Mobile Forensics

Mobile phone forensics
A science of recovering digital evidence from a mobile phone under forensically sound conditions.

 

......................................................................................................
Mobile Concept

 

Common type of mobile OS
webos
symbian os
android os: open source
apple ios
windows phone7
rim blackberry os

ps:
Blackberry devices:
encryption technology of Password Keeper is AES
hashing method of password protection is SHA-1

...

Architecture of cellular network
Mobile station:手機
SIM(subscriber identity module)
Base station subsystem:機地台
BST(base transceiver station)
BSC(base station controller)
Network subsystem:電信機房
MSC(mobile services switching center)
other as below
 HLR(home location register)
 VLR(visitor location register)
 EIR(equipment identity register)
 AUC(authentication center)

...

鑑識目標主要有
SIM卡
mobile device

SIM(subscriber identity module)
a removable component that contains essential information about the subscriber
main funcation entails authenticating the suer of the cell phone
it has both volatile and nonvolatile memory
the file system of a SIM resides in nonvolatile memory

SIM password
a PIN(Personal identification Number) code
PUK(Personal Unlock Number) can unlock protection of 3 times password failed

SIM file system
MF(master file):1個MF包含多個DF
DF(dedicated file):1個DF包含多個EF
EF(elementary files)

ICCID(integrated circuit card identification)
SIM id
20 digit number as below
1-2 = industry identifier prefix, 89 for telcommunication
3-4 = country code
5-10 = issuer identifier number
11-20 = individual account identification number

IMEI(international mobile equipment identifier)
15 digit number
first 8 digit = TAC(type allocation code)
it can be obtained by keying in *#06#

ESN(electronic serial number)
unique 32 bit identifier recorded on a secure chip

 

......................................................................................................

Mobile Forensics Process

Acquire the information
acquire data from SIM card
acquire data from synched devices,memory cards
acquire data from obsructed and unobstructed mobile devices,
gather data from network operator
gather data from sqlite record

Sqlite database
store vital information by iOS and android
information include contacts,SMS,call records

Hex viewer from sqlite record
1th,record length: 1 byte
2th,key: 1byte
3th,record header length: 1byte
5th,address length:1byte
6th,date and time stamp,1byte
7~8th,message length: 2byte
9th,flag

...

Mobile evidence
SIM in GSM/UMTS: 有使用者相關資訊
Phone Internal Memory(手機記憶體): 有大部分的通話紀錄
Flash Memory Card(記憶卡): 很多手機記憶體或Sim卡中的資料
找系統商Call data:包括來源號碼,掛斷號碼,來話設備號碼,通話時間,使用服務,當時基地台...etc

找手機證據的方法
1.關掉手機避免破壞
2.分別檢視手機內的證據
3.從使用者或系統商取得SIM卡的存取碼並檢驗SIM卡
ex: 使用普通的Smart Card Reader可以找回刪掉的資料
4.檢驗Flash Memory
ex: 將mobile接到電腦上用forensic tool分析, tool像是 EnCase,FTK,SMART,WinHEX
5.把mobile的記憶體作bit stream copy
ex: 取下Memory Chip並讀內容
ex: 從主機板讀取內容

refer
http://wenku.baidu.com/view/da7fbcd0360cba1aa811da11.html?re=view

...

Mobile forensics software tools

Popular tool as below
oxygen forensic suite
paraben tool


2015-10-24 08:12:27發表 0000-00-00 00:00:00修改   

數據分析
程式開發
計算機組織與結構
資料結構與演算法
Database and MySql
manage tool
windows
unix-like
linux service
network
network layer3
network layer2
network WAN
network service
作業系統
數位鑑識

資訊安全解決方案
資訊安全威脅
Cisco security
Cisco network
Cisco layer3
Cisco layer2



  登入      [牛的大腦] | [單字我朋友] Powered by systw.net