Guidelines on Mobile Device Forensics

Figure 6: Mobile Device Tool Classification System

The following discussion provides a more detailed description of each level and the methods
used for data extraction.

 Manual Extraction – A manual extraction method involves viewing the data content
stored on a mobile device. The content displayed on the LCD screen requires the
manual manipulation of the buttons, keyboard or touchscreen to view the contents of
the mobile device. Information discovered may be recorded using an external digital
camera. At this level, it is impossible to recover deleted information. Some tools have
been developed to provide the forensic examiner with the ability to document and
categorize the information recorded more quickly. Nevertheless, if there is a large
amount of data to be captured, a manual extraction can be very time consuming and
the data on the device may be inadvertently modified, deleted or overwritten as a
result of the examination. Manual extractions become increasingly difficult and
perhaps unachievable when encountering a broken/missing LCD screen or a
damaged/missing keyboard interface. Additional challenges occur when the device is
configured to display a language unknown to the investigator; this may cause
difficulty in successful menu navigation.

 Logical Extraction – Connectivity between a mobile device and the forensics

workstation is achieved with a connection using either a wired (e.g., USB or RS-232)
or wireless (e.g., IrDA, WiFi, or Bluetooth) connection. The examiner should be
aware of the issues associated when selecting a specific connectivity method, as
different connection types and associated protocols may result in data being modified
(e.g., unread SMS) or different amounts or types of data being extracted. Logical
extraction tools begin by sending a series of commands over the established interface
from the computer to the mobile device. The mobile device responds based upon the
command request. The response (mobile device data) is sent back to the workstation
and presented to the forensics examiner for reporting purposes.

 Hex Dumping and JTAG – Hex Dumping and Joint Test Action Group (JTAG)
extraction methods afford the forensic examiner more direct access to the raw
17
 Guidelines on Mobile Device Forensics

information stored in flash memory. One challenge with these extraction methods is
the ability of a given tool to parse and decode the captured data. Providing the forensic
examiner with a logical view of the file system, and reporting on other data remnants
outside the file system that may be present are challenging. For example, all data
contained within a given flash memory chip may not be acquired, as many tools, such
as flasher boxes, may only be able to extract specific sections of memory [Bre07].
Methods used at this level require connectivity (e.g., cable or WiFi) between the
mobile device and the forensic workstation.

Hex Dumping – this technique is the more commonly used method by tools at this
level. This involves uploading a modified boot loader (or other software) into a
protected area of memory (e.g., RAM) on the device. This upload process is
accomplished by connecting the mobile device’s data port to a flasher box and the
flasher box is in turn connected to the forensic workstation. A series of commands is
sent from the flasher box to the mobile device to place it in a diagnostic mode. Once
in diagnostic mode, the flasher box captures all (or sections) of flash memory and
sends it to the forensic workstation over the same communications link used for the
upload. Some flasher boxes work this way or they may use a proprietary interface for
memory extractions. Rare cases exist where extractions can be accomplished using
WiFi (i.e., early Jonathan Zdziarski (JZ) Methods) [Zdz12].

JTAG – Many manufacturers support the JTAG standard, which defines a common
test interface for processor, memory, and other semiconductor chips. Forensic
examiners can communicate with a JTAG-compliant component by utilizing special
purpose standalone programmer devices to probe defined test points [Wil05]. The
JTAG testing unit can be used to request memory addresses from the JTAG-
compliant component and accept the response for storage and rendition [Bre06].
JTAG gives specialists another avenue for imaging devices that are locked or devices
that may have minor damage and cannot be properly interfaced otherwise. This
method involves attaching a cable (or wiring harness) from a workstation to the
mobile device’s JTAG interface and access memory via the device’s microprocessor
to produce an image [Bre07]. JTAG extractions differ mainly from Hex Dumping in
that it is invasive as access to the connections frequently require that the examiner
dismantle some (or most) of a mobile device to obtain access to establish the wiring
connections.

Flasher boxes are small devices originally designed with the intent to service or
upgrade mobile devices. Physical acquisitions frequently require the use of a flasher
box to facilitate the extraction of data from a mobile device. The flasher box aides the
examiner by communicating with the mobile device using diagnostic protocols to
communicate with the memory chip. This communication may utilize the mobile
device’s operating system or may bypass it altogether and communicate directly to the
chip [Jon10]. Flasher boxes are often accompanied by software to facilitate the data
extraction process working in conjunction with the hardware. Many flasher box
software packages provide the added functionality of recovering passwords from
mobile device memory as well in some configurations. Although acquisition methods
differ between flasher boxes, a general process is used [Bre07]. Limitations of the use
of flasher boxes include the following:

18
 Guidelines on Mobile Device Forensics

 Rebooting of the mobile device is frequently required to begin the extraction

process; this may cause authentication mechanisms to activate preventing further
analysis.

 Many flasher boxes recover the data in an encrypted format requiring the
examiner to either use the software provided by the flasher box manufacturer to
decrypt the data or may require reverse engineering the data’s encryption scheme
by the analyst.

 Many phone models do not provide the acquisition of the entire memory range
within a given mobile device. Only certain ranges may be available for certain
mobile devices

 The flasher box service software often has many buttons that are labeled with
nearly identical names. This confusion may easily lead even an experienced
examiner to press the wrong button, erasing the contents of the mobile device
instead of dumping the memory.

 Lack of documentation on the use of the flasher box tools is common. Extraction
methods are frequently shared on forums supported by the vendor and moderated
by more seasoned users. Caution should be taken when advice is provided, as not
all the information provided is correct.

 Forensic Use: Nearly all flasher boxes were not designed with a forensic use as its
intended purpose. Examiners must be experienced in the use of flasher boxes and
should understand the proper use and function of flasher boxes.

 Despite all of these limitations, use of a flasher box is a viable option for many
forensics cases. Proper training, experience and understating of how the tools
work are the keys to success.

A wide range of technical expertise and proper training is required for extracting and
analyzing binary images with these methods, including locating and connecting to
JTAG ports, creating customized boot loaders and recreating file systems.

 Chip-Off – Chip-Off methods refer to the acquisition of data directly from a mobile
device’s flash memory. This extraction requires the physical removal of flash
memory. Chip-Off provides examiners with the ability to create a binary image of the
removed chip. In order to provide the examiner with data in a contiguous binary
format file, the wear-leveling algorithm must be reverse engineered. Once complete,
the binary image may then be analyzed. This type of acquisition is most closely
related to physical imaging a hard disk drive as in traditional digital forensics.
Extensive training is required in order to successfully perform extractions at this level.
Chip-Off extractions are challenging based on a wide variety of chip types, a myriad
of raw data formats, and the risk of causing physical damage to the chip during the
extraction process. Due to the complexities related to Chip-Off, JTAG extraction is
more common.

 Micro Read – A Micro Read involves recording the physical observation of the gates
on a NAND or NOR chip with the use of an electron microscope. Due to the extreme
technicalities involved when performing a Micro Read, this level of acquisition would
19
 Guidelines on Mobile Device Forensics

only be attempted for high profile cases equivalent to a national security crisis after all
other acquisition techniques have been exhausted. Successful acquisition at this level
would require a team of experts, proper equipment, time and in-depth knowledge of
proprietary information. There are no known U.S. Law Enforcement agencies
performing acquisitions at this level. Currently, there are no commercially available
Micro Read tools.

Table 3 provides a classification of some tools currently used in mobile device investigations,
and identifies the facilities they provide: acquisition, examination, or reporting. Additional
tools do exist, but only those familiar to the authors are discussed. For a more complete an up
to date list of forensic tools refer to: NIST Tool Taxonomy
([Link] The tools listed in Table 3 are
grouped by level starting with Level 1 (Manual Extraction) through Level 4 (Chip-Off).

The following describes each of the headings contained within Table 3:

 Tool – tool name

 † Denotes a tool that supports the logical acquisition of a UICC

 ‡ Denotes a tool that supports the logical acquisition of a UICC and the creation
of a Cellular Network Isolation Card (CNIC)

 Acquisition Level – level(s) at which the tool performs data extractions: 1- Manual
extraction, 2 - Logical extraction, 3 - Physical extraction, 4 - Chip-off, 5 - Micro Read

 Network Type – acquisition of devices operating over specified networks

 Forensic Tool – is the tool specifically designed for forensic acquisition

 Examination/Analysis – provides the examiner with the ability to perform

examination or analysis of acquired data

 Reporting – provides the examiner with the ability to generate reports

 3rd Party Tool Image Analysis (3PIA) – supports importing of raw data produced
from another manufacturer’s tool

 Chinese Chipset Support (CCS) – mobile devices containing Chinese chipsets are
increasing as they continue to flood the international market. Some mobile forensic
tools provide either a logical and/or physical extraction solution.

 Cables/Hardware Available (C/HW) – cables are provided

20