-
ceo.bfi@gmail.com
Send Email
-
2C, C-6/A Block, Janakpuri, Delhi India 110058
Visit Our Office
99902-92279
Confidentiality Guaranteed
99902-92279
Confidentiality Guaranteed
14
Jun
Jun
Mobile Forensic Investigation
MOBILE-FORENSICS
Mobile-forensics investigation processes
SEIZURE
Mobile devices are generally seized in order to preserve the digital evidence and to keep the device in the same condition so as to avoid shutdown or turning off of the device by the investigating officer or digital forensic expert. Faraday bags or cases are used to keep the mobile device as these bags prevent any further cellular connection or any communication with the device. The mobile device is kept in airplane mode to prevent further alteration or activities. The investigation officer would risk user lock activation.
Mobile-forensics is the branch of digital forensics or forensic science dealing with data acquisition from mobile phones or similar electronic devices like tablets, personal digital Assistant (PDA) or handheld PC and GPS devices for investigation purposes. In today’s time, most people possess mobile devices for communication by using calls, messages, MMS services. Multiple application based apps and tools are available in all android and IOS mobile devices to communicate and exchange information’s in the forms of text messages, audio files, video files, GPS locations, photos etc. The crimes using mobile technology are also increasing day by day as criminals find mobile devices as the most convenient way to commutate, exchange their plans as well as to execute digital frauds. It has become a necessity for the digital forensic experts as well as investigating officers dealing with digital fraud or digital crimes to get all the digital information’s like call history, location history, deleted files and folders, deleted chats, deleted messages, MMS, photos, videos, app data, contact lists etc. from the seized mobile devices which may lead to key role in investigation by analyzing the digital information’s. Various mobile-forensics tools like UFED, Oxygen Forensic, XRY are used for the data extraction, data analysis, and report preparation.
MOBILE DATA ACQUISITION
Data acquisition is the process of gathering information from mobile devices and their associated media. This process reduces the chance of data loss due to damage or battery depletion during storage and transportation. Mobile device identification is necessary at the beginning of the forensic examination.
The data can be gathered from mobile devices in two different ways:
a)Physical Acquisition: – The physical acquisition is also known a physical memory dump. It is a technique for capturing all data from flash memory chips on the mobile device. It allows forensic tools to collect all remnants of deleted data like deleted call history, contacts, media files, GPS locations, passwords etc. Initially, the received data is in raw format and it cannot be read. Later on, some methods are applied to convert the unread data into a readable form.
b) Logical Acquisition: – Logical acquisition is bit by bit copying of data of the directories as well as files preset on file system partition. It is also known a Logical Extraction. It is a technique for extracting the files and folders without any of the deleted data from a mobile. However, some particular data such as pictures, call history, text messages, calendar, and videos. A software tool is used to make a copy of the files.
What type of digital evidences can be extracted from the Mobile Devices?
1.Call Detail Record (CDRs)
• Call started and ended time/data
• Terminating and Originating towers
• Whether the call was outgoing or incoming
• Call time duration
• Who was called and who made the call
However, the collection of this information depends on the policies of the concerned states.
2.Global Positioning System (GPS): – It is an excellent source of empirical evidence. If the suspect as an active mobile device at the crime scene, GPS can pinpoint or locate his/her location as well as his/her criminal act. GPS also locates the movement of the suspect from a crime scene to the hideout. Furthermore, It helps in finding phone call logs, images and SMS.
3.App Data: – Many apps seek permission during the installation process to access the data. Example – a photo or video editing apps request permission to media files, camera, and GPS for navigation. Database and cache memory of applications like WhatsApp, Facebook, Instagram, Twitter, Google maps, calendar etc. can be extracted.
4.SMS: – The text messages or MMS leave an electronic record of dialogues that can be presented in a court.
5.Photos and Videos (Gallery):– All the photos and videos including the deleted files can be extracted using tools.
6.Contacts: – all the contact list can be extracted using forensic tools.
MOBILE-FORENSIC TOOL AND TECHNIQUES
Following cables or connectors are used to connect the mobile device to work station:-
1.JTAG or Cable Connection used in physical extraction
2.Bluetooth or Cable Connection are used in logical extraction
Forensic Tools Classification System:- Forensic specialists or forensic analysts must understand the several types of forensic tools. The classification offers a framework for forensic analysts to compare the acquisition techniques used by different forensic tools to capture data.
a)Manual Extraction: – It allows extracting and viewing data through the device touch screen or keypad. At a later stage, this data is documented photographically. Furthermore, it is time-consuming and involves a great probability of human error.
Tools: –
• Project A phone
• EDEC Eclipse
b)Logical and Physical Extraction: – The investigators connect the cellular device to a forensic work station or hardware via Bluetooth, RJ – 45 cable or USB cable. The computer using a logical and physical extraction tool sends a series of commands to the mobile device. As a result, the required data is collected from the phone’s memory and sent back to the forensic work station for analysis purposes.
List of Forensic Tools: –
c)Hex Dump: It extracts the raw image in binary format from the mobile devices. The forensic specialists connect the device to the forensic workstation and push the boot – ladder into the device to dump its memory to the computer. This supplies more information and the recovery of deleted phone’s files and unallocated space.
Tools: –
• XACT
d)Chip – off: This technique allows the examiner to extract data directly from the flash memory to a cellular device. They remove the phone’s memory chip and create its binary image. This process is costly and requires ample knowledge of hardware. Inappropriate dealing with may make a physical harm the chip and renders the information to recover.
Tools: –
• iSeasamo phone opening tool
• FEITA digital inspection station
• Chip epoxy glue remover
e)Micro Read: This involves interpreting and viewing data on memory chips. The investigators use a high power electron microscope to analyze the physical gates on the chip and then convert the gate level into 1’s and 0’s to discover resulting ASCII code. There is no tool available for micro read.
Our organization deals with cases related to mobile-forensics like data extraction from mobile devices, memory cards and cloud data for the personal purpose or legal purposes pertaining to judiciary or police etc. our forensic organization also provides training in the field of mobile forensics using digital forensic UFED tool. Our Mobile-forensics expert appears in the courts as an expert witness for forensic report demonstration by testimony and cross-examination. The mobile-forensics services are available all across the states of India especially in the metropolitan cities like Delhi NCR, Mumbai, Kolkata, Bangalore etc.