Seeking the Truth from Mobile Evidence - Basic Fundamentals, Intermediate and Advanced Overview of Current Mobile Forensic Investigations

Title page......Page 2
Table of Contents......Page 3
Copyright......Page 15
Dedication......Page 18
Foreword......Page 19
Preface......Page 23
Acknowledgment......Page 26
Introduction......Page 28
Part 1. Basic, Fundamental Concepts......Page 36
Chapter 1. Defining Cell Phone Forensics and Standards......Page 37
Introduction......Page 38
Defining Cell Phone Forensics......Page 39
Chapter Summary Key Points......Page 50
Chapter 2. Evidence Contamination and Faraday Methods......Page 52
Introduction......Page 53
Evidence Contamination......Page 54
Faraday Origins......Page 58
Faraday Methods......Page 63
Chapter Summary Key Points......Page 71
Introduction—Chapter Disclosure......Page 74
The Legal Process......Page 75
Mobile Network Operators......Page 79
Mobile Virtual Network Operators......Page 80
Determining Target Number......Page 82
Chapter Summary Key Points......Page 87
Search Warrant Language......Page 91
Destructive Court Orders......Page 104
Chapter Summary Key Points......Page 109
Introduction to the Cellular Network......Page 112
Code Division Multiple Access......Page 114
Global Systems for Mobile Communications and Time Division Multiple Access......Page 115
Integrated Digital Enhanced Network......Page 116
Long-Term Evolution......Page 117
International Mobile Equipment Identity......Page 120
Subscriber Identity Module......Page 124
International Mobile Subscriber Identity......Page 125
Integrated Circuit Card Identifier......Page 126
How a Call Is Routed Through a Global System for Mobile Communications Network......Page 127
Chapter Summary Key Points......Page 133
Chapter 6. Subscriber Identity Module......Page 136
SIM Sizes......Page 137
Internal Makeup......Page 140
Where Is My Evidence?......Page 143
SIM Security......Page 149
Forensic SIM Cloning......Page 152
Chapter Summary Key Points......Page 154
Chapter 7. Device Identification......Page 157
Handset Communication Types......Page 158
The Form Factors......Page 164
Common Operating Systems......Page 171
Steps for Device Identification (Free)......Page 176
Removable Storage......Page 177
Chapter Summary Key Points......Page 178
Chapter 8. Triaging Mobile Evidence......Page 182
Introduction......Page 183
Devices Powered On......Page 184
Devices Powered Off......Page 193
Locked Devices Powered On......Page 199
Forensic Processing Triage Forms......Page 202
Chapter Summary Key Points......Page 204
Chapter 9. The Logical Examination......Page 207
Introduction—A “Logical” Home......Page 208
Computer Forensics and Mobile Forensics......Page 209
Connection Interfaces......Page 210
Agent or Client......Page 211
Communication Protocols......Page 215
Attention Terminal Commands......Page 216
Port Monitoring......Page 230
Chapter Summary Key Points......Page 236
Chapter 10. Troubleshooting Logical Examinations......Page 240
History of Common Problems......Page 241
Truck and Trailer Analogy......Page 244
Device Manager......Page 248
Advanced Tab (Device Manager)......Page 250
Using Log Files......Page 252
General Troubleshooting Steps......Page 254
Chapter Summary Key Points......Page 255
Chapter 11. Manual Examinations......Page 258
History......Page 259
Reasons for the Manual Examination......Page 260
Hardware Tools for Manual Extractions......Page 264
Software Solutions......Page 270
An Alternative Solution to Hardware and Software Vendors......Page 271
Chapter Summary Key Points......Page 274
Chapter 12. Report Writing......Page 277
History—Our Forensic Wheel......Page 278
A Final Report Example......Page 279
General Questions to Answer/Include in Your Report......Page 281
Initial Contact......Page 282
Documenting Other Initial Issues (DNA/Prints/Swabbing)......Page 284
Specific Tools and Versions Used......Page 286
Listing Parsed Data......Page 287
Reporting Issues and Anomalies......Page 289
Validation......Page 292
Methods of Reporting......Page 293
Other Formats and Proprietary Readers......Page 295
Hashing......Page 296
The Archive Disk......Page 297
Chapter Summary Key Points......Page 299
Part 2. Intermediate Concepts......Page 302
Chapter 13. Physical Acquisitions......Page 303
History......Page 304
Flasher Boxes......Page 305
Pros and Cons—Flasher Box Usage......Page 309
Bootloaders......Page 311
Current Popular Boxes......Page 312
Early Physical Examination Vendors and Tools......Page 314
MSAB and Cellebrite......Page 316
Chapter Summary Key Points......Page 318
Chapter 14. Physical Memory and Encoding......Page 321
NAND and NOR......Page 322
NAND Blocks, Spare Area, Operation Rules, Wear Leveling, Garbage Collection, and the SQLite Databases......Page 325
Encoding......Page 328
Chapter Summary Key Points......Page 341
Chapter 15. Date and Time Stamps......Page 344
Introduction “In the Beginning…”......Page 345
Epoch, GMT, and UTC......Page 347
Integers......Page 349
Formats......Page 350
Chapter Summary Key Points......Page 367
Chapter 16. Manual Decoding MMS......Page 370
Introduction—Lab Work......Page 371
Susteen—SV Strike and Burner Breaker......Page 372
MMS Carving......Page 375
Containers for MMS......Page 386
Chapter Summary Key Points......Page 388
Chapter 17. Application Data......Page 391
Introduction—A Last Argument......Page 392
Applications......Page 393
Supported Decoding—The Tip of the Iceberg......Page 395
Database Naming—It Does Not Always Stay Original......Page 397
Validating Database Content......Page 401
Sanderson Forensics SQLite Forensic Browser......Page 406
Write-Ahead Log Files......Page 412
Journal Files......Page 413
Blobs and Attachments......Page 415
Chapter Summary Key Points......Page 416
Introduction......Page 419
USB Monitoring—Can You Hear Me Now?......Page 421
UltraCompare Professional......Page 425
Chapter Summary Key Points......Page 436
Part 3. Advanced Concepts......Page 439
Chapter 19. Android User Enabled Security: Passwords and Gesture......Page 440
Introduction—Security on Androids......Page 441
Simple Security Values......Page 442
The Password Lock......Page 444
Hashcat......Page 445
The Pattern Lock (Gesture)......Page 453
SHA-1 Exercise......Page 455
Chapter Summary Key Points......Page 459
Chapter 20. Nondestructive Hardware and Software Solutions......Page 462
Introduction......Page 463
MFC Dongle......Page 464
IP Box......Page 466
Best Smart Tool......Page 467
FuriousGold......Page 470
XPIN Clip......Page 472
Other Methods......Page 476
Chapter Summary Key Points......Page 479
Chapter 21. Phone Disassembly and Water-Damaged Phones......Page 481
Fastening Methods......Page 482
Tools Used......Page 486
Removing Moisture (Water Damage)......Page 487
Suggestions—Saltwater Exposure......Page 493
Chapter Summary Key Points......Page 494
Chapter 22. JTAG (Joint Test Action Group)......Page 496
Introduction......Page 497
Joint Test Action Group......Page 498
How Joint Test Action Group Works......Page 499
Test Access Port......Page 500
Molex (Connections)......Page 507
Joint Test Action Group Issues......Page 508
Chapter Summary Key Points......Page 509
Chapter 23. JTAG Specialized Equipment......Page 511
Introduction—Slow and Deliberant......Page 512
Pogo Pins and Jigs......Page 513
Molex Parts......Page 514
Wires and Wire Harnesses......Page 516
JTAG Finder......Page 518
Precise Soldering Units......Page 522
Hot Glue, Rubber Bands, and Cardboard......Page 524
Chapter Summary Key Points......Page 526
Chapter 24. RIFF Box Overview......Page 529
Introduction......Page 531
RIFF Box Components......Page 532
JTAG Manager Software......Page 533
Saving the Binary Scan......Page 543
Manual Probing Test Access Ports......Page 545
RIFF 2 Overview......Page 547
Software and Driver Install......Page 548
DLLs and Account Manage......Page 550
Connector Pinout Locations......Page 552
General Purpose Input/Output......Page 553
eMMC/SD Access Tab......Page 554
Advanced Settings......Page 558
Chapter Summary Key Points......Page 559
Chapter 25. Z3X Box (Easy JTAG) Overview......Page 563
Easy-JTAG W/Cables and ISP Adaptor......Page 564
Software and Driver Install......Page 565
Additional Activations......Page 573
Easy JTAG Tool (Z3X EasyJtag Box JTAG Classic Suite)......Page 574
Reading Target Flash......Page 577
Chapter Summary Key Points......Page 581
Chapter 26. Thermal Chip Removal......Page 584
Introduction—Chain of Command Knowledge Phenomenon......Page 585
Research the Phone and Chip......Page 587
Is the Chip Encrypted?......Page 592
Prepping the Board......Page 593
Using Heat for Memory Removal......Page 595
Basic Removal Steps When Using Heat......Page 600
Chapter Summary Key Points......Page 603
Chapter 27. Nonthermal Chip Removal......Page 606
Removal Through a Cold Process......Page 607
Removing the Chip From the Board......Page 609
Milling......Page 614
Lap and Polishing......Page 615
ULTRAPOL Basic......Page 616
Chapter Summary Key Points......Page 620
Chapter 28. BGA Cleaning......Page 623
Introduction—Your First Car......Page 624
Examples From Thermal Use......Page 625
Equipment Used in Cleaning (Thermal)......Page 626
Steps Involved in Cleaning (Thermal Removed)......Page 628
The Re-tinning Process......Page 630
Reballing......Page 635
Case Example (Thermal Cleaning) Steps......Page 636
Chapter Summary Key Points......Page 638
Chapter 29. Creating an Image......Page 640
Introduction—Fish On!......Page 641
Reading the Memory......Page 642
Using the UP 828 and 828P Programmers......Page 644
SD Adaptors......Page 650
DediProg NuProg-E Programmer......Page 652
Imaging......Page 656
Regular Expression Searching......Page 671
Common Email Regular Expressions......Page 673
Chapter Summary Key Points......Page 677
Chapter 30. eMMC Reading and In-System Programming......Page 680
Introduction—Model Building......Page 681
How Does Communication Occur?......Page 682
Understand eMMC Support Versus ISP......Page 683
Researching ISP Connections......Page 686
Probing In-System Programming Connections......Page 689
Probing Example......Page 695
Undocumented Phones......Page 698
Wires and Jumper Boards......Page 706
Medusa Pro and Octoplus Pro JTAG......Page 707
Chapter Summary Key Points......Page 708
Closing Remarks......Page 710
Index......Page 712