Common practices in mobile device investigation
Question:
Discuss about the Computer Forensics and Digital Investigation.
This study offers the information about forensics tools of mobile device. The procurement, the examination, the preservation and the reporting, and examination of cellular device digital evidence. This data is related to enforcement of law and other kind of prosecution. This case study mainly concentrates on the features of mobile devices which includes smartphones, mobile phones and tablet etc. This study focus to address the common field which is investigated by security employee of organization and law prosecution investigators including electronic digital information residing on cellular phone and connected electronic media. This will engaged to accomplish available instruction and inquire intensely to problem relevant to cellular phones with respected analysis and examination. Techniques and process exist in this study are the combination of best system along with the discipline where reference got from available forensic rule. Its main function is to advise editor of the different knowledge associated with possible ways to access it from aspects of forensic.
Investigation style are practice the examination group can employ, which need no forensic tools of hardware and software. The common predominant practice are as follows:
Assure with mobile admin if a mobile is secured with authentication mechanism such as PIN, password, or other authentication techniques including authentication of information, the admin may be inquire about this data during an investigation process.
Password may be revealed by written in a slip and put near the mobile, at a desktop system need to synchronize wit cellular device or with the admin and it will found via visual examination (Hoog, 2011). Enclosed with substance of UICC and a cellular device is attached as PUK (PIN unlocking Key) which helps to reset PIN. The vulnerabilities exist in device may exploited like smudge attacks. This type of attacks includes very careful research of the external phase on touch screen phones to identify the usage of current gesture lock.
If a GSM cellular phones is secured with UICC PIN, analyzer therefore the ICCID will acquire from it and need to inquire the PUK from the service launcher and reset the password. Some of the service provider promotes capability to extract the PUK by accessing the amount of cellular phones where the particular subscriber data to universal web sites build for this type of principle. In future, the data acquired by approaching device manufacturer. Cellular phone users do prefer poor pin to protect their device in the form of 1-1-1-1, 0-0- 0-0 or 1-2-3-4. This format is not fully prescribed try to unlock a device applying those compounds for various threat determinant. This might leads to constant loss of mobile memory, permit advanced security techniques for example PUK or PIN and initiating destructive operation. Before applying the attempts to unlocking a cellular phones, it is suggested to consider the time of attempts left over. Instance has to be considered where an analyzer may prefer to take this risk. This is the only solution for information extraction.
Best practices for forensic analysis
In nature, Digital evidence is very delicate and it may be changed, broken, or destroyed by incorrect management or analysis. Examination is best management of an imitation of the original evidence. The original evidence must be seized by a way which secure and preserves the evidence integrity.
The main aim of the examination or analysis process is to refine and examine digital evidence. The extraction defines to the rehabilitation of information from its media. Analysis defines to the perception of collected data and storing it into a logical and needful plan.
Deal and examination must be documented throughout the process of forensic evidence management. This will terminate with the development of a written statement of the recommendation.
The key principle of mobile forensic apply when determining digital evidence. Various kind of media need various examination model. Individual processing an analysis of digital evidence must be practiced for this scope (Peterson & Shenoi, 2012).
When executing evidence analysis, consider the following stage:
Develop active directories on independent media to which evidence document and information can be found and refined.
There is a two-various kind of extraction such as physical extraction and logical extraction. The physical extraction level discovers and restore the information over the physical drive without concern of file system. The logical extraction level discovers and restores resources and information which is depend on the installed OS (operating system), applications and file system.
During the level of physical extraction, the resource from the drive appears at the physical stage unconcerned of file system exist on the drive. This may consider following techniques: searching keyword, document carving and refinement of the partition table and new space on physical drive.
- Keyword search performance in the physical drive is needful to permit the examiner to refine the information which does not assumed for by the file system or OS.
- File carving functionality of physical drive may help to recover and extracting needful file and resource which does not assumed for by the file system or OS.
- Analyzing the structure of partition can discover the file system exist and examine if the whole physical size of hard disk is considered for.
During the level of logical extraction from drive is depends on the file system exist on the drive and it invokes resources from such fields as operating file, deleted data, slack file and unallocated memory files. Stage may include the followings.
- File system data extraction is to disclose the feature such as structure of directory, resource attributes, name of the file, date and time of the file, location and size of the file.
- Data elimination is the process of discovering and neglecting file through the correlation of estimated hash values to authenticated values.
- Restoration of deleted files
- Separation of encrypted, password secured and compressed resource file management.
- Separation of file slack
- Separation of unallocated memory.
Analysis is the sequence of read the refined information to examine the importance for the case. The example analysis is performed by timeframe, application and file, data hiding and ownership possession. Analysis may need an inspection of the device request, searching and finding legal authority for digital evidence, investigate analytical leads.
Timeframe analysis is very needful for examining the events placed on a system. Two kind if methods can be utilized are
- Checking the data and time stamps exist in the metadata of file system for example last modified, current accessed or created to connect the file of interest for the timeframes related to the inspection.
- Checking the exist computer system and application logs. These consist with failure logs, installation logs, security logs, connection logs, etc.
Data will be covered with a system. The examination of data hiding is needful in discovering and recovering data and indicate information, intent. Techniques involved:
- Combining the resource headers to the respective extension of the file to discover mismatches
- Achieving the connection to all password secured, encrypted file and compressed zip file to indicate the attempt to cover the resource form unauthorized users.
- Steganography
- Achieving access to HPA (host-protected area). The existence of user-discovered information with HPA may reveal try to cover data.
- Application and file analysis
Extraction techniques for digital evidence
Enormous file and programs discovered which consist data related to the examination and offer awareness about the system ability and the user information (Tahiri, 2016). Outcome of the analysis reveal advance steps that require to be considered in the separation and examination processes. Some example is considered:
- Checking the name of the file for patterns and applicability.
- Analyzing the content of the file
- Discovering the number and kind of OS
- Relating the resources to the already installed application.
- Study relationship between the resources or files for example comparing history in the internet to cache file and mail file for email attachments.
- Discovering unknown resources types to evaluate their profit to the examination.
- Analyzing the default storage location of the users’ for application and structure of the file drive to analyses if the resource has been collected in their alternative or default location.
- Analyzing user-configuration settings of application.
There is some kind of terminology integrated to posit an explanation of digital intelligence which includes knowledge having the law prosecution and other departments of investigation and this will combine via forensic examination and operation of digital storage. Intelligence of Digital forensic will worn from the activities of intelligence and through the regular inspection where the intelligence restore in databases.
However, more number of examples associated with intelligence database along with this kind of forensic domain for the object of UK NDNAD (National DNA Database), IDENT1 which is known as National Fingerprint database of UK and the IAFIS called as USA Integrated Automated Fingerprint Identification system. The following databases are represents the comparison between evidence and intelligence. It does not having evidence but it will share effective solution for digital crimes that has not reveal at the certain period that similar access were combine with the database.
Forensic tools are used to manage the conventional investigation of cases requires by dispatch a vast number of applicable devices (Peterson & Shenoi, 2014). Complex situation such as recovery of erased information from the memory of a device will need more advanced tools and knowledge for the devices. The support extent is offered including cellular devices cables and driver, pc readers, documentation of the products may differs considerably among goods. The features provided such as bookmarking, searching and reporting ability may alter significantly. Tools must be validated to make sure with acceptability and re-practice when updates or new version of the tool is exist. Validating a tool require discovering a data set where the following procedures of acquisition to recollect the test data as well as assessing the outcomes. The significant features of forensic tools having the capability to control the integrity of original data being accessed and extracted data. Here some of the mobile device tools used for digital investigation.
Oxygen Forensic Suite discovering the inspection with Oxygen forensic suit discover the main expensive data such as IMSI, ICCID, IMEI in such cellular device that has been used in crime scenario. Figure. 1 represents the data that will assist the examiner to discover the primary evidence which is needed. This kind of case includes WhatsApp fraudulent. Therefore, data of WhatsApp text is discover. The Oxygen Forensic Suite tool is utilized in practice of a freeware where there is some constraint on the quantity of data which will be extracted.
Utilizing UDED tool in forensic analysis is not the end. Most of the forensic professionals suggesting more number of tools for the purpose of separate detailed evidences which can be produced in the court. The smartphones were approved by using UFEFD physical analyzer cellebrite broaden the search gap of evidence. Information in the smartphone was separated by the software (Widup, 2014). The software separated the analytical data which can assist the forensic examination such as message history and call logs. The Artefact represents the installation of whatsapp in smartphone are represented in Fig. 2.
Conclusion
Procedure for achieving forensic analysis must be organized with proper guidelines especially for managing evidence. At first, considering the issues of mobile application like whatsapp, the examination of the suspected device must achieve using mobile forensic software tool such as oxygen forensic suite and UFED physical cellebrite tools within a controlled surrounding while secure that evidential and evidence stability is managed. Examination of extracted data from testing tools along with logs from ISP must be correlate and determined and discovering reported. The devices with IMEI, IMSI and ICCID number as well as SIM card will be related with significant logs. This study offers the information about mobile forensics tools. The acquisition, the examination, the preservation and reporting, and analysis of cellular device digital evidence. This study focuses to address the common field which is investigated by security employee of organization and law prosecution investigators are discussed.
References
Gladyshev, P., & Rogers, M. (2012). Digital forensics and cyber crime. Berlin: Springer.
Hoog, A. (2011). Android forensics. Waltham, MA: Syngress.
Peterson, G., & Shenoi, S. (2012). Advances in digital forensics VIII. Heidelberg: Springer.
Peterson, G., & Shenoi, S. (2014). Advances in Digital Forensics X. Berlin, Heidelberg: Springer Berlin Heidelberg.
Tahiri, S. (2016). Mastering Mobile Forensics. Packt Publishing.
Widup, S. (2014). Computer forensics and digital investigation with EnCase Forensic v7. New York: McGraw-Hill Education.
Order an Essay Now & Get These Features For Free:
Turnitin Report
Formatting
Title Page
Citation
Outline
