Cyber Forensics Flashcards

Flashcards on Cyber Forensics, Incident Response, Mobile Device Forensics, and IoT Forensics

Mobile Device Forensics Overview

The operation of the cellular network and service provider meta-data.

Three generations of mobile phones by the end of 2008

Analog, Digital personal communications service (PCS), Third-generation (3G).

Technologies 4G networks can use:

Orthogonal Frequency Division Multiplexing (OFDM), Mobile WiMAX, Ultra Mobile Broadband (UMB), Multiple Input Multiple Output (MIMO), Long Term Evolution (LTE).

Main Components Used for Communication:

Base transceiver station (BTS), Base station controller (BSC), Mobile switching center (MSC), Home Location Register (HLR), Interworking Functions (IWF), Visitor Location Register (VLR), Equipment Identity Register (EIR), Operation and Maintenance Center (OMC), Short Message Service Center (SMSC)

Cell network needs to keep:

Detailed information to enable cell handoff and for billing and usage purposes.

Data Set Contains:

Who he called and texted, how long each phone call lasted, the time of the communication, and the location of the cell tower contacted when outgoing calls were initiated.

Metadata Retention Laws in Australia:

Origin, destination, and time of phone calls, text messages, and emails are stored for at least two years.

Items stored on cell phones:

Incoming, outgoing, and missed calls; MMS and SMS messages; E-mail accounts; Instant-messaging logs; Web pages; Pictures, video, and music files.

Hardware Components of Mobile Devices:

Microprocessor, ROM, RAM, a digital signal processor, a radio module, a microphone and speaker, hardware interfaces, and an LCD display.

Electronically Erasable Programmable Read-Only Memory (EEPROM):

Enables service providers to reprogram phones without having to physically access memory chips.

Peripheral Memory Cards Used with PDAs:

Compact Flash (CF), MultiMediaCard (MMC), Secure Digital (SD).

Main concerns with mobile devices are:

loss of power, synchronization with cloud services, and remote wiping

Isolate the device from incoming signals with one of the following options:

Place the device in airplane mode, place the device in a paint can, use a Faraday cage/bag, turn the device off

Check these areas in the forensics lab:

Internal memory, SIM card, removable or external memory cards, network provider

Data Acquisition from Mobile: SIM contents includes:

International Mobile Subscriber Identity (IMSI), Integrated Circuit Card Identifier (ICC-ID).

The file system for a SIM card is a hierarchical structure:

Master File (MF), Dedicated File (DF), Elementary File (EF).

SIM card readers:

Combination hardware/software device used to access the SIM card.

Mobile Forensic Tool Classification:

Manual extraction, Logical extraction, Physical extraction (Hex Dumping), Physical extraction (Chip-off), Physical extraction (Micro Read)

Manual extraction tools:

Eclipse, Project-A-Phone.

Logical extraction tools:

Paraben’s Device Seizure, Susteen’s Data Pilot.

Physical extraction (Hex Dumping) tools:

CeleBrite’s UFED Touch Ultimate, RIFF Box.

Physical extraction (Chip-off) tools:

SD Flash Doctor, UP-828.

Physical extraction (Micro Read) tools:

High-power microscope.

The stored evidence can be found in:

Call history, SMS, Address book, Documents, Calendar, Videos, Photos, Web browser history, Email, Deleted data, Maps, Social networking data.

Paraben Software offers several tools:

E3:DS, DataPilot, BitPam.

The main IOS operating modes are:

Normal mode (secure bootchain), Recovery mode, DCFU mode (Boot ROM).

Backup files in iTunes contain copy of:

SMS, photos, calendar, music, call logs, configuration files, documents, keychains, network settings, cookies,…

Data base file systems for forensic investigations of Call history is located:

/private/var/mobile/Library/CallHistoryDB/CallHistory.storedata.

Data base file systems for forensic investigations of SMS Messages is located:

/private/var/mobile/Library/SMS/sms.db.

Data base file systems for forensic investigations of Address Book Contacts is located:

/private/var/mobile/Library/AddressBook/AddressBook.sqlitedb.

Consolidated GPScache location:

/private/var/root/Caches/locationd/consolidated.db

Photo metadata location:

/private/var/mobile/Media/PhotoData/Photos.sqlite

Notes location:

/private/var/mobile/Library/Notes/notes.sqlite

Voicemail location:

/private/var/mobile/Library/Voicemail/voicemail.db

Android Platform Architecture:

Linux Kernel, Native C/C++ Libraries, Android Runtime, Java API Framework, System Apps.

Android Security features:

Secure Kernel, Application Sandbox, The permission model, Application signing, Security Enhanced Linux, Full Disk Encryption, Trusted Execution Environment.

Main partitions on Android are:

/boot, /system, /data, /cache, /recovery, /misc, /sdcard.

Google Chrome location:

/data/data/com.android.chrome/appchrome/Default/Bookmarks, /data/data/com.android.chrome/appchrome/Default/History, /data/data/com.android.chrome/app_chrome/Default/Log in Data

Gmail location:

/data/data/com.google.android.gm/cache/@gmail.com, /data/data/com.google.android.gm/databases/suggestions.db

Whatsapp location:

/data/data/com.whatsapp/me

IoT Architecture includes various layers:

Application Layer, Middleware Layer, Internet Layer, Access Gateway Layer, Edge Technology Layer

Potential IoT vulnerabilities include:

No automatic security updates, improper communications and encryption, lack of secure storage and authentication

The IoT critical areas that the attackers could breach may include:

Device firmware & mobile application, Device memory, Device physical interface & network services, Local data storage & Cloud web interface, Device web interface & network traffic, Ecosystem access control & communication, Vendor & TTP backend APIs

Attackers can exploit IoT devices to steal data, cause physical damage to the network or launch other disruptive attacks:

DoS, Jamming, Ransomware, Sybil, Man-in-the-Middle, Replay, Side channel, Rolling code, Remote access attacks.

Standard forensic examination process can include:

Evidence identification and collection, Preservation, Analysis, Presentation and reporting.

To acquire data from smartwatches need to check:

Data API; Message API; and Node API.

Forensic Examination of Android Wearable Image:

Any tools can be used to forensically analyse the extracted artifcats, such as Autopsy, Magnet Axiom, IoT Inspector, NetOdin3, MD-NEXT.