Mobile forensics tools hammer out evidence

Companies that offer technologies for mobile forensics – the art of extracting digital evidence from smartphones – face a raft of challenges developing tools in today’s breakneck mobile device market.

For one thing, short release cycles are the norm for mobile devices, meaning forensics firms must constantly update their tools to provide legal examiners solutions for current devices.

Keeping up with the latest models is no mean feat, and forensic manufacturers’ support for newer phones “may lag significantly behind the introduction of a device in the marketplace,” said the National Institute of Standards and Technology, in guidelines it released in May on mobile device forensics.

Maintaining the tool set requires a forensics company to manage more than 10,000 phone profiles. “That is a lot of work,” said Cellebrite CEO Jim Grady, and is a barrier to entry that has kept the market for forensics tools relatively small.

Even so, Cellebrite claims a 50 percent share of the market for its Universal Forensic Extraction Device (UFED) tool, which – as its name implies – is used to help police extract data from a device. Part of the company’s success in keeping up with the rapid evolution of mobile devices is its relationship with phone vendors, who often provide the company new models prior to their release.

Cellebrite began in 1999 by supporting the military’s need to extract data from cell phones in the field for field intelligence and situational awareness. The extraction tool was commercialized about five years later to support phone retailers who needed a way to quickly transfer data from a customer’s old phone to a new one.

Later, the company pushed into law enforcement forensics when it discovered that police were using its tool to collect evidence from phones. But it had drawbacks for forensics work. First, there were no safeguards against damaging or changing data being extracted or against making changes to the target device, and there were no provisions for examining the data. Cellebrite’s established its forensics division in 2007, and UFED was developed to handle these requirements.

New forensics feature sets

To be useful as evidence, investigators not only have to be able to transfer data, they must be able to reconstruct file systems for analysis and recover data that has been deleted or erased.

Recovering deleted data from the memory of a device may require even more sophisticated software tools, including disassembly of the device. But the range of support for conventional and specialized tools varies widely, according to the NIST guidance.

Still, extracting the data from a device is only the first step in the forensics process. Someone has to make sense of it beyond looking at an address book and call logs.

Autopsy, an open source platform developed by Basis Technology, is a tool that is intended to support complete analysis in the lab and incorporates many modules for specific tasks. It began as a project to provide a common user interface for the limited, often clunky command-line tools being used by labs, most of them supporting Linux and Mac operating systems rather than Windows.

But most law enforcement agencies use Windows-based systems, according to Brian Carrier, vice president of digital forensics at Basis. About five years ago his company decided to expand Autopsy to support Windows as well as add capabilities. “The idea was to write plug-in modules instead of standalone tools,” Carrier said.

Built with funding from the Army, Autopsy 3 was introduced about two years ago and is available as a free download from Basis.

Addressing needs of law enforcement

Once a mobile device has been imaged, the bits are fed into the software engine and reconstructed to produce data and, eventually, information and evidence. The type of evidence recovered depends on what modules are being used. Last year Basis approached DHS with an offer to develop new modules to meet specific law enforcement needs. One of the first new modules being developed will produce a timeline analysis of what a device – and its user – has been doing.

“Timelines are really hard to do well,” Carrier said. There are tools that can construct activity timelines, but they incorporate a limited number of data sources and are hard to use. The new module will use more types of data and is intended to be user friendly.

The second module to be developed under the DHS contact is for image analysis. The challenge with images coming off modern devices is the sheer number of them. “You can go through them, but it’s tedious,” Carrier said. And if time is of the essence, as in the search for a possible victim, it can take too long.

Even when the search process is automated, “there is still a human in the loop” making decisions about an image, but searching and classification can go much more quickly.

A database of hashes for known images can be used to quickly search for or eliminate some pictures, speeding up the process. One new feature of the module is that it provides results to the user as they are found during the search, rather than waiting until the end of the search, which can speed up detection when minutes might count.

Cracking encryption

The growing use of encryption and biometrics to protect access to mobile devices raises barriers for forensics examiners. Getting past these protections depends on the type of phone and how it is being protected.

John Carney, chief technology officer of Carney Forensics, rates the Nokia Lumia 920 Windows phones with full device encryption as one of the most secure on the market. Fortunately for him, it only accounts for about 3 percent of the smartphone market. Apple iPhones with iOS4 or higher also incorporate better encryption. “We have to work harder to get deeper,” he said.

Breaking PINs, passwords and passcodes depends on the phone and the strength of the code. A simple four-digit PIN could be broken by brute force, running through all 9,999 possible code combinations. “But the operating system has to allow that many attempts,” Carney said.

In some instances, vendors and manufacturers can help investigators getting into a phone – if the paperwork is in order. With a search warrant or subpoena, Apple, for example, “can extract certain categories of active data from passcode-locked iOS devices,” the company says in its legal process guidelines.

But it cannot provide a passcode. Accessible data includes only unencrypted, active user-generated files contained in Apple’s native apps on devices running iOS 4 or higher. Recoverable files include SMS messages, audio, photos, videos, contacts and call history. Apple can’t get at email, calendar entries or data from third-party apps.

Likewise, encryption is a significant hurdle in the investigative process. According to NIST, encrypted phones such as Android and iOS devices, should be “triage processed at the scene if they are found in an unlocked state,” as the data might not be available if the battery runs out or its screen locks.

“Deploying the use of field forensics tools to either acquire the device, or establish a trusted relationship with the device, will ensure that the data can be accessed at a later time, after the device has locked,” the agency said.

 “Failure to preserve evidence in its original state,” NIST said, “can jeopardize an entire investigation, potentially losing valuable case-related information."