Pro Digital Forensic Consulting: smart phones

Showing posts with label smart phones. Show all posts

Saturday, November 3, 2018

FAQ Video Series: Mobile Forensics

What is mobile forensics and how can you use it for your case? In this edition of our Frequently Asked Questions videos, we provide an overview and answers questions about deleted and recovered text messages and more. Apple and Android are different and it's important that your mobile forensic analyst knows the proper approach to the specific device(s) in your case.

For more information, visit prodigital4n6.com, call 804-588-9877 or email: inquiries@prodigital4n6.com

Friday, May 13, 2016

Don’t Forget the Victim (And Their Device)!

May 13, 2016

Don’t Forget the Victim (And Their Device)!

Regardless if your case involves computers, tablets, iPhones, Android devices or all of the above, one thing the investigative community can agree on is, every case is different. Sure, certain cases will follow a workflow pattern, but the circumstances of every case, the suspects/targets, investigators and victims all take on different faces, which can alter your approach to conducting digital forensic analysis in the case slightly or dramatically. We’ve all seen a surge in criminal (and civil) cases involving smart phones and other mobile devices and with that comes the mountain of evidence that is contained on a those powerful pocket computers that store up to 128 GB of data (or more, depending on when you’re reading this). But consider this: You may only be getting half of the story if the only device you seize and analyze is that belonging to the target of your investigation.

Case Application

The best case example we can use to illustrate this point is the investigation of a rape allegation. Rape doesn’t happen in a bubble, it takes two people (or more) for a rape to occur. And virtually everyone involved in these incidents owns & uses a smart phone on a daily basis. Frequently, rape occurs when the alleged perpetrator knows the victim, either in some sort of early-stage relationship, a family friend, relative, etc. Because experienced investigators know this to be true and many reports will validate this, it is your investigative responsibility to prove or disprove the claim. In order to help do that, you need to seize not only the target’s phone data, but also the alleged victim’s phone data – all as soon as possible.

The best (and sometimes worst) thing about mobile device forensics is, once we have the data extraction, it’s ours. It is a digital snapshot of whatever was present on the device at the time the extraction took place and, depending on the device, may also give us access to deleted information. So in the interest of conducting a thorough investigation, I put forth that when an alleged rape victim makes the report, investigators should make it a regular and common practice to ask for consent to perform a data extraction on his/her phone. It is simply the easiest way to get a 360-degree view of the case.

A More Holistic View of the Data

Consider also what happens in the mind of the target after they know they may have committed a crime. Text and chat messages are deleted. Pictures of the alleged victim get erased from the device. They may even dispose of the device altogether and replace it with a new, fresh phone that has virtually no useful evidence contained on it. Wouldn’t it be nice if the other side of those conversations still existed on another device? What’s more, by grabbing the data from the alleged victim’s phone, you work toward a more complete investigation of the allegation. It is an unfortunate reality that there are often false reports of serious crimes. This certainly doesn’t mean that we automatically assume the victim may be lying, but it is our responsibility to fully investigate the case to determine what actually happened. Victims and eye witnesses are notoriously unreliable for different reasons. When victims are subjected to trauma, their accurate recollection of the incident can suffer to a degree, so that puts even more oneness on the investigator to try and piece the puzzle together.

The best part about the data is, it doesn’t lie. It has a perfect memory and it’s all documented, complete with date and time stamps, exif metadata, GPS coordinates, network activity and other great pieces of evidence that are very hard to spoof or fake, if not nearly impossible for most mobile device users.

Spoofing is a Thing

While the data doesn’t lie, it can be manipulated somewhat by either or both parties. As demonstrated in this news piece we helped out with, one can simply download a free app, assign a desired number to it and send text messages to themselves as if they were someone else, perhaps an ex-boyfriend or some other acquaintance. Then, if the messaging app is deleted, to the untrained investigator, this evidence looks legitimate on its face. But it’s only part of the story.

In the somewhat rare instance where this happens, it is absolutely vital to get the alleged victim’s cell phone dump. Getting even a logical extraction from the device might show what happened, but it’s always advisable to get as much data as you can in the form of a physical extraction, SIM card data, SD card image, etc. I realize these things may take time, but remember, the victim came to you for help. If they back off on wanting that help, don’t ignore your instincts. That could be a warning sign that you’re dealing with a false claim.

A Brief Note About Encryption

Encryption is the big bugaboo in forensics. More and more devices are coming to the consumer out-of-the-box with some sort of encryption already in place. Heck, this is the whole rub between Apple and the FBI…

But consider that if your suspect or target has a device with encryption in place, the alleged victim may be much more willing to hand over their device for extraction, whether their device is encrypted or not. From a law enforcement investigative perspective, the victim is generally much more cooperative and, in theory, would be willing to provide you with a passcode (as well as other potential credentials) in furtherance of the investigation on their behalf. It could be the only digital evidence you get!

Conclusion

Never forget there is always more than one person involved in the investigation. Grabbing the alleged victim’s cell phone data in this circumstance could mean the difference between an innocent person being convicted of a serious crime or being exonerated fully. When all the facts have been completely uncovered, the truth must remain and will have to hold up in a court of law.

Author:

Patrick J. Siewert, SCERS, BCERT, LCE

Principal Consultant

Professional Digital Forensic Consulting, LLC

Virginia DCJS #11-14869

Based in Richmond, Virginia

Available Globally

We Find the Truth for a Living!

About the Author:

Patrick Siewert is the Principal Consultant of Pro Digital Forensic Consulting, based in Richmond, Virginia. In 15 years of law enforcement, he investigated hundreds of high-tech crimes, incorporating digital forensics into the investigations, and was responsible for investigating some of the highest jury and plea bargain child exploitation cases in Virginia court history. A graduate of both SCERS, BCERT, the Reid School of Interview & Interrogation and various online investigation schools (among others), Siewert continues to hone his digital forensic expertise in the private sector while growing his consulting & investigation business marketed toward litigators, professional investigators and corporations.

Email: ProDigitalConsulting@gmail.com

Web: www.ProDigital4n6.com

Twitter: @ProDigital4n6

Monday, March 7, 2016

Apple vs. the F.B.I: Some Forensic Implications

March 7, 2016

Apple vs. the F.B.I: Some Forensic Implications

Never one to let a good legal-tech story opportunity go to waste, I started ruminating over the multitude of implications in the Apple vs. FBI matter. There are certainly many factors which will inevitably lead to a decision. These include legal, technical, ethical, moral and philosophical factors, many of which have been (correctly or incorrectly) espoused upon by pundits, politicians and bloggers. One of the main considerations, however, deals with the practice of mobile forensics and how any evidence gained from the hacked iPhone may affect future legal proceedings.

The Problem with the Request

Most mobile forensic practitioners will tell you that mobile forensics is not true forensics. This is because data on the device is always changing and cannot be proverbially frozen in a state when it is seized due to near-constant network connectivity and instant, minor changes being made to the device. Further, in order to obtain the data off the device, we generally have to alter a minimal amount of data to allow the acquisition computer to “handshake” the device and get the data extraction. Without boring any readers with the technical aspects of what goes on in this process, suffice it to say, this is the case in virtually every single mobile forensic data extraction performed.

The problem with the FBI’s court order to Apple is it is forcing them to alter data even more than the normal procedure calls for. The request calls for several changes to be made to the iOS operating system on the device in question to allow 1) unlimited attempts at a brute-force unlock (i.e., hack) of the device without the threat of a 10-tries-and-out data wipe and 2) to alter the iOS operating system to allow successive attempts at the brute-force unlock without the hassle of the time-out feature in between attempts, which works its way up to 1 hour. Simply put, the FBI doesn’t want to have to potentially wait up to 10,000 hours or so to unlock the device. None of these alterations of the operating system have ever been performed on any other evidence device, which opens the flood-gates to many questions with regard to exactly what data is being altered if and when Apple performs this procedure on the device in question.

The Daubert Standard

In 1993, forensic science in the courtroom got a proverbial slap in the face through what is now known as the Daubert Standard (See Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579). The case involved forensic expert procedures and testimony from a witness and dictated how forensic expert work and testimony should be judged from that point forward. The standards and issues are as follows:

What is the basic theory and has it been tested?
Are there standards controlling the technique?
Has the theory or technique been subjected to peer review and publication?
What is the known or potential error rate?
Is there general acceptance of the theory?
Has the expert adequately accounted for alternative explanations?
Has the expert unjustifiably extrapolated from an accepted premise to an unfounded conclusion?

I propose that most (or all) of the above-listed questions cannot be answered in the case of Apple vs. the FBI. The theory has not been tested (at least not that we know of). There are no standards controlling the technique because the technique has, in theory, never been attempted. Because it’s never been tested, it has not been subjected to peer review and publication. We have no idea the error rate (because it’s never been attempted). Acceptance of the theory is very much up for debate and is one big reason why the case has garnered so much attention. Whether or not the actual person performing this procedure would have to come to court in any subsequent proceeding would answer the last two points, but again, the procedure has never been done before, so how do we defend against any conclusions that are drawn as a result of the procedure?

Further, the results of the procedure need to be validated, repeatable and defensible. If the evidence the FBI gains from the phone leads to criminal charges and that criminal defendant hires an independent digital forensic analyst to perform a data extraction, analysis & reporting, how is he or she supposed to facilitate that? How is this procedure repeatable to an independent expert? Short answer, it isn’t… At least not under current circumstances.

The End is a Good Place to Start

A common theme in this blog is one coined by Stephen Covey: Begin with the end in mind. In this particular case, the FBI has a professional and ethical responsibility to begin with the end in mind and answer the questions, what do you hope to learn? What is your objective? What will you ultimately do with this data, should it present evidence of a crime?

The rules are in place for a reason. Innocent people get mixed up in investigations just like guilty people do. Everyone deserves a fair shake in the court system and the heart of forensic science is to find the truth based upon the evidence, no matter where that leads. So before we, as a society, choose sides with regard to who is the “good guy” and who is the “bad guy” in this case, perhaps we should ask the critical questions about the end-goal. Often times, that will direct you where you need to go with regard to proper procedure.