Obstacles & Opportunities in Mobile Forensic Collections October 2, 2014 Evidence Collection in the Mobile Age

Obstacles & Opportunities in Mobile Forensic Collections

October 2, 2014

Evidence Collection in the Mobile Age

Trend: Mobile Device Ownership is Rising

© Elysium Digital 2014 2

Source: Pew Research Center (Internet & American Life Project)

3

Trend: Increasing Use of Smartphones

© Elysium Digital 2014


4

Trend: BYOD Popularity Increasing


Bring Your Own Device (BYOD) Support

Source: Good Technology Corporation. Good Technology’s 2nd Annual State of BYOD Report. (n=100)

5

Mobile: It is the Wild, Wild West of Tech


• Similar to early PC landscape– More Devices– More Varieties– More Connectivity– More Users

• Results in– Lack of Standards– Unsettled Marketplace

Image sources: www.securitypronews.com, www.gospotcheck.com

6

Types of Devices


Cellphones

Smartphones

Tablets

7

Agenda


• Traditional Computer Forensics• Mobile Collections Obstacles• Mobile Collections Opportunities• Other Issues• Quick Takeaways

8© Elysium Digital 2014

Traditional Computer Forensics

9

Traditional Computer Forensics:Non-volatile Storage


• Disk Drive & Solid State Drive (SSD)– “File” Abstraction – Blocks under the

abstraction

10

Traditional Computer Forensics: Files


• Files

• File-level operations

• Internal metadata

11

Traditional Computer Forensics: Filesystems


• Filesystem– Organizational system – Implemented in both storage structure & process– Examples: FAT, inodes

• Filesystem metadata– Creation time– Modification time– Access time

12

Traditional Computer Forensics: “Hidden” Data


• Block Reuse Principles– Conserve cycles– Conserve I/O traffic

• Breaking through the Abstraction– File slack– Deleted files


Mobile Forensics: Obstacles

14

Mobile Forensics: Obstacles


• Designed for Loss / Theft• Modified by Carriers• Analysis software is less mature• Deleted data & metadata• Truncated email


Mobile Forensics: Opportunities

16

Mobile Evidence Collection: Opportunities (1/3)


• Opportunities from Common Practices– Devices not centrally managed – Data policies not implemented– Data remains on old devices– Data is maintained in backups

17



• Opportunities from Types of Data– Locational data available– Network connection information available

18



• Opportunities yielded by the process– Broadening scope of discovery– Helping to find the “digital packrat”

19

Mobile Evidence Collection: Spoliation


• Devices viewed as a private, personal accessory• Spoliation 10x increase over laptops• Can yield obstacles and opportunities

20

Mobile Evidence Collection: Other Issues


• Cloud backups• Encrypted backups• Commingled personal data

21

Mobile Evidence Collection: Quick Takeaways (1/4)


Trends:– Mobile device usage increasing– Mobile evidence issues multiplying– Mobile evidence collection increasingly complex


Source: Good Technology Corp. 2nd Annual State of BYOD Report. (n=100)

22



Checklist: Collecting a Smartphone– Get the smartphone– Get it fast– Turn on airplane mode ASAP– Obtain charging device– Keep battery charged– Obtain password / unlock code– If Blackberry, have company/owner unlock it– Send device & charger to mobile forensics expert

23



Secure Confidential & Proprietary Data– Strong & enforced IT policy– Password protection or encryption– Watermarks, print banners, or hidden identifiers– Usage restrictions (print, copy, etc.)

24



Geographic information not limited to Carriers– XIF data records geographic location of pictures– Pictures themselves can document location– Network connections are tracked and can be mapped back to

geographic locations


Q&A / Discussion

Have a matter involving mobile evidence collection? Ask.

Didn’t understand that? Ask.

Want more info? Ask.

Christian HicksPresident, Elysium Digital

[email protected]

617-621-3100 x100

Documents

Obstacles & Opportunities in Mobile Forensic Collections October 2, 2014 Evidence Collection in the Mobile Age