Effects of the Factory Reset on Mobile Devices
Total Page:16
File Type:pdf, Size:1020Kb
Calhoun: The NPS Institutional Archive DSpace Repository Faculty and Researchers Faculty and Researchers Collection 2014 Effects of the Factory Reset on Mobile Devices Schwamm, Riqui ADFSL Schwamm, Riqui, and Neil C. Rowe. "Effects of the factory reset on mobile devices." Journal of Digital Forensics, Security and Law 9.2 (2014): 205-220. http://hdl.handle.net/10945/49294 Downloaded from NPS Archive: Calhoun Effects of the Factory Reset on Mobile Devices JDFSL V9N2 This work is licensed under a Creative Commons Attribution 4.0 International License. EFFECTS OF THE FACTORY RESET ON MOBILE DEVICES Riqui Schwamm and Neil C. Rowe U.S. Naval Postgraduate School Computer Science Department Monterey, CA 93943 USA {rschwamm, ncrowe}@nps.edu ABSTRACT Mobile devices usually provide a “factory-reset” tool to erase user-specific data from the main secondary storage. 9 Apple iPhones, 10 Android devices, and 2 BlackBerry devices were tested in the first systematic evaluation of the effectiveness of factory resets. Tests used the Cellebrite UME-36 Pro with the UFED Physical Analyzer, the Bulk Extractor open-source tool, and our own programs for extracting metadata, classifying file paths, and comparing them between images. Two phones were subjected to more detailed analysis. Results showed that many kinds of data were removed by the resets, but much user-specific configuration data was left. Android devices did poorly at removing user documents and media, and occasional surprising user data was left on all devices including photo images, audio, documents, phone numbers, email addresses, geolocation data, configuration data, and keys. A conclusion is that reset devices can still provide some useful information to a forensic investigation. Keywords: mobile device, forensics, factory reset, file types, Cellebrite, privacy 1. INTRODUCTION Thomas, and McPhee, 2010). Systematic An increasing amount of criminal activity uses analysis of mobile devices differs somewhat mobile devices (McMillan, Glisson, and from that of desktop and laptop computers Bromby, 2013). Devices do provide ways to because of the difficulty of accessing the main erase user information from secondary storage secondary storage, which is usually a flash and criminals will likely use them. However, storage soldered to the device board. Cutting these methods are not entirely effective and out and removing the storage (Alghafli, Jones, information of forensic value can be left after and Martin, 2012) usually destroys the device these attempts to erase it. In addition, with functionality. Hence most mobile forensic frequent device upgrades by manufacturers, tools attempt to access the storage through discarded older devices are common. This the operating system. Several issues particular paper attempts to determine how much and to mobile devices arise such as finding where what kind of residual user data are left after a data are stored and dealing with data “factory reset” or “wipe” intended to remove aggregation. For instance, on most user data. This analysis will aid forensic smartphones the call records are stored in a examiners that encounter reset drives. single file. In addition, the operating system may not permit access to all files. Recently a number of researchers have developed methodologies for forensic The term “factory reset” is used by investigation of mobile devices (Marturana, et manufacturers to mean restoring an electronic al., 2011; Omeleze and Venter, 2013; Owen, device to the state when it left the factory, deleting all user data and third-party © 2014 ADFSL Page 205 JDFSL V9N2 Effects of the Factory Reset on Mobile Devices applications in the process (Rouse, 2013). It are even worse if the data left on devices are should be done when discarding a device or unpredictable as it appears to be from the transferring it to a new owner. The concept is anecdotal reports. clear when referring to music players and other simple devices, but its meaning is less 2. EXPERIMENTAL clear for complex mobile devices where some SETUP user data may be necessary to configure it Tools from Cellebrite adequately, and some user data are stored (www.cellebrite.com/mobile-forensics) were within operating-system files. used to extract data from the main storage of test devices. The Cellebrite UME-36 Pro No systematic testing appears to have Universal Memory Exchanger 1.2.2.3 been done of the factory reset on mobile hardware accessed the devices, and the devices, although technology websites report Cellebrite UFED Physical Analyzer 3.7.2.0 gripes (The Guardian, 2013). For example, software analyzed the images. Other products (Smith, 2012) tested secondhand phones claiming similar functionality include the purchased through Craigslist where a factory Forensic Toolkit (www.accessdata.com), rest had been performed on the devices. Data Oxygen Forensic Suite (www.oxygen- that they found included court records, social forensic.com), EnCase Neutrino security numbers, resumes, college (www.guideancesoftware.com), Recuva applications, child support documents, (www.piriform.com), and ViaExtract employee records, bank statements, credit- (viaforensics.com). The Oxygen Forensic suite card statements, tax returns, email, contact was tested on some of our phones and it lists, and photos. One investigation (Cardwell, appeared to work well. ViaExtract showed 2013) studied the effects of a factory reset on compatibility issues with some Android network data left on an Android phone. Data phones (the Samsung Galaxy SIII and the was transferred between Android phones and Motorola Atrix 4G). Recuva is primarily for multiple network access points (cellular, hard drive recovery; it could extract small wireless, and Bluetooth). Residual data in data sets but did not provide useful analysis. secondary storage on test phones after the reset included “userdata” partitions containing A full ufd-format dump of the file system Service Set Identifiers, wireless-router on each device was made by the Cellebrite Subscriber Identity Modules, DHCP ACKs Physical Analyzer. A program was written to from wireless routers, and base-station calculate DFXML metadata metadata that included the Mobile Network (www.nsrl.nist.gov/DFXML /fileobject.xsd) Code, Mobile Country Code, Local Area Code on the dumps, including calculation of hash and Cell Identification, wireless router Media values on files. Another program discussed in Access control addresses, and Bluetooth section 4.2 was written to compare the pre- addresses of devices paired with the phone. reset and post-reset DFXML metadata. A taxonomy from (Rowe, 2013) was used to These reports suggests that useful classify files by extension and directory. The forensics on reset devices is indeed possible. Bulk Extractor tool from digitalcorpora.org They also raise worrisome questions about the (Garfinkel, 2013) was used to extract strings. privacy of information stored on mobile We did not exclude operating-system files devices. Privacy of personal information is from analysis because our previous work currently subject of much attention (Payton (Rowe, 2013) found some user data in them. and Claypoole, 2014). If private data are left on devices after users have reset them, users Except for two unresponsive phones and may be able to sue manufacturers, and this also in section 3.4, resets were performed needs to be factored into business decisions through software using each device’s setup (Kauffman, Lee, and Sougstad, 2009). Matters menu under “Privacy” or “Backup & Reset”. Page 206 © 2014 ADFSL Effects of the Factory Reset on Mobile Devices JDFSL V9N2 The reset takes a few minutes after which the 3.1 Experimental Protocol device restarts. The phones were “factory-reset”; a protocol 2.1 Other Storage for Devices was followed to put applications and data onto the phones; images were taken of the This work focused on the main nonvolatile phone with the Cellebrite Physical Analyzer; storage. A separate removable memory card the phones were reset again; and images were on some phones (“SIM” or “subscriber identity taken again. The furnished data included module”) contains the user’s identity, account distinctive keywords to make it easier to information, and keys, and is necessary to recognize forensically. The phones were not make phone calls. It may also contain text connected to a cellular account, so messaging messages and contacts depending on the services could not be tested. The protocol phone. SIM cards were not available for most was: of our phones. SIM cards are unaffected by a 1. Reset the device. factory reset and contain information of 2. Visit four specified websites: nps.edu, definite forensic interest, so they should be fark.com, yahoo.com, and npr.org. analyzed if available. 3. Take six pictures with the built-in Besides SIM cards, many devices have camera and rename three distinctively. additional removable storage in the form of 4. Click on eight specified links to Web SD or MMC cards that is not subject to the pages and documents (4 html, 1 docx, factory reset. No such cards were available for 1 pdf, 1 pptx, and 1 wav file). the devices tested in section 4, but 76 cards 5. Download to the root directory of the comprising 54,279 files were acquired from phone a specified text document and smartphone images from an international zip file. corpus. Classifying its files by extension using 6. For the Android: (a) download and our taxonomy, 31.7% were camera pictures, install the Facebook app, login, and 15.0% were audio, 11.8% were video, 5.6% browse specified pages; (b) download were documents, and 5.6% had no extension. and install the Google Drive app, Hence these cards had rich materials for login/sync, and open three specified forensic investigation compared with 4.3% files; (c) download and install the camera images, 4.8% audio, and 0.1% video DropBox (www.dropbox.com) app, on the mobile-device main-storage corpus to login/sync, and open three specified be described. That suggests that the cards files; (d) download and install the should be checked first when available in a YouTube app, login, and watch three forensic investigation.