See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/340939977

Mobile Forensic: Investigation of Dead or Damage Smart Phone -An Overview,

Tools & Technique Challenges from Law Enforcement Perspective.

Article · April 2020

CITATIONS READS

4 9,755

1 author:

Rhythm Kr Dasgupta
JIS COLLEGE OF ENGINEERING
16 PUBLICATIONS 11 CITATIONS

SEE PROFILE

All content following this page was uploaded by Rhythm Kr Dasgupta on 27 April 2020.

The user has requested enhancement of the downloaded file.

 Mobile Forensic: Investigation of Dead or Damage Smart Phone - An
Overview, Tools & Technique Challenges from Law Enforcement Perspective.

Rhythm Kr Dasgupta

Abstract 1. Introduction

The rapid development and grow of the Digital forensics is an interesting fast-paced
mobile phones industry the possibility of field that can have a powerful impact on a
they are often involved in digital crimes wide range of situations such as internal
and digital investigation as well. Mobile corporate investigations, civil litigation,
forensic is fast becoming an abbreviated criminal investigations, information gathering,
and issues such as national security. As has
term that describes the process of applying
been defined by National Security Database
digital forensics in mobile phones world.
(NSD), digital forensics is a branch of
While the mobile device market provides a
forensic science including the retrieval and
great variety of manufactures and models investigation of material found in-digital
causing a strong diversity. It becomes devices, often related to computer crime.
difficult for a professional investigator to Mobile device forensic, cellular phone
choose the proper forensics tools or forensic or mobile forensics are all synonyms
technique for seizing internal data from to the same term which refers to the branch of
mobile devices. This paper examines the digital forensics that concern with recovering
of digital evidence or data from a mobile
nature of some of the newer pieces of
device under forensically sound conditions.
information that can become potential
evidence on mobile phones. It also Mobile Device forensic tool is to obtain data
discusses some of the emerging from a Mobile Device without modifying the
technologies and their potential impact on data. Flash memory is currently the most
dead or physical damage Smart phone dominant non-volatile solid-state storage
technology in consumer electronic products.
based evidence. Finally, the paper gives
An increasing number of embedded systems
recommendation for following the best
use high level file systems comparable to the
practices for investigating smartphones.
file systems used on personal computers.
Keywords: Mobile forensics, cell phone Current forensic tools for examination of
evidence, mobile phone forensic toolkits, embedded systems like mobile phones or
digital device forensics, Embedded PDAs mostly perform logical data acquisition.
System, eMMC, JTAG, SPI, UFI Box.
With logical data acquisition it’s often not Many mobile phones come with security
possible to recover all data from a storage software such as passwords, biometrics, or
medium. Deleted data for example, but pattern locks so the individual can protect
sometimes also other data which is not the data within the phone. This can cause
directly relevant from a user standpoint, issues for investigators if these measures
can not be acquired and potentially are allowed to activate. One such way
interesting information might be missed. these security measures can be activated is
For this reason data acquisition is wanted due to power depletion.
at the lowest layer where evidence can be
expected. For hard disk based storage Due to the nature of investigations on a
media it’s common to copy all bytes from mobile phone, an exact forensically sound
the original storage device to a destination reproduction may not be possible. This
storage device and then do the analysis on issue requires investigators to take special
this copy. The same procedure is desired care in documenting all the steps taken
for embedded systems with solid-state during the search of the device. It is
storage media. important that this recovery is done under
forensically sound conditions. There are a
2. Survey on mobile forensics number of items that must be kept in mind
when dealing with mobile forensics.
The National Institute of Standards and
Technology defines mobile phone 2.1 Chain of custody
forensics as, “the science of recovering
digital evidence from a mobile phone Establishing and maintaining the chain of
under forensically sound conditions using custody (CoC) and maintaining integrity
accepted methods”. Turning the power on the mobile device can prove quite
failure mobile device on may cause difficult when dealing with mobile
security protocols to reactivate, and it also devices. Most available forensic tools
connects the device to the live network require the investigator to install an
introducing the problems previously application to the system to be analysed.
stated. Physical acquisitions are much Additionally, there is no way to physically
more difficult on mobile devices as they make file systems read-only. Investigating
require specialised hardware or software the device in a test environment might be
and more training. Logical acquisitions recognised by malware and lead to
recover the files and directories of a drive; evidence loss. Acquiring evidence from
information such as call records, text mobile devices may therefore taint the
messages and contact lists, this type of integrity of the evidence rendering it non
acquisition cannot recover deleted files. admirable for trials.
 4. Data Acquisition Process
2.2 Acquisition Methodology
The first principle when examining
The first principle when examining electronic evidence is to keep data held on
electronic evidence is to keep data held on a storage medium unchanged. For flash
a storage medium unchanged. For flash memory wear levelling might cause
memory wear levelling might cause unpredictable data changes. Switching
unpredictable data changes. Switching mobile phones off and/or on has shown
mobile phones off and/or on has shown data changes probably caused by wear
data changes probably caused by wear levelling and/or garbage collection
levelling and/or garbage collection algorithms. The general rule of data
algorithms. The general rule of data acquisition is to keep the number of power
acquisition is to keep the number of power cycles as low as possible.
cycles as low as possible.
In this paper three possible data
3. Forensic Investigation Process acquisition approaches are presented for
obtaining a full copy of flash memory data.
Mobile investigation is the process to
analyses the mobile phone to detect and A. Flasher tools.
collect the evidences related to the crime.
The investigation steps are - B. JTAG Test Access Port.

(i) Identification: Identifying the system or C. Chip-OFF Technique.

the exhibitions that need to be investigated.
A. Flasher tools
(ii) Data acquisition/ Preservation: Taking a
forensic Image or Cloning the data from the The most easy and non-invasive way to
exhibition that belongs to an identified read flash data is by using a simple
system. hardware interface and software that
(iii) Data recovery: Restoring or pulling out copies all flash memory data from the
deleted, hidden or actual data from the target system to another system for further
image file. analysis. Unfortunately there’s no general
method for this procedure because every
(iv) Forensic analysis: Analyses the digital
embedded system can have its own
artefacts inside the data that has been
dedicated interface to data stored in flash
recovered.
memory chips. There’s also no
(v) Presentation of Evidences: Reporting of standardised “embedded system operating
evidence found during the analysis face. system” with documented low level flash
memory access functions. These tools
mainly originate from two sources:
potential TAPs and manually trace or
manufacturers or service centers who use
probe to pinpoint appropriate connector
these tools for debugging and diagnostics
pins.
and sometimes for in field software
updates, and hackers who use. Step 2 – solder wire leads to the correct
connector pins or utilise a solder-less jig.
B. JTAG Test Access Port:
Step 3 – connect wire leads to an
JTAG (Joint Test Action Group) is a
appropriate JTAG emulator with support
common hardware interface that provides
for the exhibit device.
your computer with a way to communicate
directly with the chips to access raw data Step 4 – read the flash memory after
on a board. When a forensically sound selecting the appropriate device profile or
extraction options cannot acquire a m a n u a l l y c o n fi g u r i n g t h e c o r r e c t
physical image or when a device is processor/memory settings.
logically damaged or “bricked”. A JTAG
test access port is normally used to test or Step 5 – analyse the extracted data using
debug embedded systems but can also be industry standard forensic tools and
used to access flash memory. The majority custom utilities.
of our JTAG engagements involve
Android phones which are pattern locked
and cannot be bypassed by other means.
We also regularly JTAG prepaid cell
phone models (such as RIM, Net10 and
Virgin) which have their data ports
intentionally disabled by the
carrier.Generally JTAG acquisition is an
extremely effective technique that Binary
Figure 1: Mobile phone ISP Pinout for JTAG
Intelligence utilises to extract a full
physical image (with unallocated space)
from devices that cannot be acquired with
normal tools.

Basic steps of a JTAG forensic

examination

Step 1 – identify TAPs by researching

documented devices. When TAPs are
Figure 2: JTAG Pin Connected to UFI Box
unknown, inspect the device PCB for
 C. Chip-OFF Technique

"Chip-off" is a technique based on Figure 3: UFI Toolkit

physically remove a flash memory chip
from a PCB of mobile and read this flash
memory chip with a memory chip
programmer or reader. This is the most
difficult way of data extraction from
mobile phone, video gaming systems,
tablets and network devices. This method
can be used when JTAG is not available
and software tools are failed. This Advantages / disadvantages of Chip-OFF
Technique:
recovery method works on newer devices
that store data on eMMC or eMCP flash
⁃ It can be guaranteed that no data is
memory chips and recovered through the
written in flash memory because the
device’s test points in order to bypass
security and perform memory acquisitions embedded system stays powered
and analysis of this evidence. This down.
methods starts with de-solder chips from a ⁃ Data from broken or damaged
PCB for that need an IR station or more device can be recovered.
inexpensive Hot Air Gun station with Pre ⁃ A complete forensic image can be
Heating Station. A chip usually has to be produced (all data, inclusive spare
prepared for further processing (cleaning area, bad blocks etc).
and restoring connections) after removing. ⁃ A disadvantage is that there is a risk
It’s difficult to name the model, because of damaging the flash memory chip
lots of them have the same features. due to the heat for de-soldering.
Data extraction equipment Chips in mobile ⁃ Requires a high skill level,
devices (eMMC) have interface similar to disassembling the device and de-
SD cards (but eMMC has 8 bit data bus, solder flash memory chips.
SD card – maximum 4 bit). All eMMC can ⁃ Cannot overcome encryption. As if
work on 1 bit bus. But if we use this encryption is enabled you will
feature for data extraction, it will take too extract a raw encrypted image.
much time. So we need same equipment as ⁃ Slow acquisition speed.
for SD cards and also adapters for chips.
 small objects (much smaller than one flash
Above those technique used in mobile
block) with a high update frequency, a lot
forensic taking a forensic Image or
of old versions might exist outside of the
Cloning (all data, inclusive spare area, bad
normal high level file system. For FAT file
blocks etc) the data flash memory chip.
systems the FAT and directory entries are
interesting candidates for advanced
analysis because of their size, update
frequency and evidence value. A common
forensic tool will show the last version of
the directory, possibly with some files
marked as deleted but from the other
versions of the directory data a lot of the
user behaviour can be reconstructed.

Figure 4: UFI Box Interface for data Dump The National Institute of Justice (2004)
guidelines recommend timeframe analysis,
5. File System Analysis & Evidence
hidden data analysis, application analysis
Searching:
and file analysis of the extracted data.
Results of the analysis phase may indicate
This step is more of a technical review the need for additional steps in the
conducted by the investigative team on the extraction and analysis processes. It must
basis of the results of the examination of be determined whether the chain of
the evidence. Data acquisition as described evidence and timeline of the events are
in the previous results in one or more consistent. Using a combination of tools
binary files containing linear bitwise for analysis will yield better results. The
copies of flash memory data. Identifying results of analysis should be completely
relationships between fragments of data, and accurately documented.
analyzing hidden data, determining the
6. File System Analysis Tools:
significance of the information obtained
from the examination phase, Early phones did not have the capacity to
reconstructing the event data, based on the store large amounts of information so law
extracted data and arriving at proper enforcement officers did not need to access
conclusions etc. are some of the activities mobile phone handsets to get information
to be performed at this stage. on a suspect. The focus was more on
phone records from the
Flash file systems for example often
telecommunications companies.
contain different versions of the same data
Nowadays, mobile phone have large
objects because flash memory can’t be
storage capacity and a wide array of
erased in small quantities. Especially for
application and connectivity options
besides connectivity with the The future of forensic tools might be able
telecommunications provider. Mobile to improve the power and efficiency of
phone forensic tools and toolkits are still embedded file systems (e.g. Android,
immature in dealing with these advances Windows mobile, IOS etc) examinations
in mobile phone technology. Mobile for reasonably skilled IT professionals.
forensic toolkits are developed by third That may be very helpful to detect crimes
party companies and the toolkits are not and to collect evidences.
independently verified or tested for
Abbreviations
forensic soundness. The developers of the
toolkits admit to using both, manufacturer
FAT - File Allocation Table.
supplied and self developed commands
PCB - Printed Circuit Board.
and access methods to gain data access to
PDA - Personal Data Assistant.
memory on mobile devices.
LBA - Logical Block Address.
Some Mobile forensic tools are - Encase, LBN - Logical Block Number.
FTK AccessData, R-Studio, and TSK, LSN - Logical Sector Number.
BitPim, Manifest Explorer, Oxygen USB - Universal Serial Bus.
Forensic, MOBILedit. I/O - Input/Output
WiFi – Wireless Fidelity
7. Conclusion & Future Scope: FFS - Flash File System.
FSD - File System Driver.
No doubt, mobile forensics or digital OS - Operating System.
forensic investigation for mobile devices is CFI - Common Flash Interface.
the fastest growing and evolving digital FTL - Flash Translation Layer.
forensic discipline. The digital forensic JTAG - Joint Test Action Group.
process for any devices is consisted of SCSI - Small Computer System Interface.
different steps, starts with the API - Application Programming Interface.
identification, data acquisition, data RAPI - Remote Application Programming
recovery, forensic analysis and Interface.
presentation of evidences. While the TSK - The Sleuth Kit.
specific details of the examination of each TSOP - Thin Small-Outline Package.
device may differ, the adoption of IMSI – International Mobile Subscriber
Identity
consistent examination processes will
IMEI – International Mobile Equipment
assist the examiner in ensuring that the Identity
evidence extracted from each phone is SDK – Software Development Kit
well documented and that the results are SHA1 – Secure Hash Algorithm, version 1
repeatable and defensible in court.
REFERENCES:

[1] Garfinkel, Digital Forensics Research: The Next 10Years, Digital Investigation, 7 (2010), S64-S73.
[2] AccessData. (n.d.). Mobile Phone Examiner. Retrieved May 15, 2010, from AccessData: http://www.accessdata.com/
mobilephoneexaminer.html
[3] R. Ayers, W. Jansen, L. Moenner, and A. Delaitre, CellPhone Forensic Tools: An Overview and Analysisupdate,
NISTIR 7387, 2007.
[4] Oxygen Forensic . (n.d.). Oxygen Forensic Suite 2010. Retrieved May 15, 2010, from Oxygen Forensic: http://
www.oxygen-forensic.com
[5] Android Inc. (n.d.). What is Android|Android Developers. Retrieved May 23, 2010, from Android Developers: http://
developer.android.com/guide/basics/what-is- android.html
[6] Rick Ayers, Wayne Jansen, Nicolas Cilleros, and Ronan Daniellou. (October 2007). retrieved from Cell Phone
Forensic Tools: An Overview and Analysis. National Institute of Standards and Technology http://csrc.nist.gov/
publications/nistir/nistir-7100-PDAForensics.pdf
[7] Paraben Corporation. (n.d.). Device Seizure. Retrieved May 29, 2010, from Paraben Corporation http:/www.paraben-
forensics.com/device-seizure.htm
[8] Lim, N., & Khoo, A. (2009, June). Forensics of Computers and Handheld Devices: Identical or Fraternal Twins?
Communications of the ACM , pp. 132-135.
[9] Apple Inc. (n.d.). iPhone Technologies Overview. Retrieved May 22, 2010, from iPhone Reference Library: http://
developer.apple.com/iphone/library/documentation/Mi scellaneous/Conceptual/iPhoneOSTechOverview/iPhoneOS
Technologies/iPhoneOSTechnologies.html#//apple_ref/doc/u id/TP40007898-CH3-SW1
[10] Symbian Foundation. (n.d.). Symbian Software Model. Retrieved May 23, 2010, from Symbian Developer
Community: http://developer.symbian.org/wiki/index.php/Symbian_Syste m_Model
[11] Guidance Software. (n.d.). EnCase Neutrino. Retrieved May 28, 2010, from Guidance Software:
[12] Klaver, C. (2010). Windows Mobile Advanced Forensics. Digital Investigation, Volume 6, Issues 3-4, Pages
147-167, May 2010,
[13] Mislan, R. (2008). Mobile Device Analysis. Small Scale Digital Device Forensics Journal .
[14] Schiffman, J. (2010). Blackberry OS Report 2. Retrieved May 24, 2010, from http://www.cse.psu.edu/~enck/
cse597a- s09/slides/appmodel_blackberry.pdf
[15] Wayne Janson and Aurélien Delaitre, Mobile Forensic Reference Materials: A Methodology and Reification,
National Institute of Standards and Technology, http://csrc.nist.gov/publications/nistir/ir7617/nistir-7617.pdf
[16] Casey, E., Bann, M., & Doyle, J. (n.d.). Introduction to Windows Mobile Forensics. Digital Investigation Volume 6,
Issues 3-4, Pages 136-146, May 2010

View publication stats