HEX D UMPING P RIMER Part I Michael Harrington, CFCE, EnCE Cell (or Mobile as it’s known outside the US) Phone Forensics has become a red hot topic in the last year or so. Among the issues that examiners often face are the lack of support for specific models and manufacturers and the quixotic and proprietary file systems that are on the handsets. Adding to this mix are the expensive hardware and software ‘solutions’ that have flooded the forensic community-solutions that can run into the hundreds, thousands and even tens of thousands of dollars. Imagine a solution that was not only inexpensive, required only a hex editor and ASCII table to interpret data AND was able to obtain the Holy Grail of Cell Phone Forensics - the acquisition of the physical memory of the phone. Impossible you say? Doubt no more! Enter the world of Hex Dumps or ‘Flashing’ as it’s more commonly known. FLASHING A P HONE - W HAT I S I T? Flashing a phone is usually interpreted as a dump of the phones memory into a format that is either hexadecimal or binary (for an Absolute or true physical acquisition). The aim of the practitioner then is to get a snapshot of the complete memory contents of the phone in order to uncover hidden and deleted data. Concomitant to this is the hope that this method will eliminate problems caused by the more “traditional” methods of using AT commands to query the handset and thereby create changes to the phone memory. In essence we are striving to get as close to the forensic image which is the bread and butter of conventional electronic evidence forensics and thereby have a best evidence exhibit as defined by the legal courts. Why is obtaining this forensic image or hex dump so important? I believe it is of utmost importance for the examiner to try to get the data from the phone in this way because most of the so called forensic phone applications are in reality variations of backup software that concentrate on the user data and rely on the phone being up and running in order to get at the data (again using something like AT commands). The examiner needs to look beyond the general user data of contacts, call registers and text messages. Using a hex dump the examiner can plumb the memory for such things as previously inserted SIM cards, previous (and to the traditional tools lost) calls, MAC addresses and more. 1 Add this to the myriad number of handsets each with differences in how data is stored, software and hardware revisions and the exorbitant costs of hardware and software solutions the examiner must look beyond the traditional. Hex dumps can and have been obtained from handsets that wouldn’t otherwise power up, were broken or had no battery or SIM. This goes way beyond what is capable from a traditional logical examination, which generally requires one of the aforementioned situations. Obtaining a hex dump is not without caveats though. One has to be cognizant of the fact that the boxes and the software used are not “officially” sanctioned by the handset manufacturers (but then neither are the traditional tools used by the practitioner) and while overly complex to use, there is a dearth of information on how to use the software (what is out there is often in a language foreign to the user) and if the wrong button is pressed you can turn your evidence into a “brick”. Commercially the devices used to obtain the hex dumps of the phones are used by cell phone retailers to repair, customize and unlock (free the phone from its provider) to use with different providers.. EQUIPMENT So we have defined what a hex dump or a flash of the phone is and we have hinted that there is some device that is needed to obtain the dump. So what exactly is required? Common terminology used in this subset of the wireless industry for these devices is typically ‘box’ or ‘clip’. These devices are small aluminum devices with USB and RJ-45 ports. It can be overwhelming to look at the amount of ‘boxes’ or ‘clips’ available on sites and wonder if one is better than the other or if they even work. Listed below are some of the choices. UFS3 Tornado Furious Gold Smart Clip GTS Unibox JAF N-box Vygis Typically GSM oriented these boxes support a variety of cell phone manufacturers from Nokia to Motorola to Sony-Ericsson. Some cables for CDMA handsets can also be found. 2 It is best to select a box that has the widest support for the manufacturers your department or force sees. Some of the websites you can find these boxes on (and that the author has used with great success) are the following: GSM Server One Stop Factory Fone Fun Shop (UK) Tech GSM This paper is going to focus on the UFS3™ (Tornado) box because it is a popular and very inclusive solution, though the concepts described though out the paper are applicable to the gamut of products on the market for obtaining hex dumps. UFS3™ The terminology of this box can be confusing at times because the Universal Flashing Software and the box itself are both referred to by the same name. This can be further compounded by the software sometimes being referred to as ‘Tornado’. For all intents and purposes the software is the same and only differs by name (later versions also include upgrades for new models etc). Depending on where the box is purchased, the examiner can get a variety of cables to go with the various supported models of phones. In general, the UFSx series supports the following manufacturers/models. Nokia DCT3: 3610 (NAM-1), 2100 (NAM-2), 3410 (NHM-2), 6250 (NHM-3), 3310 (NHM-5), 3330 (NHM-6), 3350 (NHM-9), 3390 (NBP-1), 6210 (NPE-3), 5510 (NPM-5), 5190 (NSB-1), 6190 (NSB-3), 8890 (NSB-6), 8290 (NSB-7), 5110 (NSE-1), 5110i (NSE- 2), 6110 (NSE-3), 7110 (NSE-5), 8810 (NSE-6), 3210 (NSE-8), 5130 (NSK-1), 5130 (NSK-3), 6150 (NSM-1), 8850 (NSM-2), 8210 (NSM-3), 8250 (NSM-3D), 8855 (NSM-4), 5210 (NSM-5), 9110 (RAE-2), 6090 (NME-3) Nokia DCT4: D211 (DTE-1), 3300 (NEM-1), 3300b (NEM-2), 7210 (NHL-4), 7250 (NHL-4J), 7250i (NHL-4JX), 6610 (NHL-4U), 6800 (NHL-6), 6820a (NHL-9), 6650 (NHM-1), 8910 (NHM-4), 8910i (NHM-4NX), 8310 (NHM-7), 3510 (NHM-8), 1220 (NKC-1), 1260/1 (NKW-1), 7600 (NHM-3), 3320 (NPC-1), 6310 (NPE-4), 6310i (NPL-1), 6100 (NPL-2), 6200 (NPL-3), 5100 (NPM-6), 5100a (NPM-6X), 3590 (NPM-8), 6510 (NPM-9), 3595 (NPM-10), 3360 (NPW-1), 6360 (NPW-2), 8390 (NSB-8), 6800a (NSB-9), 6590 (NSM-9), 6108 (RH-4), 3108 (RH-6), 3510i (RH-9), 6340i (RH-13), 3560/20 (RH- 14), 1100 (RH-18), 3100 (RH-19), 6220 (RH-20), 6560 (RH-25), 3200 (RH-30), 3200b (RH-31), 1100b (RH-36), 1100a (RH-38), 2260/1 (RH39+41), 2220/1 (RH40+42), 3586i (RH-44), 3100b (RH-50), 2300 (RM-4), 2300a (RM-5) 3 Nokia DCT-L: 9290 (RAB-3), 9210 (RAE-3), 9210i (RAE-5) Sony Ericsson: R520, T39, T65, T68, T68i, T200, T202, T230, T238, T300, T306, T310, T312, T610, T616, T630, T628, P800, P802, P900, P908, Z600, Z608, A3618, T100, R600, T66, T600, Z200 Samsung: A2xx, A800, N1xx, N2xx, N300, N400, N500, N600, N611, N620, N625, N628, R200, R201, R208, R210, R220, R225, T100, T108, T400, T410, T500, E400, E710, E715, P100, P400, Q100, Q105, Q200, Q300, Q400, Q605, S100, S105, S108, S200, S208, S300, S300m, S308, V100, V200, V205, V208, X400, X430, A100, A110, A188, A300, A400, M100, E100, E105, E700, E708, S500, S508, X100, X600, A500 E-Gold, C100 SkyWorks, C108 SkyWorks Siemens: C30, S40, C35, C35 NEW, M35, M35 NEW, S35, S35 NEW, A35, A36, A40, A50, A52, A55, A60, 1168, C45, 2118, C55, 2128, C60, C60 boot, S45, S55, SX1, ME45, M55, M55 boot, SL42, SL45, SL55, 6688, MT50, M50, 3118 Cables and C onnections The cables that come with the UFS3™ box appear like standard data cables but end in an RJ-45 connector. Included in the kit is usually a DKU/5, FBUS and DKU/2 cable. The connection between the box and the handset directly access the manufacturer’s service ports typically through the Joint Test Action Group (JTAG) connections or the Mbus/Fbus connections. These connections can be located underneath the battery of the handset as shown in the below graphic of a Nokia 3310. Picture taken from http://www.embedtronics.com They can also be accessed through ports located on the bottom of the phone as is shown in this picture of the fbus connector on a Nokia 3220. 4 The UFS3™ uses a variety of specialist cables like the one shown below. Of note on the cable are the connecting points (for accessing the logic board) and the RJ-45 connector. The latter hooks directly into a like port on the UFS3™ box as is shown below. SarasSoft’s T ornado™ Software 5 Having discussed what a hex dump is and why it is necessary as well as the equipment for such, we can now move onto the software required to obtain the hex dump. Installation Installation of the software is straightforward. You should install the software before hooking the UFS3™ box to the computer. In most circumstances you will want to take the defaults that the software presents to you.