Sometimes, The Data Isn’t There (anymore)

November 18, 2015

Sometimes, the Data Isn’t There (anymore)

Being a digital forensic services provider in the private sector, we service a wide array of client’s needs.  It is fairly common for our clients to be involved in litigation and investigations ranging from divorce to employment disputes and other criminal and civil matters.  Many times, the evidence they’re looking for may have once resided on a mobile device, but upon performing the data extraction and analysis, we have to regrettably inform them that we cannot recover the data they are looking for.  Why does this happen, especially with mobile devices?  Let’s talk about it…

The first thing to realize is that deletion of data doesn’t get rid of the data, at least not completely.  Deletion simply tells the operating system that the data may be over-written when the operating system needs the space.  However, accessing the deleted data can be the problematic part.  Areas of particular interest to many of our clients are text and picture messages.  As I often tell attorneys when they call with these inquiries, the deleted data may or may not be there.  It really just depends on several factors.  They include:

1)      The type of device.  This goes back to the fight of the geeks: Apple or Android.  Apple is particularly popular and particularly secure with regard to deleted data.  Can we recover deleted text messages off an Apple iDevice.  Probably.  But several of these other factors also come into play.  Android devices are generally a little easier to recover deleted data because industry standard forensic tools will many times perform a full physical data extraction from the device, which means we get all deleted and non-deleted data.  Because Apple maintains propriety over the chipsets and algorithms on all devices newer than an iPhone 4, a full physical extraction is not currently possible… So whether or not we can get the deleted data on your Apple device is a big question that we won’t fully know the answer to until we perform an extraction and start our analysis.

2)      The capacity of the device.  The text (SMS) and picture (MMS) databases on mobile devices are somewhat flexible in size.  They will expand and contract, depending on the usage (see point 3).  However, if you buy a 16 GB iPhone or Android device, the overall memory capacity does become an issue, especially when taking point #3 into account.  We’ve had clients submit devices with over 44,000 text & picture messages in the database.  That’s a lot of space for text messages and if the database on your device is growing to a point where the operating system has to figure out where to store all of it, the likelihood that deleted messages will be over-written increases greatly.

3)      The level of usage of the device.  If you are seeking deleted messages from a user who doesn’t actually use the phone feature on their device and rather texts all of their communications, the likelihood that deleted messages will be over-written in time increases as well.  If the level of text database usage on the device is high, the priority of those deleted messages goes way down.

4)      The time in between the sending/receiving of the alleged messages of interest and when the mobile data extraction takes place.  If you’re interested in messages that have been deleted 8 months or a year prior to retaining a digital forensic consultant and the level of usage has been high on the device, the likelihood that we’ll recover those messages goes way down.  Again, it’s not impossible, but it does become less likely when combined with the other factors.  This is why we advise you to engage the services of a digital forensic consultant sooner rather than later.  The staleness of the data and potential spoliation becomes a greater concern as time goes on.

All Is Not Always Lost

One of the things we routinely have to do is come up with work-arounds for any number of problems that present themselves in cases.  In the case of lost deleted messages, we utilized one work-around that turned out great for our client.  

The client presented us with his iPhone 5s, which he claimed contained text messages from and ex-girlfriend who was claiming that he assaulted her.  His contention was that the content of the text messages exonerated him of this claim.  But when we went to examine the extraction, these messages, which were 5-6 months old and had been deleted, were not on the device.  However, in digital forensics, there’s more than one way to skin the proverbial cat. (don’t worry, we don’t actually skin cats in our lab)

The client indicated he backed up his iPhone on his computer at a time period much closer to the alleged incident.  So we incorporated our computer and mobile forensic skills to acquire that backup file and import it into the mobile forensic tools and voila!  There were the text messages that helped get him acquitted in the case.  Sometimes, it’s just that simple.  Sometimes, we need to try to access cloud data, synced data on a Mac or PC computer or other backup data to try and retrieve what we need, but just bear in mind that deleted is often combatted by archived.

What About Computers?

Computers are a different animal much of the time.  Most computers have greater memory capacity and more robust operating systems than mobile devices such as smart phones and tablets, so their potential data retention is much higher.  Just bear in mind that when something is deleted on a computer, just like on a mobile device, it is tagged for over-writing whenever the operating system needs it.  True deletion also removes much of the file-specific information like creation, modification and access dates & times.  Also consider that on a Mac or Windows computer, your files are still be recoverable if all you (or someone else) did was put it in the trash or recycle bin.  More & more, manufacturers are socially engineering users to put encryption into place by default, which will also have a greater impact on our ability to recover the data over time.  Even recovered deleted data, if it’s encrypted, doesn’t do anyone any good.

So at the risk of being overly repetitive, please call your digital forensic consultant sooner rather than later.  Once we have the extraction or forensic image (copy), the data is preserved and we can do all the analysis you need on it, even if it’s months down the road.  But having that proverbial ‘time capsule’ of your device could mean the difference between getting you what you need and not being able to access the data at all!

Author:

Patrick J. Siewert, SCERS, BCERT, LCE

Principal Consultant

Professional Digital Forensic Consulting, LLC

(Virginia DCJS #11-14869)

Based in Richmond, Virginia

Available Globally

We Find the Truth for a Living!

About the Author:

Patrick Siewert is the Principal Consultant of Pro Digital Forensic Consulting, based in Richmond, Virginia.  In 15 years of law enforcement, he investigated hundreds of high-tech crimes, incorporating digital forensics into the investigations, and was responsible for investigating some of the highest jury and plea bargain child exploitation cases in Virginia court history.  A graduate of both SCERS, BCERT, the Reid School of Interview & Interrogation and various online investigation schools (among others), Siewert continues to hone his digital forensic expertise in the private sector while growing his consulting & investigation business marketed toward litigators, professional investigators and corporations.

Email:  ProDigitalConsulting@gmail.com

Web: www.ProDigital4n6.com

Twitter: @ProDigital4n6

Digital Forensics vs. Data Extraction

 

April 16, 2015

Digital Forensics vs. Data Extraction

I was having lunch the other day with a good friend who is a very well-trained & accomplished Digital Forensic Examiner for the Virginia State Police.  He and I often get together and talk about trends in the industry, past cases, tools that work and tools that don’t among other things (we’re both avid motorcyclists).  He mentioned something again to me recently that I’ve heard him mentioned in the past.  “Forensics is all but dead”, he says. “Almost everyone now is just doing data extraction & reporting, not forensics.”

This comment spawned some more thought from me on the topic.  Is forensics almost dead?  There are several factors at play, not the least of which is the ubiquitous nature of digital forensics practices within government sectors.  These factors encompass personnel, practice, cost & overall expertise, to name a few.  I, for one, would like to think that forensics is not dead, rather going through an evolution of sorts, as most technology-oriented fields do over time.  So what’s the difference between digital forensics and data extraction?  Plenty!

Data Extraction & Reporting

I propose a hypothetical case:  Agent Smith is an investigative field agent.  He works child exploitation crimes for the Mayberry Police Department.  He receives an anonymous cybertip from the National Center for Missing & Exploited Children (NCMEC) that John Jones, who lives in Mayberry, has numerous images of child pornography on his smart phone.  Agent Smith does his due diligence in background case work and goes to visit Mr. Jones at his home for a knock-and-talk. 

Jones consents to talking to Agent Smith and further consents to have his phone examined, but refuses to let Agent Smith take the phone with him.  Smith pulls out his field kit, hooks up the phone to his laptop and starts the extraction.  Jones admits to nothing, the extraction is complete and a brief review on-scene of the images on the phone indicates there is illegal material, so Smith seizes the phone and arrests Jones based upon the images he found on-scene.  Now Agent Smith needs to dig further into the evidence to prove the case, but does he? 

Part of the problem and delicate balance with easy-to-use forensic tools (especially mobile forensic tools) is that they’re easy to use.  Point, click, extract, view, report, done!  This is simple data extraction, not digital forensics.  While some of the methods employed to acquire the data may be mostly forensically sound and/or within best practices, that’s about where the forensics ends.  The practice of data extraction simply pulls out the data Agent Smith needs to prove his case, not necessarily the whole story.  How did the images get on the device?  Who put them there?  When were they created?  Who else may have had access to the device (the anonymous tipster, perhaps)?  What additional inculpatory or exculpatory evidence may be present on the device?  In short, what does the whole picture look like?  These are questions that go mostly unanswered by simple data extraction & reporting.  This practice makes the evidence look very damning and very simple, where it may not be either. 

The Forensic Difference

Digital Forensics in the simplest definition goes far beyond simple data extraction.  Forensics looks at all of the available evidence with an open mind, objectively looking to prove or disprove the case from the start and looking to recover whatever relevant evidence that may be present.  The practice of forensics also looks much deeper than what can be found on the surface level.  Forensics seeks to answer questions like:

• Are there old partitions on the disk that can be recovered?  If so, what evidence might they contain to help prove or disprove the theory of the case?

• Are there deleted items in unallocated and/or file slack space that may provide proof of an attempt to cover up evidence?

•  Are there file fragments that could be recovered and/or pieced together to provide a clearer picture of what may have been going on at the time of the incident?

•  Are there logs of network connections, operating system journal entries, registry artifacts, encrypted or other data that needs to be examined at the hexadecimal level to put the pieces of the puzzle together?

All of these questions and more encompass just the basic differences between simple data extraction and digital forensics, which is much more complex.  It also requires much more training and hands-on experience.  I can honestly say that I don’t think I’ve ever conducted a true digital forensic examination where I didn’t have the need to research file types, headers, footers, applications and any number of other assorted case-specific items to help figure out what activity may have been going on with regard to the submitted device(s) and report those findings accurately & intelligently.  Indeed, digital forensics is true investigative work, not simply a point-and-click approach to recovering evidence.

Rationale

So why do so many field and some lab practitioners do data extraction rather than forensics?  There are several reasons.  The first, and easiest to explain, is laziness.  This may shock you, but some people are just plain lazy.  They can take a test, pass a certification and have all the on-paper credentials, but if they’re lazy and simply don’t want to do the work, none of that really matters.  The next factor is time, which can be closely related to laziness.  In the government sectors especially, examiners are pressured to turn over more cases in less time, especially when it comes to mobile devices.  A true digital forensic examination takes time and, oddly enough, some governmental supervisors don’t understand that.  It is entirely possible that a 64 GB smart phone or tablet full of valuable evidence could take much longer to examine than a 1TB hard drive that doesn’t really have much evidence at all.  Ask the bean-counters to wrap their heads around that one!

Along with extensive time goes money, but with digital forensics, it goes beyond that.  It takes not only an extensive investment in money, but time as well to get an examiner to a competent state.  In order to train a digital forensic examiner to be proficient, knowledgeable and effective requires a huge commitment.  Point-and-click classes take less time and are cheaper than weeks or months of in-depth digital forensic training and hands-on experience.  To add insult to injury, consider this:  I have a friend with whom I attended BCERT – a 5-week computer forensic “boot camp” of sorts.  He works at a local law enforcement agency at the level of Sergeant conducting digital forensic examinations.  He’s been at it for years and is a go-to resource for me whenever I have a question.  If he chooses to advance his career in law enforcement to the next rank (Lieutenant), he would have to quit doing forensics, go back in uniform on patrol and essentially give up that investment he and his department have made, thus starting all over again with a new, green examiner.  This practice is not limited to my friend’s department and is in fact commonplace in law enforcement and other government sectors.  What sense does that make?  Good question.  But the ultimate outcome is departments don’t want to spend that mountain of money to train somebody to my friend’s level again (and again), so they take the easy route:  Train them to get just what we need, i.e., data extraction. 

Conclusions

It seems to be a no-brainer - Trained, equipped, effective examiners are in the best interest of conducting thorough investigations and thus proving or disproving a case, which is in the best interest of justice.  Unfortunately, the general reality doesn’t reflect that.  Since I started in digital forensics in 2008, I’ve seen several cycles of examiners at the government level.  The highly-trained ones get cycled out and the newer ones have less and less training & experience at actually performing any forensics.  Conversely, the gap is widening between those who stick with the practice of digital forensics, whether it be in private or government practice, and those who are constantly in the refresh cycle of digital forensics. The smart get smarter & better and the newer ones keep doing data extraction, often not even submitting evidence to the lab unless it’s a “high-profile” case. 

This gap will undoubtedly get larger and the numbers of practitioners conducting data extractions will grow, while a few of us are continually staying up-to-date & trying to hone our skills.  At some point, the house of cards has to fall, but until it does, I really wish those doing simple data extraction would stop using the F-word: Forensics.

Author:

Patrick J. Siewert, SCERS, BCERT, LCE

Principal Consultant

Professional Digital Forensic Consulting, LLC

Based in Richmond, Virginia

Available Globally

About the Author:

Patrick Siewert is the Principal Consultant of Pro Digital Forensic Consulting, based in Richmond, Virginia.  In 15 years of law enforcement, he investigated hundreds of high-tech crimes, incorporating digital forensics into the investigations, and was responsible for investigating some of the highest jury and plea bargain child exploitation cases in Virginia court history.  A graduate of both SCERS and BCERT (among others), Siewert continues to hone his digital forensic expertise in the private sector while growing his consulting business marketed toward litigators, professional investigators and corporations.

Email:  ProDigitalConsulting@gmail.com

Web: www.ProDigital4n6.com

Twitter: ProDigital4n6