Do you know how that cell phone in your hand actually works? If not, how do you know your mobile forensic tool will get the data you expect? How about that iPhone or Android — do you know what’s really involved with a physical acquisition on these devices?
Cellebrite will be offering multiple mobile forensic labs, both on its own and in conjunction with training partner Sumuri Forensics, on these topics and more. We talked with instructors Keith Daniels, Ronen Engler, and Steve Whalen about what they’ll be offering in September:
Best Practices in Mobile Forensics
One of the most misunderstood aspects of mobile forensics, according to Cellebrite director of training Keith Daniels, is the need for investigators to understand the device from which they’re trying to retrieve data.
“Get the device’s manual from the FCC,” says Daniels. “Log on to an investigative community like [conference Bronze sponsor] Teel Technologies’ Mobile Forensics Central. That’s where investigators talk about phone features and limitations, the hoops you have to jump through to get the phone to communicate with the forensic device.”
Doing so can mean all the difference between getting the correct data in the correct way, and having to take the time to snap photos of each of the phone’s screens. But that’s not all that’s at stake. Daniels points to the Laci Peterson homicide, in which mobile device evidence was crucial.
“Scott Peterson is on Death Row. Fifteen years from now in a new trial, will the original investigators remember case details, or even be available to testify? But if they have the manual, they’ll be able to testify as to what phones could do in 2003, what his particular device was capable of, and why that evidence was relevant to the case.”
Other practices besides knowing the phone:
- Taking the phone off the network — and understanding the dangers of not doing so.
- Create the right folder structure. “Some investigators use more than one forensic tool, so the right folder structure will segment the evidence according to the tool that retrieved it,” says Daniels.
- Thinking outside the box. “The phone can be physical evidence as well as containing digital evidence,” says Daniels, referring to a homicide in which gunshot residue was found on a cell phone.
“Remember,” Daniels adds, “the defense will attack not the evidence itself, but the way it was obtained. Doing your due diligence will elevate your credibility and your position in court.”
Basic and advanced UFED work
Authorized Cellebrite trainer Steve Whalen, Managing Director and co-founder of Sumuri Forensics, will show how the UFED tool puts these best practices to work in his two introductory labs, one each on the UFED and the Physical Pro. “We’ll do a brief overview of each tool and its important features, with examples so that the students can learn hands-on how it all works,” he says.
But the training won’t only be about what buttons to push. Instead, it provides the background of why investigators push those buttons, the way the unit functions and how it applies to forensic methodology.
“So-called ‘push-button’ forensics is not a problem as long as the examiner understands the device’s basic functionality and what it’s doing to perform the extraction,” Whalen says. “It’s not about how hard or easy the tool is to use; tools can be validated. It’s about following the basic forensic principles that everyone should follow.”
In fact, Whalen says, the UFED’s simplicity is a benefit toward this goal. “The basic UFED Logical lab will show how the UFED extracts information from within the device’s filesystem, such as the call logs, and interprets the directory structure.
“The Cellebrite Physical Pro lab will show how the device extracts both the logical filesystem, and the physical data — the bit-for-bit copy including unallocated space on the chip. We’ll also cover the variety of search functions in Physical Analyzer, including regular expressions, predefined search patterns like 7-bit SMS strings, and GREP,” Whalen says.
“Physical Pro simplifies the process of making a physical image of a mobile device, which significantly increases the amount of evidence that can be located,” Whalen adds. “Because Cellebrite takes the time to ensure its tools’ processes are as un-intrusive as possible, more users can acquire physical data without having to resort to non-forensic hacker tools like flasher boxes, which can ruin evidence if used the wrong way.”
What does all this add up to? Time saved, says Whalen, explaining that the UFED is a standalone unit and doesn’t rely on a good or bad installation of forensic software, or whether that software communicates properly with the device. “Debugging a comm port can take time and increases the chance of hair loss as the examiner troubleshoots the device and/or the computer,” he says. “The UFED saves that time.”
A deep dive into iPhone and Android physical extractions
The final block of Cellebrite instruction will be a “deep dive” into physical forensic exams, as students work with iPhones and iPads that have been locked without having to jailbreak the device. Cellebrite engineering product manager Ronen Engler and Daniels will demonstrate the Physical Pro’s password bypass, along with its data parsing capabilities and a newer feature – decoding for encrypted iPhones, including the iPhone 4.
Decoding will also be demonstrated for BlackBerry. “We showed this in June at the Mobile Forensics Conference,” says Engler, “and we will show it again in Indian Wells.” The decoding process is for physical data recovered during the chip-off process.
Finally, students will be able to see dumps of Android devices using four different methods, two of which, says Engler, are unique to Cellebrite. “We’ll also show how to bypass the pattern lock on an Android without modifying the device,” he adds. (These details are covered more in a recent blog post by mobile forensic tool reviewer Christopher Vance.)
And he and Daniels will discuss the ability to dump Chinese knockoff devices. “The UFED supports logical extractions from more than 150 Chinese clones,” says Engler. These include iPhone, Nokia, Motorola, Samsung and LG knockoffs.
Just getting into mobile device examinations, or want to take your exams further into physical extractions? Register for our conference and be eligible to sign up for these labs!