crisis management • Cyber bullying David Benford MSc Blackstage Forensics Limited

9. Evidential data can be recovered from: • Device • SIM/USIM • Removable Media Storage • Backup David Benford MSc Blackstage Forensics Limited

10. Main Forensic Tools: • Microsystemation XRY/Xact • Cellebrite UFED • Oxygen Forensic Suite • Flasher Box – Hex dump David Benford MSc Blackstage Forensics Limited

11. SIM (Subscriber Identity Module) • or USIM (Universal Subscriber Identity Module) Forensics • International Mobile Subscriber Identity (IMSI) • Last dialled numbers • Location information • Contacts • Service provider name • ICCID (Integrated Circuit Card ID) 18 digit number • SMS text messages – including deleted David Benford MSc Blackstage Forensics Limited

12. Types of Data Extraction: • Logical • Usually done via vendor interface • for synchronising contents of phone with PC • Physical • Bit-by-bit copy of device via flash memory • Similar to computer extraction • 2 step – dump & decode • Manual • Done when no available tool • Chip Removal • Last resort • Read by commercial off the shelf memory programmer & then dump & decode David Benford MSc Blackstage Forensics Limited

13. Phone analysis: • No single tool • Variations in firmware versions • Vendor-specific modifications David Benford MSc Blackstage Forensics Limited

14. David Benford MSc Blackstage Forensics Limited

15. David Benford MSc Blackstage Forensics Limited

16. XRY (Logical) Process: • Learn device • Charge • Isolate • SIM clone • Faraday • Switch on • Time/date etc • Photographs • SIM extraction • Phone Extraction • Analyse & report • Manually record process David Benford MSc Blackstage Forensics Limited

17. Smartphones • Social networking • Instant messaging / VOIP • Location based services • Web Browsing activities • Email activity • App data David Benford MSc Blackstage Forensics Limited

18. Apple iPhone • Scaled down Mac OS x based on BSD • App Store • iTunes • iPad came first! • Location Services default • No one tool does it all • Pin lock is easily bypassed for media files David Benford MSc Blackstage Forensics Limited

19. David Benford MSc Blackstage Forensics Limited

20. Location Services : Friend or Foe? • Geotags • Social Networks • Augmented Reality • Blogs David Benford MSc Blackstage Forensics Limited

21. The iPhone and Fraud • Modifying data • Directly • iTunes David Benford MSc Blackstage Forensics Limited

22. David Benford MSc Blackstage Forensics Limited

23. David Benford MSc Blackstage Forensics Limited

24. David Benford MSc Blackstage Forensics Limited

25. David Benford MSc Blackstage Forensics Limited

26. Crossover: Phones & Computers • Smartphones are mini-computers • Backups • Windows 7 Shadow Volume Copies David Benford MSc Blackstage Forensics Limited

27. Future: • Clustering of phones to provide PC-like capabilities • PC Replacements – full-blown software • The Cloud • Payment by phone • Fully connected, location-aware devices • “Situationally & contextually aware tp present information accordingly” • (digitaltrends.com, 2010) • Development of A.R. • “ad hoc broadcast terminal at sporting events where you can view a video feed from a guy in the second row or up in the nose-bleed seats” • (digitaltrends.com, 2010) David Benford MSc Blackstage Forensics Limited

28. Conclusion David Benford MSc Blackstage Forensics Limited

29. References: CCS Insight Blog » Ben Wood. Available at: http://www.ccsinsight.com/blog/?author=3 [Accessed January 16, 2011]. Forensics. Available at: http://www.zdziarski.com/blog/?cat=8 [Accessed January 16, 2011]. iPhone Sales Forecast to Hit 100 Million by 2011 - PCWorld. Available at: http://www.pcworld.com/article/199237/iphone_sales_forecast_to_hit_100_million_by_2011.html [Accessed January 16, 2011]. Speeches and Disscussion Papers. Available at: http://www.itu.int/ITU-D/ict/papers/ [Accessed January 16, 2011]. The Future of Smartphones: 2010-2015 and Beyond. Available at: http://www.digitaltrends.com/features/the-future-of-smartphones-2010-2015-and-beyond/ [Accessed January 16, 2011]. David Benford MSc Blackstage Forensics Limited

30. Any Questions? David Benford MSc Blackstage Forensics Limited

31. Blackstage ForensicsCatton Hall,CattonDerbyshireDE12 8LNT: +44(0)1283 762559E:David@Blackstage-forensics.co.uk W: www.Blackstage-forensics.co.uk Charity: www.Cystinosis.org.uk Thank you for your attention! David Benford MSc Blackstage Forensics Limited