Advanced Techniques in Forensic Examination of Smartphones 2010 (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com Smartphones market growth Data provided by FutureSource Consulting Smartphones market is growing even while general mobile phones market falling (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com Smartphone is a small PC (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com Smartphone as: Cell phone * - Usually these features are not utilized by smartphones (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com Smartphone as: Address book (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com Smartphone as: Planner (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com Smartphone as: Messenger (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com Smartphone as: GPS navigator * - Available in EXIF header for many new models ** - Available in smartphones with Nokia LifeBlog application installed (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com Smartphone as: Web client * - Available for some IM clients (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com Smartphone as: PC (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com Standard extraction methods There are standard ways to get forensic information from smartphones: logical and physical analysis (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com Logical analysis for smartphones Caller groups Custom field labels General phone Speed dials information Messages from Contacts* custom folders Calendar Event log Deleted messages Notes information Calls history Service center timestamps Messages* GPS information Files* Location tagged data Settings* Web browser data Bookmarks IM client data * - Available data set is restricted and depends highly on manufacturer implementation 3rd party apps 1) The information extracted by all logical protocols is only the top of the iceberg 2) All logical protocols were developed for data synchronization (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com Physical analysis for smartphones How to deal with gigabytes of that? (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com Standard extraction methods: Summary (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com How to extract data without a headache? In 2002 Oxygen Software invented the 3rd way - analysis using a special agent application working inside smartphone OS * - Agent can extract all the information available for native OS applications (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com Agent application usage General phone information & SIM card data Contacts with all fields and custom field labels Caller groups & Speed dials Event Log Calendar events Tasks & Notes Messages from standard and custom folders Deleted messages information Service center timestamp Camera snapshots, video clips and voice records File system GPS & Location tagged information Web browser cache & bookmarks IM clients data 3rd party applications with their information (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com - Protected operating system files - Memory dump Afraid of writing to device? Comparison of phone content changes when performing analysis using different approaches * - Extra sync add-ons installation may be needed to extract some additional information (e.g MMS) ** - Agent does not generate any log files Unlike Agent, SyncML server is not a forensically designed app and is out of full control from examiner In addition - it makes more data modifications than Agent (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com Summary Smartphones is a considerable part of mobile device market FutureSource Consulting forecasts that, between 2008 and 2013, annual sales of smartphones will rise by 95% to over 300 million It will be around 37% of all new mobile phones, up from 13% in 2008 Smartphones store much more important forensic information than plain cell phones Being a multiple-in-one device and having OS with open API smartphones are turning into small PCs with big memory sizes, wide set of preinstalled applications and huge number of available 3rd party applications Standard extraction methods are less effective for smartphones All logical protocols were developed for sync purposes, thus they can only extract a top of the iceberg Physical analysis of gigabyte hex dumps takes a lot of time Agent application usage is the golden mean The Agent application approach, introduced by Oxygen Software in 2002, almost achieves the completeness of data extracted by physical methods At the same time it works via standard cables and adaptors and allows to present the extracted data in readable and user-friendly format that is more peculiar to logical analysis (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com Interested in more details? Oxygen Forensic Suite 2010 www.oxygen-forensic.com Oxygen Forensics for iPhone www.iphone-forensics.com +44 (0) 20 8133 8450 (UK) +1 877 9-OXYGEN (USA) £499 £899 Standard Oxygen Forensic Suite and Oxygen Forensic Suite 2010 a the trademarks of Oxygen Software Oxygen Software LLC was founded in year 2000 and since that time our business is a PC-to-mobile communication Professional (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com [...]... tagged data Settings* Web browser data Bookmarks IM client data * - Available data set is restricted and depends highly on manufacturer implementation 3rd party apps 1) The information extracted by all logical protocols is only the top of the iceberg 2) All logical protocols were developed for data synchronization (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com Physical analysis for smartphones. .. designed app and is out of full control from examiner In addition - it makes more data modifications than Agent (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com Summary Smartphones is a considerable part of mobile device market FutureSource Consulting forecasts that, between 2008 and 2013, annual sales of smartphones will rise by 95% to over 300 million It will be around 37% of all new mobile. .. information & SIM card data Contacts with all fields and custom field labels Caller groups & Speed dials Event Log Calendar events Tasks & Notes Messages from standard and custom folders Deleted messages information Service center timestamp Camera snapshots, video clips and voice records File system GPS & Location tagged information Web browser cache & bookmarks IM clients data 3rd party applications... phones, up from 13% in 2008 Smartphones store much more important forensic information than plain cell phones Being a multiple-in-one device and having OS with open API smartphones are turning into small PCs with big memory sizes, wide set of preinstalled applications and huge number of available 3rd party applications Standard extraction methods are less effective for smartphones All logical protocols... usage is the golden mean The Agent application approach, introduced by Oxygen Software in 2002, almost achieves the completeness of data extracted by physical methods At the same time it works via standard cables and adaptors and allows to present the extracted data in readable and user-friendly format that is more peculiar to logical analysis (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com...Standard extraction methods There are 2 standard ways to get forensic information from smartphones: logical and physical analysis (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com Logical analysis for smartphones Caller groups Custom field labels General phone Speed dials information Messages from... Oxygen Forensics for iPhone www.iphone-forensics.com +44 (0) 20 8133 8450 (UK) +1 877 9-OXYGEN (USA) £499 £899 Standard Oxygen Forensic Suite and Oxygen Forensic Suite 2010 a the trademarks of Oxygen Software Oxygen Software LLC was founded in year 2000 and since that time our business is a PC-to -mobile communication Professional (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com ... http://www.oxygen-forensic.com Physical analysis for smartphones How to deal with gigabytes of that? (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com Standard extraction methods: Summary (C) Oxygen Software, 2000-2010 http://www.oxygen-forensic.com How to extract data without a headache? In 2002 Oxygen Software invented the 3rd way - analysis using a special agent application working inside smartphone OS * ... achieves the completeness of data extracted by physical methods At the same time it works via standard cables and adaptors and allows to present the extracted data in readable and user-friendly format... Messages* GPS information Files* Location tagged data Settings* Web browser data Bookmarks IM client data * - Available data set is restricted and depends highly on manufacturer implementation.. .Smartphones market growth Data provided by FutureSource Consulting Smartphones market is growing even while general mobile phones market falling (C) Oxygen