Samsung Galaxy Camera Forensics
Total Page:16
File Type:pdf, Size:1020Kb
Combining technical and legal expertise to deliver investigative, discovery and forensic solutions worldwide. SAMSUNG GALAXY April 11, 2013 Introduction. The Samsung Galaxy camera was Operating System: Abstract released on November 16, 2012. This Android 4.1 (Jellybean) Samsung Galaxy Camera device has the potential to replace mobile Network:2G, 3G or 4G (LTE) phones, as it has the same functionality GSM, HSPA+ Forensics of a smartphone, with the additional perk of a high quality camera. This creates an Processor:1.4 GHz Quad Core attractive incentive to buy the camera, Memory:microSD, 4GB on The purpose of this project which could lead to the possibility of it board, 1GB RAM was to determine whether or not forensics on the Samsung Galaxy becoming more popular. Connectivity: WiFI As the camera’s popularity rises in the 802.11a/b/g/n, WiFi hotspot camera was possible. Although market, and more users purchase the the camera runs an Android device, the risk of the camera being used Bluetooth:Yes operating system, there was still a chance that no data could be in an illicit manner rises as well. As the GPS:Yes extracted, as forensics on this Samsung Galaxy camera is now a part device had never been done of an investigator’s scope, understanding Table 1. before. To begin the process of where any evidence can be retrieved Goals. this project, as much data as is crucial. Using several different The goal for this project was to possible had to be created on forensic tools, any data that could be of develop an informational guide for the the camera by utilizing all of the applications and features that evidentiary value is detailed in this paper. Samsung Galaxy camera. Due to the By providing a guide to finding crucial were offered. The next step was novelty of the product, it was crucial fora to find a forensic tool(s) capable data from the Samsung Galaxy camera, preliminary source to be created in order examiners analyzing this device in the of providing data that would to aid forensic examiners in working constitute as forensic artifacts. The future will be saving valuable time. with this device. In order to develop a major goal of this project was to forensic guide, the Samsung Galaxy find any artifacts and determine Samsung Galaxy Camera. camera had to be used as a normal user their locations on the camera, As aforementioned, the camera was would. All user data artifactshad to be in case the device is ever a part released on November 16, only two found in a forensic manner in order to of an investigation. By explor- months before it was received for this simulate a case in reality. The findings ing the way data is stored on the Samsung Galaxy camera, project. The specifications of the camera from this device make up the content of are provided in Table 1. A more detailed computer forensic examiners now this paper, and are placed in order for have an idea of what tools will chart can be found on gsmarena. investigators to navigate both the guide com. When this project first started, no work and what information can and the camera with ease. The locations be extracted. SIM card or data plan was provided, of possible evidence are all available although the camera does have these and easily referenced for any professional options available. The camera is meant analyzing the camera in search of data. to be used as a camera with networking Additionally, even with its well-known, capabilities and is not built to be a Android operating system, therewas mobile phone. Since the camera mostly possibility of the camera storing functions off WiFi, applications can be information differently than other devices. downloaded to allow the camera to act A secondary goal was to discover as a cell phone. continued on next page 44 Montgomery Street, Suite 700 San Francisco, CA 94104 415.524.7320 GALAXY, continued whether the acquisition of the camera was similar or Santoku. different from the same process on other Android devices. Santoku worked successfully and once the camera was connected to the guest machine, AFLogical was Methodology. used. AFLogical is a tool provided by viaForensics The Samsung Galaxy camera was received on January 8(viaForensics) and comes built into Santoku. This tool is 31, 2013 for the means of facilitating this project. open source and is used for mobile phones; it extracts call In order to get the most accurate results possible, an logs, contacts, SMS, and MMS. Although the camera is average user identity needed to be created. Use of the not considered a mobile phone, it runs Android, which camera had to be simulated as though an everyday provided a chance that some data could be pulled. person had purchased it and constantly utilized it. The Before extracting any data, AFLogical needed to name Sammy Sung was given to the camera and this be put onto the camera. To install AFLogical, Santoku avatar acted as a normal Galaxy camera user who tutorials were referenced (Kswartz). The command “adb frequently visited Facebook, Twitter, Gmail, Google Voice, devices”2 was first used to ensure the camera showed up and various other applications that came with the camera. in Santoku. Next, “adb install AFLogical-OSE_1.5.2.apk” Once Sammy’s identity was created, six accounts were was used to push the AFLogical software to the camera. associated with this name; Facebook, Samsung, Google, This resulted in the creation of an AFLogical application Twitter, Dropbox and Chaton. A full timeline of all the on the camera itself. Upon clicking it via the camera, the data created and deleted can be found in Appendix A. “Extract All” option was selected. Within Santoku, a new After the accounts were created and synced with directory was made for any output that was extracted from the camera, the next step was to begin using the the camera. To pull data from the camera, the command applications. Twenty applications and features were used “adb pull /sdcard/forensics” was executed (Figure 1). and will be discussed more extensively further on in this paper. Allapplications were used a multitude of times in order to generate enough data. Once enough was created, portions of data were deleted to understand where the Galaxy camera stored information and to determine if data could be recovered. Having a plentiful amount of data from social media networks, emails, text messages, pictures, and other applications, the next step was acquiring the camera. Considering that the Samsung Galaxy camera was new and no forensics had been done on it yet, deciding on a starting point for acquisition was a point of difficulty. At first, an attempt was made to image the device using FTK Imager and EnCase 6.19, to decide if it was possible. As expected, the camera was not recognized by either software and was showing in Windows Explorer as a portable media device. The next step was Oxygen Forensic Suite 2012. This Figure 1. software has a good track record of imaging mobile devices and it seemed like the best tool to use for the Once the extraction was complete, any files that project as it is available at the Leahy Center for Digital were pulled were found in the aforementioned directory. Investigation (LCDI). Unfortunately, Oxygen1 did not In this case, only one picture was extracted. This picture recognize the camera. The Linux forensic platform Santoku was attempted to be sent to a contact via the Messaging was then used in a virtual machine to test whether or not it application preinstalled on the camera. Since a data would detect the camera. Android is an operating system plan was not present, the picture was pending and never based on Linux, so there was a high possibility Santoku sent. No other data was pulled from the camera.Different would recognize the camera as something more than just results may occur depending on where data is stored on a media device. the camera by the user. Also, for any examiner who has 1. As research continued, it was found that Oxygen Forensic Suite 2013 could acquire the camera The findings were the same as those provided by EnCase 7 and are not discussed in this paper. It is just 2. Commands are executed without quotations. The commands mentioned throughout this paper are in another option for examiners to use if Oxygen is their tool of preference. quotations fordistinguishability. continued on next page GALAXY, continued access to AFLogical Law Enforcement software has a possibility of extracting more data. Concluding AFLogical was not the correct tool to use for this project, the next step was to see what other options Santoku offered. Santoku comes preinstalled with Android SDK. Android SDK is a software developer kit that comes with various tools for debugging and developing Android applications (Developer). Within this developer kit is Android Debug Bridge (ADB). This is a command line tool that enables a user to communicate with a connected Android device via computer (Developer). Using ADB allows for data to be pushed or pulled to or from an Android device. With the right ADB commands, information from logged data, system data, and port connectionscan be outputted. For the purpose of this project, the command ‘dumpsys’ was used. “Dumpsys provides information on services, memory, Figure 3. and other system details...” (Hoog 119). Running applications, process IDs and current system activities Below the Unix timestamp was the latitude are just some of the types of data that can be displayed. (44.4609067) and the longitude (-73.2159816) of This command was executed using “adb shell dumpsys the device on March 27 at 5:41 PM.