CORE Metadata, citation and similar papers at core.ac.uk Provided by Calhoun, Institutional Archive of the Naval Postgraduate School Calhoun: The NPS Institutional Archive Theses and Dissertations Thesis Collection 2014-03 Effectiveness of the factory reset on a mobile device Schwamm, Riqui Monterey, California: Naval Postgraduate School http://hdl.handle.net/10945/41441 NAVAL POSTGRADUATE SCHOOL MONTEREY, CALIFORNIA THESIS EFFECTIVENESS OF THE FACTORY RESET ON A MOBILE DEVICE by Riqui Schwamm March 2014 Thesis Advisor: Neil Rowe Second Reader: Simson Garfinkel Approved for public release; distribution is unlimited THIS PAGE INTENTIONALLY LEFT BLANK REPORT DOCUMENTATION PAGE Form Approved OMB No. 0704-0188 Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instruction, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to Washington headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302, and to the Office of Management and Budget, Paperwork Reduction Project (0704-0188) Washington DC 20503. 1. AGENCY USE ONLY (Leave blank) 2. REPORT DATE 3. REPORT TYPE AND DATES COVERED March 2014 Master’s Thesis 4. TITLE AND SUBTITLE 5. FUNDING NUMBERS EFFECTIVENESS OF THE FACTORY RESET ON A MOBILE DEVICE 6. AUTHOR(S) Riqui Schwamm 7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) 8. PERFORMING ORGANIZATION Naval Postgraduate School REPORT NUMBER Monterey, CA 93943-5000 9. SPONSORING /MONITORING AGENCY NAME(S) AND ADDRESS(ES) 10. SPONSORING/MONITORING N/A AGENCY REPORT NUMBER 11. SUPPLEMENTARY NOTES The views expressed in this thesis are those of the author and do not reflect the official policy or position of the Department of Defense or the U.S. Government. IRB Protocol number ____N/A____. 12a. DISTRIBUTION / AVAILABILITY STATEMENT 12b. DISTRIBUTION CODE Approved for public release; distribution is unlimited 13. ABSTRACT (maximum 200 words) All mobile phones use internal flash memory to store information. The flash memory contains personal user data that can be extracted with the use of forensics tools. This information could be used to profile a user’s daily activity. However, all smartphones provide a tool to erase (factory reset) the information from the flash memory. Twenty-one smartphones were used to evaluate the effectiveness of the factory-reset feature. A set of forensics tools from Cellebrite was used for the extraction and analysis process. The factory-reset feature was found to leave significant amounts of user-generated content after operation. The amount of user-generated content varied by vendor and model number. Extracted data are presented as evidence to show the ineffectiveness of the reset. User data such as photographs, audio files, text files, login information and geolocation data were left on the phone. The data analysis uncovered the unreliable nature of a factory reset and how the user is not properly protected. 14. SUBJECT TERMS Android Operating System, Apple iOS, Mobile Forensics, smartphone, 15. NUMBER OF personal user data PAGES 67 16. PRICE CODE 17. SECURITY 18. SECURITY 19. SECURITY 20. LIMITATION OF CLASSIFICATION OF CLASSIFICATION OF THIS CLASSIFICATION OF ABSTRACT REPORT PAGE ABSTRACT Unclassified Unclassified Unclassified UU NSN 7540-01-280-5500 Standard Form 298 (Rev. 2-89) Prescribed by ANSI Std. 239-18 i THIS PAGE INTENTIONALLY LEFT BLANK ii Approved for public release; distribution is unlimited EFFECTIVENESS OF THE FACTORY RESET ON A MOBILE DEVICE Riqui Schwamm Civilian, Department of the Navy B.S., California State University, Monterey Bay, 2011 Submitted in partial fulfillment of the requirements for the degree of MASTER OF SCIENCE IN COMPUTER SCIENCE from the NAVAL POSTGRADUATE SCHOOL March 2014 Author: Riqui Schwamm Approved by: Neil Rowe Thesis Advisor Simson Garfinkel Second Reader Peter J. Denning Chair, Department of Computer Science iii THIS PAGE INTENTIONALLY LEFT BLANK iv ABSTRACT All mobile phones use internal flash memory to store information. The flash memory contains personal user data that can be extracted with the use of forensics tools. This information could be used to profile a user’s daily activity. However, all smartphones provide a tool to erase (factory reset) the information from the flash memory. Twenty-one smartphones were used to evaluate the effectiveness of the factory-reset feature. A set of forensics tools from Cellebrite was used for the extraction and analysis process. The factory-reset feature was found to leave significant amounts of user-generated content after operation. The amount of user-generated content varied by vendor and model number. Extracted data are presented as evidence to show the ineffectiveness of the reset. User data such as photographs, audio files, text files, login information and geolocation data were left on the phone. The data analysis uncovered the unreliable nature of a factory reset and how the user is not properly protected. v THIS PAGE INTENTIONALLY LEFT BLANK vi TABLE OF CONTENTS I. INTRODUCTION........................................................................................................1 A. MOBILE DEVICES, APPLICATIONS, AND USER DATA .....................1 B. RESEARCH QUESTIONS .............................................................................2 C. THESIS STRUCTURE ...................................................................................2 II. BACKGROUND AND RELATED WORK ..............................................................3 A. GROWTH OF SMARTPHONES AND MOBILE COMPUTERING .......3 B. PRIOR WORK.................................................................................................4 III. DIGITAL FORENSICS TOOLS................................................................................7 A. COMPUTER FORENSICS ............................................................................7 B. MOBILE FORENSICS ...................................................................................9 C. MOBILE FORENSIC TOOL CELLEBRITE UFED ..................................9 D. MOBILE FORENSIC TOOL BULK EXTRACTOR ................................11 E. OTHER MOBILE FORENSICS TOOLS TESTED ..................................11 IV. EXPERIMENTS ........................................................................................................15 A. CONTROLLED EXPERIMENT WITH TWO SMARTPHONES ..........15 B. EXPERIMENT AND DATA EXTRACTION ............................................21 C. ISSUES WITH THE SMARTPHONES ......................................................28 D. DATA ANALYSIS WITH THE PHYSICAL ANALYZER ......................29 E. STRING SEARCHING WITH LINUX GREP COMMAND ...................32 F. DATA ANALYSIS WITH BULK EXTRACTOR ......................................34 G. DISCUSSION .................................................................................................38 V. CONCLUSIONS AND FUTURE WORK ...............................................................41 A. CONCLUSION ..............................................................................................41 B. RECOMMENDED PROCEDURES ............................................................41 C. FUTURE WORK ...........................................................................................42 LIST OF REFERENCES ......................................................................................................45 INITIAL DISTRIBUTION LIST .........................................................................................51 vii THIS PAGE INTENTIONALLY LEFT BLANK viii LIST OF TABLES Table 1. Top Smartphone Platforms (from [1]). ..............................................................1 Table 2. Mobile Internet & Smartphone Adoption: October 2011 (from [4]). ................3 Table 3. Sample files from post-wipe iPhone ................................................................19 Table 4. Sample files from post-wipe Android phone ...................................................20 Table 5. Full list of smartphone and status (from [41], [42]).........................................22 Table 6. Summary data from 21 smartphones ...............................................................23 Table 7. File type counts before and after the factory reset. ..........................................24 Table 8. The number represents user data and system data on smartphones part 1. (post-wipe/pre-wipe) I=iPhone, A=Android, B=BlackBerry ..........................26 Table 9. The number represents user data and system data on smartphone part 2 (post-wipe/pre-wipe) I=iPhone, A=Android, B=BlackBerry ..........................27 Table 10. User data files found in the smartphones part 1 ...............................................32 Table 11. User data files found in the smartphones part 2 ...............................................32 Table 12. Search result (post-wipe/pre-wipe) part 1 ........................................................36 Table 13. Search result (post-wipe/pre-wipe) part 2 ........................................................37 ix THIS PAGE INTENTIONALLY LEFT BLANK x LIST OF ACRONYMS AND ABBREVIATIONS ADB Android Debug Bridge CDMA code division multiple access DoD Department