NIST SP 800-72, Guidelines on PDA Forensics
Total Page:16
File Type:pdf, Size:1020Kb
Special Publication 800-72 Sponsored by the Department of Homeland Security Guidelines on PDA Forensics Recommendations of the National Institute of Standards and Technology Wayne Jansen Rick Ayers NIST Special Publication 800-72 Guidelines on PDA Forensics Recommendations of the National Institute of Standards and Technology Wayne Jansen Rick Ayers C O M P U T E R S E C U R I T Y Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 November 2004 U.S. Department of Commerce Donald L. Evans, Secretary Technology Administration Phillip J. Bond, Under Secretary for Technology National Institute of Standards and Technology Arden L. Bement, Jr., Director Reports on Computer Systems Technology The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL’s responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL’s research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations. National Institute of Standards and Technology Special Publication 800-72 Natl. Inst. Stand. Technol. Spec. Publ. 800-72, 67 pages (2004) Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation o r endorsement by the National Institute of Standards and Technology, nor is it inten ded to imply that the entities, materials, or equipment are necessarily the best available for the purpose. Acknowledgements The authors, Wayne Jansen and Rick Ayers from NIST wish to express their thanks to colleagues who reviewed drafts of this document. In particular, their appreciation goes to Murugiah Souppaya and Tim Grance from NIST, Karen Kent from Booz-Allen-Hamilton, Barry Grundy from NASA – Office of Inspector General, Rick Mislan from Ferris State University, Joe Grand from Grand Idea Studio, and Eoghan Casey from Knowledge Solutions LLC for their research, technical support, and written contributions to this document. The authors would also like to express thanks to all others who assisted with our review process, including Susan Ballou from NIST’s Office of Law Enforcement Standards and those individuals who contributed input during the public comment period. This work was sponsored by the Department of Homeland Security (DHS), whose support and guidance in this effort are greatly appreciated. Guidelines on PDA Forensics Table of Contents TABLE OF CONTENTS............................................................................................................. V LIST OF FIGURES ....................................................................................................................VII LIST OF TABLES.................................................................................................................... VIII EXECUTIVE SUMMARY........................................................................................................... 1 1. INTRODUCTION.................................................................................................................. 2 1.1 AUTHORITY ...................................................................................................................... 2 1.2 PURPOSE AND SCOPE........................................................................................................ 2 1.3 AUDIENCE AND ASSUMPTIONS......................................................................................... 3 1.4 DOCUMENT STRUCTURE .................................................................................................. 3 2. BACKGROUND.................................................................................................................... 4 2.1 DEVICE CHARACTERISTICS .............................................................................................. 4 2.2 PALM OS........................................................................................................................... 6 2.3 POCKET PC ....................................................................................................................... 9 2.4 LINUX.............................................................................................................................. 12 2.5 GENERIC STATES ............................................................................................................ 14 3. FORENSIC TOOLS............................................................................................................. 16 3.1 PALM DD (PDD)............................................................................................................... 17 3.2 PILOT-LINK..................................................................................................................... 17 3.3 POSE .............................................................................................................................. 17 3.4 PDA SEIZURE................................................................................................................. 18 3.5 ENCASE .......................................................................................................................... 18 3.6 DUPLICATE DISK (DD).................................................................................................... 19 3.7 MISCELLANEOUS TOOLS ................................................................................................ 19 3.8 CUSTOM TOOLS .............................................................................................................. 20 4. PROCEDURES AND PRINCIPLES.................................................................................. 21 4.1 ROLES AND RESPONSIBILITIES ....................................................................................... 21 4.2 EVIDENTIAL PRINCIPLES ................................................................................................ 22 4.3 PROCEDURAL MODELS................................................................................................... 23 5. PRESERVATION ................................................................................................................ 26 5.1 SEARCH........................................................................................................................... 28 5.2 RECOGNITION ................................................................................................................. 28 5.3 DOCUMENTATION........................................................................................................... 29 5.4 COLLECTION ................................................................................................................... 30 v Guidelines on PDA Forensics 6. ACQUISITION..................................................................................................................... 35 6.1 UNOBSTRUCTED DEVICES.............................................................................................. 36 6.2 OBSTRUCTED DEVICES................................................................................................... 38 6.3 TANGENTIAL EQUIPMENT .............................................................................................. 41 7. EXAMINATION AND ANALYSIS.................................................................................. 45 7.1 LOCATING EVIDENCE ..................................................................................................... 45 7.2 APPLYING TOOLS ........................................................................................................... 47 8. REPORTING ........................................................................................................................ 50 9. REFERENCES ..................................................................................................................... 52 APPENDIX A. ACRONYMS .................................................................................................... 55 APPENDIX B. GLOSSARY ...................................................................................................... 57 vi Guidelines on PDA Forensics List of Figures Figure 1: Generic Hardware Diagram ................................ 5 Figure 2: Palm OS Architecture.......................................... 8 Figure 3: Windows CE Architecture ................................ 10 Figure 4: Linux Architecture............................................. 13 Figure 5: Generic State Diagram ...................................... 15 Figure 6: ROM/RAM Storage Assignments.................... 37 Figure 7: Alternative ROM/RAM Assignments.............. 38 vii Guidelines on PDA Forensics List of Tables Table 1: An Overview of Representative PDA models..... 5 Table 2: PDA Forensic Tools............................................ 16