Ios Mobile Device Forensics: Initial Analysis
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Guidelines on Mobile Device Forensics
NIST Special Publication 800-101 Revision 1 Guidelines on Mobile Device Forensics Rick Ayers Sam Brothers Wayne Jansen http://dx.doi.org/10.6028/NIST.SP.800-101r1 NIST Special Publication 800-101 Revision 1 Guidelines on Mobile Device Forensics Rick Ayers Software and Systems Division Information Technology Laboratory Sam Brothers U.S. Customs and Border Protection Department of Homeland Security Springfield, VA Wayne Jansen Booz-Allen-Hamilton McLean, VA http://dx.doi.org/10.6028/NIST.SP. 800-101r1 May 2014 U.S. Department of Commerce Penny Pritzker, Secretary National Institute of Standards and Technology Patrick D. Gallagher, Under Secretary of Commerce for Standards and Technology and Director Authority This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Management Act of 2002 (FISMA), 44 U.S.C. § 3541 et seq., Public Law (P.L.) 107-347. NIST is responsible for developing information security standards and guidelines, including minimum requirements for Federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate Federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems, as analyzed in Circular A- 130, Appendix IV: Analysis of Key Sections. Supplemental information is provided in Circular A- 130, Appendix III, Security of Federal Automated Information Resources. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority. -
Guidelines on Mobile Device Forensics
NIST Special Publication 800-101 Revision 1 Guidelines on Mobile Device Forensics Rick Ayers Sam Brothers Wayne Jansen http://dx.doi.org/10.6028/NIST.SP.800-101r1 NIST Special Publication 800-101 Revision 1 Guidelines on Mobile Device Forensics Rick Ayers Software and Systems Division Information Technology Laboratory Sam Brothers U.S. Customs and Border Protection Department of Homeland Security Springfield, VA Wayne Jansen Booz Allen Hamilton McLean, VA http://dx.doi.org/10.6028/NIST.SP. 800-101r1 May 2014 U.S. Department of Commerce Penny Pritzker, Secretary National Institute of Standards and Technology Patrick D. Gallagher, Under Secretary of Commerce for Standards and Technology and Director Authority This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Management Act of 2002 (FISMA), 44 U.S.C. § 3541 et seq., Public Law (P.L.) 107-347. NIST is responsible for developing information security standards and guidelines, including minimum requirements for Federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate Federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems, as analyzed in Circular A- 130, Appendix IV: Analysis of Key Sections. Supplemental information is provided in Circular A- 130, Appendix III, Security of Federal Automated Information Resources. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority. -
About the AAFS
American Academy of Forensic Sciences 410 North 21st Street Colorado Springs, Colorado 80904 Phone: (719) 636-1100 Email: [email protected] Website: www.aafs.org @ AAFS Publication 20-2 Copyright © 2020 American Academy of Forensic Sciences Printed in the United States of America Publication Printers, Inc., Denver, CO Typography by Kathy Howard Cover Art by My Creative Condition, Colorado Springs, CO WELCOME LETTER Dear Attendees, It is my high honor and distinct privilege to welcome you to the 72nd AAFS Annual Scientific Meeting in Anaheim, California. I would like to thank the AAFS staff, the many volunteers, and everyone else who have worked together to create an excellent program for this meeting with the theme Crossing Borders. You will have many opportunities to meet your colleagues and discuss new challenges in the field. There are many workshops and special sessions that will be presented. The Interdisciplinary and Plenary Sessions will provide different views in forensic science—past, present, and future. The Young Forensic Scientists Forum will celebrate its 25th Anniversary and is conducting a workshop related to the meeting theme. More than 1,000 presentations are scheduled that will provide you with more insight into the developments in forensic science. The exhibit hall, always interesting to explore, is where you will see the latest forensic science equipment, technology, and literature. The theme Crossing Borders was chosen by me and my colleagues at the Netherlands Forensic Institute (NFI). We see many definitions of crossing borders in forensic science today. For the 2020 meeting, six words starting with the letters “IN” are included in the theme. -
Graduate Prospectus2014 Institute of Space Technology
Graduate Prospectus2014 Institute of Space Technology we HELP YOU ACHIEVE YOUR AMBITIONS P R O S P E C T U S 2 141 INSTITUTE OF SPACE TECHNOLOGY w w w . i s t . e d u . p k To foster intellectual and economic vitality through teaching, research and outreach in the field of Space Science & Technology with a view to improve quality of life. www.ist.edu.pk 2 141 P R O S P E C T U S INSTITUTE OF SPACE TECHNOLOGY CONTENTS Welcome 03 Location 04 Introduction 08 The Institute 09 Facilities 11 Extra Curricular Activities 11 Academic Programs 15 Department of Aeronautics and Astronautics 20 Local MS Programs 22 Linked Programs with Beihang University 31 Linked Programs with Northwestern Polytechnic University 49 Department of Electrical Engineering 51 Local MS Programs 53 Linked Programs with University of Surrey 55 Department of Materials Science & Engineering 72 Department of Mechanical Engineering 81 Department of Remote Sensing & Geo-information Science 100 w w w . i s t . e d u . p k Department of Space Science 106 ORIC 123 Admissions 125 Fee Structure 127 Academic Regulations 130 Faculty 133 Administration 143 Location Map 145 1 20 P R O S P E C T U S 2 141 INSTITUTE OF SPACE TECHNOLOGY w w w . i s t . e d u . p k 2 141 P R O S P E C T U S INSTITUTE OF SPACE TECHNOLOGY Welcome Message Vice Chancellor The Institute of Space Technology welcomes all the students who aspire to enhance their knowledge and specialize in cutting edge technologies. -
Comparing Two Tools for Mobile-Device Forensics
NAVAL POSTGRADUATE SCHOOL MONTEREY, CALIFORNIA THESIS COMPARING TWO TOOLS FOR MOBILE-DEVICE FORENSICS by Casandra M. Martin September 2016 Thesis Advisor: Neil C. Rowe Second Reader: Approved for public release. Distribution is unlimited. THIS PAGE INTENTIONALLY LEFT BLANK REPORT DOCUMENTATION PAGE Form Approved OMB No. 0704–0188 Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instruction, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden to Washington headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202–4302, and to the Office of Management and Budget, Paperwork Reduction Project (0704-0188) Washington DC 20503. 1. AGENCY USE ONLY (Leave Blank) 2. REPORT DATE 3. REPORT TYPE AND DATES COVERED September 2016 Master’s Thesis 09-20-2015 to 09-23-2016 4. TITLE AND SUBTITLE 5. FUNDING NUMBERS COMPARING TWO TOOLS FOR MOBILE-DEVICE FORENSICS 6. AUTHOR(S) Casandra M. Martin 7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) 8. PERFORMING ORGANIZATION REPORT NUMBER Naval Postgraduate School Monterey, CA 93943 9. SPONSORING / MONITORING AGENCY NAME(S) AND ADDRESS(ES) 10. SPONSORING / MONITORING AGENCY REPORT NUMBER N/A 11. SUPPLEMENTARY NOTES The views expressed in this document are those of the author and do not reflect the official policy or position of the Department of Defense or the U.S. Government. -
Comparative Evaluation of Mobile Forensic Tools
See discussions, stats, and author profiles for this publication at: https://www.researchgate.net/publication/322250449 Comparative Evaluation of Mobile Forensic Tools Chapter in Advances in Intelligent Systems and Computing · January 2018 DOI: 10.1007/978-3-319-73450-7_11 CITATIONS READS 0 486 6 authors, including: John Alhassan Sanjay Misra Federal University of Technology Minna Covenant University Ota Ogun State, Nigeria 40 PUBLICATIONS 16 CITATIONS 302 PUBLICATIONS 1,059 CITATIONS SEE PROFILE SEE PROFILE Adewole Adewumi Rytis Maskeliunas Covenant University Ota Ogun State, Nigeria Kaunas University of Technology 51 PUBLICATIONS 46 CITATIONS 94 PUBLICATIONS 164 CITATIONS SEE PROFILE SEE PROFILE Some of the authors of this publication are also working on these related projects: Learning from Failure: Evaluation of Agent Dyads in the Context of Adversarial Classification Game View project Biohashing based on Boolean logic operations View project All content following this page was uploaded by Rytis Maskeliunas on 08 January 2018. Provided by Covenant University Repository The user has requested enhancement of the downloaded file. CORE Metadata, citation and similar papers at core.ac.uk Comparative Evaluation of Mobile Forensic Tools J. K. Alhassan1(&), R. T. Oguntoye1, Sanjay Misra2, Adewole Adewumi2, Rytis Maskeliūnas3, and Robertas Damaševičius3 1 Federal University of Technology, Minna, Nigeria [email protected] 2 Covenant University, Otta, Nigeria [email protected] 3 Kaunas University of Technology, Kaunas, Lithuania [email protected] Abstract. The rapid rise in the technology today has brought to limelight mobile devices which are now being used as a tool to commit crime. Therefore, proper steps need to be ensured for Confidentiality, Integrity, Authenticity and legal acquisition of any form of digital evidence from the mobile devices. -
D3.2 Legal Analysis of the Use of Evidence Material
Ref. Ares(2018)5822033 - 14/11/2018 Advanced Cyber-Threat Intelligence, Detection, and Mitigation Platform for a Trusted Internet of Things Grant Agreement: 786698 D3.2 Legal analysis of the use of evidence material Work Package 3: Legal issues: data protection and privacy Document Dissemination Level P Public ☒ CΟ Confidential, only for members of the Consortium (including the Commission Services) ☐ Document Due Date: 31/10/2018 Document Submission Date: 02/11/2018 Co-funded by the Horizon 2020 Framework Programme of the European Union D3.2 Legal analysis of the use of evidence material Document Information Deliverable number: D3.2 Deliverable title: Legal analysis of the use of evidence material Deliverable version: 1.2 Work Package number: 3 Work Package title: Legal issues: data protection and privacy Due Date of delivery: 31.10.2018 Actual date of delivery: 02.11.2018 Dissemination level: PU Editor(s): Olga Gkotsopoulou (VUB) Paul Quinn (VUB) Contributor(s): Liza Charalambous (ADITESS) Dimitris Kavallieros (KEMEA) Xenia Pouli (MTN) Reviewer(s): Emanuele Bellini (MATHEMA) Clément Pavué (SCORECHAIN) Project name: Advanced Cyber-Threat Intelligence, Detection, and Mitigation Platform for a Trusted Internet of Things Project Acronym Cyber-Trust Project starting date: 1/5/2018 Project duration: 36 months Rights: Cyber-Trust Consortium Version History Version Date Beneficiary Description 0.01 20.08.2018 VUB DDP and ToC circulated to partners 0.02 27.08.2018 VUB Sections 1 and 2 0.021 04.09.2018 ADITESS Contribution – clarifications integrated -
A User-Oriented Network Forensic Analyser
A USER-ORIENTED NETWORK FORENSIC ANALYSER 1 1 1,2 1,2 D. Joy , F. Li , N.L. Clarke and S.M. Furnell 1Centre for Security, Communications and Network Research (CSCAN) Plymouth University, Plymouth, United Kingdom 2Security Research Institute, Edith Cowan University, Western Australia [email protected] Abstract Network forensics is becoming an increasingly important tool in the investigation of cyber and computer- assisted crimes. Unfortunately, whilst much effort has been undertaken in developing computer forensic file system analysers (e.g. Encase and FTK), such focus has not been given to Network Forensic Analyser Tools (NFATs). The single biggest barrier to effective NFATs is the handling of large volumes of low-level traffic and being able to exact and interpret forensic artefacts and their context – for example, being able extract and render application-level objects (such as emails, web pages and documents) from the low-level TCP/IP traffic but also understand how these applications/artefacts are being used. Whilst some studies and tools are beginning to achieve object extraction, results to date are limited to basic objects. No research has focused upon analysing network traffic to understand the nature of its use – not simply looking at the fact a person requested a webpage, but how long they spend on the application and what interactions did they have with whilst using the service (e.g. posting an image, or engaging in an instant message chat). This additional layer of information can provide an investigator with a far more rich and complete understanding of a suspect’s activities. To this end, this paper presents an investigation into the ability to derive high-level application usage characteristics from low-level network traffic meta-data. -
Mobile Device Forensics
Trends & issues in crime and criminal justice No. 460 August 2013 Mobile device forensics: Foreword | In the increasingly dynamic environment of mobile forensics, this A snapshot paper provides an overview of the capabilities of three popular mobile Christopher Tassone, Ben Martini, Kim-Kwang Raymond Choo forensic tools on three mobile phones and Jill Slay based on Apple’s iOS, Google’s Android and RIM’s BlackBerry operating systems. The paper identifies where each specific Mobile devices are fast becoming ubiquitous in populations worldwide. For example, the tool is best applied and also describes 2012 IBM Tech Trends Report (based on a survey of more than 1,200 professionals who the limitations of each in accessing make technology decisions for their organisations in 16 different industries and 13 contacts, call history, message data countries, as well as more than 250 academics and 450 students across these same (SMS, MMS and emails), media files countries) predicted that and other data. New releases of forensic [b]y the end of 2012, mobile devices are expected to outnumber people. Sources of tools and mobile operating systems may analytical insight continue to multiply, with the world generating 15 petabytes of new change the way the data are acquired data every day—that’s roughly eight times the information housed in all the academic and preserved in the future. It is libraries in the United States (Lo, Wyble & Hupfer 2012: 2). therefore hoped that future research will continue to provide the digital forensics The Australian Communications and Media Authority also demonstrated the growth community with the most up-to-date and ubiquity of Australian mobile devices in their recent report Communications Report overview of mobile forensics capabilities. -
Open-Source Mobile Forensics
Open Source Mobile Device Forensics Heather Mahalik © 2014, Basis Technology 1 Device Acquisition iOS Devices Android Devices • Zdziarski Methods • viaLogical • Boot Rom • ADB Backup Vulnerability Exploits • OSAF Toolkit – Custom Ramdisk via • Santoku SSH – The iPhone Data • DD Protection Tools – Not supported for all devices • iTunes • JTAG/Chip-off © 2014, Basis Technology 2 Considerations • How old is the device? • Is the device locked? • Is the device damaged? • Are you Law Enforcement? © 2014, Basis Technology 3 Android Memory Capture • LiME (Linux Memory Extractor) – First tool to support full memory captures of Android smartphones! – TCP dump or saved to SD card – Uses ADB © 2014, Basis Technology 4 Analytical Tools…to Name a Few iOS Devices Android Devices • iPhone Backup Analyzer • Autopsy • iExplorer – Android Module • iBackupBot • WhatsApp Extract • Scalpel – wa.db and msgstore.db • SQLite Browser • Scalpel • Plist Editor • SQLite Browser • WhatsApp Extract • Hex Editor – Contacts.sqlite and • Anything capable of mounting ChatStorage.sqlite EXT • Manual examination • FTK Imager • Customized scripts • Customized scripts • Manual examination © 2014, Basis Technology 5 Reality Check! • Commercial tools are expensive – They still miss data – They don’t parse third party applications completely – They omit relevant databases when extracting data – They don’t support all devices • Open Source tools – See above! © 2014, Basis Technology 6 Example – iOS Examination /private/var/mobile/library/Spotlight/com.apple.mobilesms/ – smssearchindex.sqlite -
Practical Investigations of Digital Forensics Tools for Mobile Devices Maynard Yates II, M.S
Practical Investigations of Digital Forensics Tools for Mobile Devices Maynard Yates II, M.S. Florida Agricultural and Mechanical University Department of Computer and Information Sciences Technical Building A, Room 211 Tallahassee, FL 32307-5100 [email protected] ABSTRACT A few examples of these changes are: With the continued growth of the mobile device market, the Correspondence: Postal mail → Electronic mail (E- possibility of their use in criminal activity will only continue to mail) → SMS messages (text messages) increase. While the mobile device market provides a great variety of manufactures and models causing a strong diversity. It Telecommunications: Telephones → car powered cell becomes difficult for a professional investigator to choose the phones→ battery powered cell phones proper forensics tools for seizing internal data from mobile Calendar: Secretary → Day Planner→ Personal Data devices. Through this paper, we will give a comprehensive Assistant (PDA)→ “Smartphone” perspective of each popular digital forensic tool and offer an inside view for investigators to choose their free sources or commercial tools. In addition, a summary for the future direction As technology continues to permeate society and mobile for forensics tools in mobile devices. computing becomes more prevalent, people will more heavily depend on applications such as e-mail, SMS (Short Message Service), MMS (Multimedia Messaging Service) and online Categories and Subject Descriptors transactions (i.e. bank, ins, etc); such devices provide a good K.4.1. [Computers and Society]: Public Policy Issues - abuse source of evidence for forensic investigators to prove or disprove and crime involving computers; D.4.6 [Operating Systems]: the commitment of crimes or location of suspects/victims [6]. -
Comprehensive Study of Digital Forensics
ISSN: 2278 – 1323 International Journal of Advanced Research in Computer Engineering & Technology Volume 1, Issue 5, July 2012 COMPREHENSIVE STUDY OF DIGITAL FORENSICS Jatinder kaur, Gurpal Singh SMCA, Thapar University, Patiala-147004, India [email protected], [email protected] Abstract— This paper presenting the review about digital forensics, it consists of techniques as well as various tools used to accomplish the tasks in the digital forensic process. Network forensics is forensics and important technology for network security area. In this paper, we inspect digital evidence collection processes using these tools. From last few decades the Figure 1 : Shows processes to collect digital data digital forensic techniques have been improved appreciably but still we face a lack of effective forensics tools to deal with varied incidents caused by these rising technologies and the advances 2. Collect, observe & preserve. in cyber crime. This article discusses the tools used in network 3. Analyze , identify and forensics , various gaps founds in these tools, and the 4. Rebuild the evidence and verify the result every time [16]. advantages and disadvantages of these tools. In the document describe digital evidence collection process Index Terms— Forensics, Digital evidence, Network forensics, as follows: computer forensics, Cyber crime , Encase, Sleuth Kit. 1. Where is the evidence? List out the systems were involved in the incident and from which evidence will be collected. I. INTRODUCTION 2. Establish what is likely to be relevant and admissible. Forensics is use of science and technology to investigate and When in doubt err on the side of collecting too much rather establish facts in criminal and civil courts of law.