Digital Forensics – Top 10 Challenges

Introduction

The ability of criminals and terrorists to maximise the opportunities offered by new technology is constantly evolving. Burying incriminating data within the increasing storage capacity of PCs and laptops presents the police and security forces with new and demanding challenges; challenges that are exacerbated by the very short space of time in which examinations of seized assets can take place. Through experience gained delivering solutions across the UK Security & Resilience community, Andrew Nanson presents the Top 10 challenges that organisations are likely to face when implementing digital forensics solutions.

1. Storage

When each suspect can store over 10 terabytes of information on home equipment, a forensic laboratory must be able to cope with the uploading, retention and manipulation of that data. It’s no longer viable to rely on local storage for each analyst. Centralised-storage is becoming a necessity.

To address this issue, we have looked at the advantages offered by Fibre-Channel storage for the initial uploading and subsequent retention of data. Fibre-Channel storage is fast, reliable and supports very high levels of input-output for multiple applications and intensive processes, such as indexing. This is ideal for forensic laboratories that must perform to timescales and can’t afford for their capability to fail.

In addition, we believe it is advisable to complement the Fibre-Channel storage with very large amounts of Serial Advanced Technology Attachment (SATA) storage. SATA is cheap and reliable. By providing both Fibre-Channel and SATA disk storage, it is possible to balance the real needs of a forensic laboratory, at the best possible price.

The solution has been proven working alongside forensic-analysts using real data at a ListX facility in Bristol.

2. Backup / archive

Forensic laboratories are often now scaled to hold up to one PetaByte of online storage. We have devised a manageable solution that guarantees against loss of data. Furthermore, it does this without impacting on the performance of a system; a system that has to be operational 24/7/365.

By taking a ‘snapshot’ of the data before it’s sent to offline media, the performance of the live storage is never degraded. This provides the users and the business with what it needs: a system without planned downtime.

3. Application performance

The effectiveness of forensic laboratories is often down to the performance of the applications that are used by the forensic analysts. This is either because the applications do

not yet take advantage of modern hardware, or because the nature of their function is such that they will never perform as quickly as the business would like. To address this issue, VEGA can devise solutions that allows the most intensive forensic applications to be served from powerful-servers. This enables applications to operate with as little ‘lag’ as possible.

By providing multiple variables of the same application, forensic analysts can initiate multiple actions from a single workstation. This results in greatly increased productivity, removing ‘dead-time’ where analysts may have traditionally had to wait hours before undertaking other activities.

4. Scalability

All technology solutions have their limits, often requiring a step-change in hardware or software to expand or contract. This can be a prohibitive factor in gradual expansion of capabilities due to the cost associated with this step-change.

Therefore, developing solutions that are fully scalable, supporting capability and user expansion / contraction through modularised technology is essential as these can be designed to scale up to a PetaByte of storage from the start and can be further increased if required. There is no theoretical limit on the number of users that can be hosted.

In addition, as the majority of forensic applications are served, thin-clients can be deployed within minutes anywhere, with the full set of forensic tools required for any investigation.

5. Malware protection

One of the biggest issues for forensic laboratories is unknown malware. To understand what an unidentified piece of software can do, analysts sometimes need to reverse engineer it, or execute it and monitor what it does. If it transpires to be unknown malware, there is the potential of corrupting the entire forensic laboratory and calling into doubt the integrity of the environment used to produce evidence.

Even the best anti-virus programmes only mitigate known risks and attack-vectors. Therefore, a series of security-enforcing functions should always be built that are invisible to the user and enable forensic analysts to examine unknown code without risk to the integrity of the forensic laboratory.

6. Accreditation

The high profile data losses of recent years have propelled the issue of information assurance to the top of the political agenda. Having devised secure systems for the most sensitive parts of UK Government, we have the experience to create a solution that complies with HMG Manual of Protective Security, as well as JSP440. The security enforcing functions mitigate against high confidentiality, integrity and availability requirements.

7. System Integration

Forensic laboratories are normally isolated technical units that use an air-gap between themselves and the main desktop infrastructure. A solution can include secure and reliable integration methods that enable organisations to transfer data safely, between corporate systems and laboratories. This is based on devising methods to bring multiple sources of information together, to provide a seamless system that meets accreditation requirements, as well as extends the information available to users.

8. Support

It is unacceptable for forensic laboratories to require a high level of maintenance. Specialist understand this and have created a solution based on Commercial Off The Shelf (COTS) products, which means clients are not tied into any supplier for long-term support, since the skills required are readily available.

9. Longevity

The rapid development of information technology and the ability of criminals and terrorists to use them to their advantage, demands that any digital forensic solution is able to evolve quickly and with minimum disruption. We work with leading forensic application providers to ensure that we understand how best to improve capability for users now and in the future. Solutions should take account of the latest hardware in production, software development, and the ever-increasing burden on forensic analysts and that of the business. This long-term planning and investment demonstrates our commitment to this field.

10. Ensuring best value-for-money

As public sector budgets come under increasing pressure, and expenditure faces intense scrutiny, organisations must ensure investment in IT provides value-for-money.

The Use of Digital Forensics For a Private Investigator

Digital Forensics is referred to as computer forensic analysis, electronic evidence discovery, digital discovery, computer analysis, and computer examinations. It is the process of preservation, identification, interpretation and documentation of evidence recovered for presentation in civil or criminal court.

Digital Forensic helps recovering deleted files and searching the slack and unallocated space on the hard drive, places where valuable hard to find evidence regularly resides. It traced on windows artifacts, for clues of what the computer has been used for, and, more importantly, knowing how to find the artifacts, and evaluating the value of information. Processing of hidden files that contain past usage information.

Professionally trained forensic technicians can recover data from a hard drive, floppy disk,USB keys, CF cards or SD cards, smart phone or cell telephone or flash card memory stick, data recovery can be done with digital forensic solution using the latest technology to recover your data. Electronic digital evidence acquisition, search, filter and consolidation of data, e-mail’s and files from virtually any type of media including hard drives, backup tapes, CD-ROM, floppy disks, Zip disks.

Computer forensics is capable to run the string-search for e-mail with an analysis revealing the Internet usage, recover data, and accomplish a full analysis even after the computer has been defragged and/or formatted.

Here are some examples on how Digital forensics provide assistance to private investigator in specific tasks and scenarios:

1. Adultery cases : where the forensic recovery was used to find evidence/trail of an unfaithful husband
Tailing the suspect : by using GPS (Global Positioning System).

Evidende Acquisition : Deleted mails, erased SMS Text messages, cell phone messages archives and others.

2. Harassment cases: victim receiving of harassment via phone, and/or email.

Tailing the suspect : Preserve logs of phone calls received from cell phones or email sent from a given source and present them as evidence by strictly maintaining a chain of custody. The forensic examiner can analyze the email header and trace it for the origins of the IP address from which it has been sent.

3. Surveillance cases : continual observation of a person closely in suspection of doing something illegal

Tailing the suspect : modern devices such as spy-ware programs and keystroke loggers are able to capture and provide real time information about what, where and when things have occurred on a suspected computer.

As society and economy evolved, the competitiveness in private investigation field gets intense. Therefore, it is vital to always stay with the latest modern technology with its latest devices, in order to provide the best professional and valued services to their clients. The ability of private investigator to equip with certain knowledge and skill on digital Forensics is a great essential step not only to further enhance the stability of this professional service, but to monopoly this business as well.

An Introduction to Forensics Data Acquisition From Android Mobile Devices

The role that a Digital Forensics Investigator (DFI) is rife with continuous learning opportunities, especially as technology expands and proliferates into every corner of communications, entertainment and business. As a DFI, we deal with a daily onslaught of new devices. Many of these devices, like the cell phone or tablet, use common operating systems that we need to be familiar with. Certainly, the Android OS is predominant in the tablet and cell phone industry. Given the predominance of the Android OS in the mobile device market, DFIs will run into Android devices in the course of many investigations. While there are several models that suggest approaches to acquiring data from Android devices, this article introduces four viable methods that the DFI should consider when evidence gathering from Android devices.

A Bit of History of the Android OS

Android’s first commercial release was in September, 2008 with version 1.0. Android is the open source and ‘free to use’ operating system for mobile devices developed by Google. Importantly, early on, Google and other hardware companies formed the “Open Handset Alliance” (OHA) in 2007 to foster and support the growth of the Android in the marketplace. The OHA now consists of 84 hardware companies including giants like Samsung, HTC, and Motorola (to name a few). This alliance was established to compete with companies who had their own market offerings, such as competitive devices offered by Apple, Microsoft (Windows Phone 10 – which is now reportedly dead to the market), and Blackberry (which has ceased making hardware). Regardless if an OS is defunct or not, the DFI must know about the various versions of multiple operating system platforms, especially if their forensics focus is in a particular realm, such as mobile devices.

Linux and Android

The current iteration of the Android OS is based on Linux. Keep in mind that “based on Linux” does not mean the usual Linux apps will always run on an Android and, conversely, the Android apps that you might enjoy (or are familiar with) will not necessarily run on your Linux desktop. But Linux is not Android. To clarify the point, please note that Google selected the Linux kernel, the essential part of the Linux operating system, to manage the hardware chipset processing so that Google’s developers wouldn’t have to be concerned with the specifics of how processing occurs on a given set of hardware. This allows their developers to focus on the broader operating system layer and the user interface features of the Android OS.

A Large Market Share

The Android OS has a substantial market share of the mobile device market, primarily due to its open-source nature. An excess of 328 million Android devices were shipped as of the third quarter in 2016. And, according to netwmarketshare.com, the Android operating system had the bulk of installations in 2017 — nearly 67% — as of this writing.

As a DFI, we can expect to encounter Android-based hardware in the course of a typical investigation. Due to the open source nature of the Android OS in conjunction with the varied hardware platforms from Samsung, Motorola, HTC, etc., the variety of combinations between hardware type and OS implementation presents an additional challenge. Consider that Android is currently at version 7.1.1, yet each phone manufacturer and mobile device supplier will typically modify the OS for the specific hardware and service offerings, giving an additional layer of complexity for the DFI, since the approach to data acquisition may vary.

Before we dig deeper into additional attributes of the Android OS that complicate the approach to data acquisition, let’s look at the concept of a ROM version that will be applied to an Android device. As an overview, a ROM (Read Only Memory) program is low-level programming that is close to the kernel level, and the unique ROM program is often called firmware. If you think in terms of a tablet in contrast to a cell phone, the tablet will have different ROM programming as contrasted to a cell phone, since hardware features between the tablet and cell phone will be different, even if both hardware devices are from the same hardware manufacturer. Complicating the need for more specifics in the ROM program, add in the specific requirements of cell service carriers (Verizon, AT&T, etc.).

While there are commonalities of acquiring data from a cell phone, not all Android devices are equal, especially in light that there are fourteen major Android OS releases on the market (from versions 1.0 to 7.1.1), multiple carriers with model-specific ROMs, and additional countless custom user-complied editions (customer ROMs). The ‘customer compiled editions’ are also model-specific ROMs. In general, the ROM-level updates applied to each wireless device will contain operating and system basic applications that works for a particular hardware device, for a given vendor (for example your Samsung S7 from Verizon), and for a particular implementation.

Even though there is no ‘silver bullet’ solution to investigating any Android device, the forensics investigation of an Android device should follow the same general process for the collection of evidence, requiring a structured process and approach that address the investigation, seizure, isolation, acquisition, examination and analysis, and reporting for any digital evidence. When a request to examine a device is received, the DFI starts with planning and preparation to include the requisite method of acquiring devices, the necessary paperwork to support and document the chain of custody, the development of a purpose statement for the examination, the detailing of the device model (and other specific attributes of the acquired hardware), and a list or description of the information the requestor is seeking to acquire.

Unique Challenges of Acquisition

Mobile devices, including cell phones, tablets, etc., face unique challenges during evidence seizure. Since battery life is limited on mobile devices and it is not typically recommended that a charger be inserted into a device, the isolation stage of evidence gathering can be a critical state in acquiring the device. Confounding proper acquisition, the cellular data, WiFi connectivity, and Bluetooth connectivity should also be included in the investigator’s focus during acquisition. Android has many security features built into the phone. The lock-screen feature can be set as PIN, password, drawing a pattern, facial recognition, location recognition, trusted-device recognition, and biometrics such as finger prints. An estimated 70% of users do use some type of security protection on their phone. Critically, there is available software that the user may have downloaded, which can give them the ability to wipe the phone remotely, complicating acquisition.

It is unlikely during the seizure of the mobile device that the screen will be unlocked. If the device is not locked, the DFI’s examination will be easier because the DFI can change the settings in the phone promptly. If access is allowed to the cell phone, disable the lock-screen and change the screen timeout to its maximum value (which can be up to 30 minutes for some devices). Keep in mind that of key importance is to isolate the phone from any Internet connections to prevent remote wiping of the device. Place the phone in Airplane mode. Attach an external power supply to the phone after it has been placed in a static-free bag designed to block radiofrequency signals. Once secure, you should later be able to enable USB debugging, which will allow the Android Debug Bridge (ADB) that can provide good data capture. While it may be important to examine the artifacts of RAM on a mobile device, this is unlikely to happen.

Acquiring the Android Data

Copying a hard-drive from a desktop or laptop computer in a forensically-sound manner is trivial as compared to the data extraction methods needed for mobile device data acquisition. Generally, DFIs have ready physical access to a hard-drive with no barriers, allowing for a hardware copy or software bit stream image to be created. Mobile devices have their data stored inside of the phone in difficult-to-reach places. Extraction of data through the USB port can be a challenge, but can be accomplished with care and luck on Android devices.

After the Android device has been seized and is secure, it is time to examine the phone. There are several data acquisition methods available for Android and they differ drastically. This article introduces and discusses four of the primary ways to approach data acquisition. These five methods are noted and summarized below:

1. Send the device to the manufacturer: You can send the device to the manufacturer for data extraction, which will cost extra time and money, but may be necessary if you do not have the particular skill set for a given device nor the time to learn. In particular, as noted earlier, Android has a plethora of OS versions based on the manufacturer and ROM version, adding to the complexity of acquisition. Manufacturer’s generally make this service available to government agencies and law enforcement for most domestic devices, so if you’re an independent contractor, you will need to check with the manufacturer or gain support from the organization that you are working with. Also, the manufacturer investigation option may not be available for several international models (like the many no-name Chinese phones that proliferate the market – think of the ‘disposable phone’).

2. Direct physical acquisition of the data. One of rules of a DFI investigation is to never to alter the data. The physical acquisition of data from a cell phone must take into account the same strict processes of verifying and documenting that the physical method used will not alter any data on the device. Further, once the device is connected, the running of hash totals is necessary. Physical acquisition allows the DFI to obtain a full image of the device using a USB cord and forensic software (at this point, you should be thinking of write blocks to prevent any altering of the data). Connecting to a cell phone and grabbing an image just isn’t as clean and clear as pulling data from a hard drive on a desktop computer. The problem is that depending on your selected forensic acquisition tool, the particular make and model of the phone, the carrier, the Android OS version, the user’s settings on the phone, the root status of the device, the lock status, if the PIN code is known, and if the USB debugging option is enabled on the device, you may not be able to acquire the data from the device under investigation. Simply put, physical acquisition ends up in the realm of ‘just trying it’ to see what you get and may appear to the court (or opposing side) as an unstructured way to gather data, which can place the data acquisition at risk.

3. JTAG forensics (a variation of physical acquisition noted above). As a definition, JTAG (Joint Test Action Group) forensics is a more advanced way of data acquisition. It is essentially a physical method that involves cabling and connecting to Test Access Ports (TAPs) on the device and using processing instructions to invoke a transfer of the raw data stored in memory. Raw data is pulled directly from the connected device using a special JTAG cable. This is considered to be low-level data acquisition since there is no conversion or interpretation and is similar to a bit-copy that is done when acquiring evidence from a desktop or laptop computer hard drive. JTAG acquisition can often be done for locked, damaged and inaccessible (locked) devices. Since it is a low-level copy, if the device was encrypted (whether by the user or by the particular manufacturer, such as Samsung and some Nexus devices), the acquired data will still need to be decrypted. But since Google decided to do away with whole-device encryption with the Android OS 5.0 release, the whole-device encryption limitation is a bit narrowed, unless the user has determined to encrypt their device. After JTAG data is acquired from an Android device, the acquired data can be further inspected and analyzed with tools such as 3zx (link: http://z3x-team.com/ ) or Belkasoft (link: https://belkasoft.com/ ). Using JTAG tools will automatically extract key digital forensic artifacts including call logs, contacts, location data, browsing history and a lot more.

4. Chip-off acquisition. This acquisition technique requires the removal of memory chips from the device. Produces raw binary dumps. Again, this is considered an advanced, low-level acquisition and will require de-soldering of memory chips using highly specialized tools to remove the chips and other specialized devices to read the chips. Like the JTAG forensics noted above, the DFI risks that the chip contents are encrypted. But if the information is not encrypted, a bit copy can be extracted as a raw image. The DFI will need to contend with block address remapping, fragmentation and, if present, encryption. Also, several Android device manufacturers, like Samsung, enforce encryption which cannot be bypassed during or after chip-off acquisition has been completed, even if the correct passcode is known. Due to the access issues with encrypted devices, chip off is limited to unencrypted devices.

5. Over-the-air Data Acquisition. We are each aware that Google has mastered data collection. Google is known for maintaining massive amounts from cell phones, tablets, laptops, computers and other devices from various operating system types. If the user has a Google account, the DFI can access, download, and analyze all information for the given user under their Google user account, with proper permission from Google. This involves downloading information from the user’s Google Account. Currently, there are no full cloud backups available to Android users. Data that can be examined include Gmail, contact information, Google Drive data (which can be very revealing), synced Chrome tabs, browser bookmarks, passwords, a list of registered Android devices, (where location history for each device can be reviewed), and much more.

The five methods noted above is not a comprehensive list. An often-repeated note surfaces about data acquisition – when working on a mobile device, proper and accurate documentation is essential. Further, documentation of the processes and procedures used as well as adhering to the chain of custody processes that you’ve established will ensure that evidence collected will be ‘forensically sound.’

Conclusion

As discussed in this article, mobile device forensics, and in particular the Android OS, is different from the traditional digital forensic processes used for laptop and desktop computers. While the personal computer is easily secured, storage can be readily copied, and the device can be stored, safe acquisition of mobile devices and data can be and often is problematic. A structured approach to acquiring the mobile device and a planned approach for data acquisition is necessary. As noted above, the five methods introduced will allow the DFI to gain access to the device. However, there are several additional methods not discussed in this article. Additional research and tool use by the DFI will be necessary.