Smartphones Changing Online Evidence

Smart
Phones
and
the
Internet

::Societal
Shi3s
and
the
Age
of
the
App

16 Knight St., Norwalk, CT 06851 : (203) 855-5387
mike.harrington@teeltech.com : www.TeelTech.com

Topics

•  How
and
why
smartphones
are
changing
the

game
for
online
evidence

•  What
evidence
can
be
found
on
smartphones

and
how
does
it
work
with
“tradi<onal”
online

evidence
gathering

•  Sugges<ons
for
how
far
to
go
with
smart-‐

phone
evidence
and
how
to
work
in

conjunc<on
with
devices
and
online
evidence

gathering


Societal
ShiAs

•  Research
by
Ericsson
ConsumerLab
suggests

that
people
are
ﬁnding
it
increasingly
diﬃcult

to
live
without
a
connec<on
to
the
cloud

•  Prior
to
smartphones
people
used
the
internet

in
chunks
–
now
they
“jacked
in”
constantly

•  Consumers
are
forming
habits
integra<ng

internet
use
into
everyday
life
through
apps-‐
cloud
dependency!


Societal
ShiAs

•  To
date
35
percent
of
US
Android/iPhone

users
interact
with
non-‐voice
applica<ons
on

their
smartphones
before
gePng
out
of
bed

–  The
most
common
ac<vity
checking
Facebook
–

18
percent
of
social
networking
users
log
in
while

their
heads
are
s<ll
on
the
pillow


Societal
ShiAs

•  AAer
gePng
out
of
bed
23%
of
smartphone

users
access
the
internet
via
their
browsers,

24%
check
their
email
and
22%
check

Facebook

•  29%
use
Google
Maps
or
other
nav
tools
on

morning
commute
and
28%
listen
to
music


Societal
ShiAs


Societal
ShiAs

•  Smartphones
are
becoming
hubs
through

which
people
manage
their
social
lives

• 
Ericsson
ConsumerLab
reports
smartphone

users
are
spending
considerable
<me
using

“everyday”
apps
-‐integra<ng
internet
use
into

a
more
basic
level
of
everyday
life


Societal
ShiAs

•  Ericsson’s
research
suggests
“Consumers
expect,

and
increasingly
depend
on,
the
ability
to
access

online
services
easily
at
low
cost
and
complexity

from
mul<ple
loca<ons
during
the
day.”

•  Among
Americans
using
portable
storage
devices

–  54
percent
were
interested
in
synchronizing
the

portable
storage
from
anywhere

–  51
percent
want
direct
exchange
between
portable

devices
and
online
secure
storage


Societal
ShiAs

•  The
overwhelming
purpose
for
use
of
the

smartphone
is
personal
–
80-‐90%
of

respondents

•  Consumers
connect
to
apps
on
an
emo<onal

level

–  Feeling
of
be`er
control
of
life

–  Feeling
of
belonging


Market

•  Smart
phone
market
expected
to
grow
over

55%
in
2011

–  472
million
expected
shipped
in
2011

–  982
by
the
end
of
2015

•  Growth
is
four
<mes
faster
than
that
of

tradi<onal
mobile
phones

•  Emerging
markets
key
–
Asia/Paciﬁc,
La<n

America


Market


Android
Market
Share


Considera<ons

•  Working
with
other
inves<gators

•  How
far
to
go?


Evidence


Third
Party
Applica<ons

•  Over
300k
apps
for
sale
in
App
Store

•  There
are
many
unauthorized
applica<ons

from
jailbroken
phones

•  Can
contain
important
informa<on

•  Store
their
informa<on
using

–  Plists

–  Sqlite
databases

–  Text
ﬁles


Twi`er

•  Two
directories

–  Documents

–  Library

•  Documents

–  Com.atebits.twee<e.applica<on-‐state

•  Account
informa<on
and
followers


Twièr

•  Documents
(cont’d)

–  Com.atebits.twee<e.compose.aàchments

•  Hashed
numbers
as
file
names
-‐
actual
aàchments

sent
with
tweets

–  Com.atebits.twee<e.streams

•  One
or
more
property
lists

–  tweet
handles
(user
names)
and
tweets

»  date
and
<me
values
in
absolute
<me


Twi`er


Twi`er

Username/Date
Stamp


Facebook

•  In
iOS
most
informa<on
stored
on
server

•  Important
ﬁles
-‐
/Library/Applica<ons/Facebook

–  Friends.db

–  Com.facebook.Facebook.plist


Facebook


Skype

•  Allows
for
VOIP
calls
on
iOS
devices
connected

by
Wi-‐Fi

–  /Library/Skype/Applica<on
Support/$user/

–  Phone
Logs

–  Chat
logs

–  Account
details


Skype


iOS
GPS
Ar<facts
-‐
Maps

•  Maps
App

–  P
to
P
direc<ons

–  Locate
Points
of
Interest
(POI)

•  More
info

•  Direc<ons

–  Loca<on:
/Library/Maps

•  History.plist

•  Direc<ons.plist

•  Bookmark.plist


iOS
GPS
Ar<facts
-‐
Maps


iOS
GPS
Ar<facts
-‐
Maps

•  Bookmarks.plist

–  Not
easily
viewable
in
plist
editor

•  Data
is
base
64
encoded

–  Contains
loca<on

•  Cell
ID

–  This
is
Google’s
cell
ID
(cell
tower)
loca<on
database

•  Details

–  telephone
number

–  URL


iOS
GPS
Ar<facts
-‐
Maps

•  Direc<ons.plist

–  User
requested
point
to
point
direc<ons

•  Start
and
stop
end
points

•  Turn
by
turn
direc<ons

–  Viewed
in
the
plist
editor
the
data
is
base
64

encoded

–  Can
be
decoded
in
a
hex
or
text
editor

•  Online
base
64
decoders


iOS
GPS
Ar<facts
-‐
Maps

h8p://www.opinionatedgeek.com/
dotnet/tools/base64decode/


Geotags


Geotags
-‐
iOS


Geotags
-‐
iOS

•  Videos
in
iOS
store
Geo
Data
at
the
end
of
the

ﬁle


Geotags
-‐
iOS

•  Quick<me
can
be
used
to
format
Geo
data
in

videos
for
quick
viewing


Cellular
Data

•  =<
iOS
4.0

–  Located
in
/Library/caches/loca<ond

•  Cells.plist

•  Clients-‐b.plist

•  H-‐cells.plist

•  H-‐wiﬁ.plist

•  =>4.0

•  Located
in
/Library/caches/loca<ond

–  Clients.plist

–  Consolidated.db


Cellular
Data


Upcoming
Training

Advanced
Smartphone
Forensics

•  Smartphone
Forensics

Mississauga,
Ontario

September
19th
-‐
23rd

Device
Repair
and
Chip-‐off
Forensics

•  Repair
+
Chip-‐Off
Forensics

Wild
PCS
Training
Facility

Las
Vegas

Sept.
26th
-‐
30th

Advanced
BlackBerry
Forensics
Training

•  BlackBerry
Forensics

Manchester,
England

October
3rd
-‐
7th

Advanced
Mobile
Forensics
/

Flasher
Box
Forensics

•  Advanced
+
Flasher
Box
Forensics

SAIC
-‐
McLean,
Virginia

October
11th
-‐
13th

Device
Repair
and
Chip-‐off
Forensics

•  Repair
+
Chip-‐Off
Forensics

Wild
PCS
Training
Facility

Las
Vegas

Nov.
7th
-‐
11th


QuesOons?


Smartphones Changing Online Evidence

Recomendados

Recomendados

Mais conteúdo relacionado

Semelhante a Smartphones Changing Online Evidence

Semelhante a Smartphones Changing Online Evidence (20)

Mais de Vere Software

Mais de Vere Software (6)

Último

Último (20)

Smartphones Changing Online Evidence