The Mobile Device Examiner

Lets talk about phones!

Of course the first step should be ALWAYS to isolate the handset from the cellular network but most important step when EXAMING the cellular device. FILESYSTEM, FILESYSTEM, FILESYSTEM.

Did I say filesystem. The filesystem, if available, should always be the first extraction you as an examiner should attempt. Time and time again, I am contacted and asked to consult on a phone that a logical tool will not extract a portion of the user data. The first question I always have is, “Could you find the data in the filesystem?” 90 percent of the time I am answered, “I did not try that yet.” We know as examiners user data cannot always be parsed from the filesystem for a number of reasons. But the filesystem can be extracted far more efficiently and 90 percent of the time the userdata is easily located using FTK,Encase and XWays (and of course others) when searching manually.

The best part: YOU the examiner can testify to the actual file location of that particular user nugget!

Another bonus of ALWAYS attempting to acquire the filesystem of a phone, particularly a CDMA phone, is the recovery of DELETED data. We have long searched over and over for tools to obtain a PHYSICAL acquisition of a CDMA device when deleted data has been under our noses. CDMA handsets store cached data and files that are not logically accessible to the handset (or many tools for that matter). They may have been marked as “non existent” by the phone, but they still reside in the filesystem. I have personally recovered over 800 SMS messages that were nowhere to be found when looking commando style via the handset, but were in the open when I backed the filesystem up and used FTK to parse the recovered data. Did I say OVER 800 damaging SMS messages! Other nuggets are HTML pages, URLs, email and more that are missed by skimping on the exam.

Don’t neglect the filesystem of the cellphone and go for just a logical extraction. If you do you could be missing over half of the data sitting on the phone.

There are many tools out there for extracting the filesystem from Cellebrite UFED to Bitpim, you choose, but don’t leave it out of your total forensic exam.

Good Luck!

This blogging will be quite interesting and I think might help express the ideas and theories I always yell at students about in class (sorry students but passion is passion). I think I will start a series on process. Let’s go for the first bullet:

DONT FALL INTO THE TRAP

First and foremost let’s wrap your head around the fact that TOOLS used to extract data do a disservice to the community by using the term “forensic”. Using this term actually lolls a new examiner (or old) into thinking that there is some magic write blocking mechanism built into the cable (don’t laugh there are some sales people selling that quote) or software. Understanding that there is no way to write protect a phone seen by the OS as a serial port or modem is the first step to understanding a TOOL does not put the FORENSICS in your exam but your PROCESS will! Yes, your process during the extraction is ultimately what will be called into question.

HAVE A SOLID PROCESS

As a cellphone examiner you often have to use multiple tools during an exam. If you are not, then how are you conducting any validation? Ok, that is a blog in it’s self, moving on..Back to what to do if you have to use one tool or multiple tools during a single exam.

First, you should attempt to obtain a backup of the cellphone filesystem (logically and/or physically) or as many user files as possible. These files should then be hashed by a software capable of creating a known hash list. For example, AccessData’s FTK allows you to bring a cellphone filesystem into the application and you can easily create a Known File Filter based on the files on the filesystem.
After this known set of hashes are created you can go about continuing your exam using as many tools as needed to extract the maximum amount of data. The last thing you should do in the exam is to re-acquire the filesystem or conduct the same initial extraction you did that was taken into FTK and hashed. Once this extraction is completed you can bring the POST filesystem into FTK and run the known file filter against the new data to identify if any files changed during your examination and extraction. You will notice every time that some files change over and over. As you look closer you will recognize the files changing are SYSTEM files and not user files. You can now say with 100% certainty that no user data was altered during the examination. Can you do that in your current methodology?

Unfortunately, most rely on their software of choice just using the word forensic in the literature to coin their exams forensic. Don’t be one of them, use a forensic process!