Test Images and Forensic Challenges

A list of sample images and forensic challenges is now available at:

http://www.forensicfocus.com/images-and-challenges

Additions are encouraged and may either be sent through the feedback form or added to this forum topic. Thank you to those who helped compile the current list.

Evaluating Mobile Telephone Connection Behaviour - Part 1

by Sam Raincock

Examining Mobile Equipment – Ensuring Accuracy

In general, all modern mobile telephones contain call information and SMS message storage which may be used as evidence. There may also be a wealth of other evidence available including browser history, sat nav usage etc. However, for the purposes of this article I am interested in discussing the accuracy and evaluation of telephone connection behaviour and hence I shall concentrate only on these two important sources of evidence.

There are various types of examinations conducted on mobile telephones to extract the call information and SMS messages (collectively I shall refer to these as connection information). The examination of a SIM card is a fairly ‘trivial’ process with a well-defined extraction procedure. However, handset examinations may be much trickier. For standard handset examinations (those that generally only extract the information live on the handset) there is no one product that can extract all of the connection information available for all handsets. Hence, when examining handsets, it is important as a first step to ensure the accuracy of the evidence you are presenting.

When presenting your evidence it may be worthwhile considering the measures you implement to be able to ascertain both the accuracy and meaning of information you present to ascertain that:

1. The extracted information is accurate and correctly attributed. For example, that a reported SMS message has the correct content and is appropriately stated as a sent, draft or a received SMS message.

2. The information is complete and where it is not, the omissions are known (and clearly declared in the report) or manually obtained.

3. The information is unambiguously reported.

These may sound like obvious points, however, in my experience sometimes failures are found in all three areas which then lead to issues when the evidence is used to ascertain the connection behaviour of a telephone. As a mobile telephone examiner, it is important to establish appropriate procedures and to report the limitations of the data you are presenting otherwise at a later stage they may be open to misinterpretation. Omissions are particularly important since information such as duration of calls and times of calls may become crucial to resolving what occurred so it is important to make your reader aware what information may be present but remains unextracted...

Read more at http://www.forensicfocus.com/sam-raincock

(Computer Security) New Year Resolutions

by Simon Biles

About the Author Simon Biles is a founder of Thinking Security Ltd., an Information Security and Risk Management consultancy firm based near Oxford in the UK.

The annual process of creating resolutions that we can break within a matter of minutes is a tradition to many of us – no new year would be complete without the heartfelt conviction that you will [delete as applicable] go to the gym/drink and/or smoke less/organise your garage etc. and that this will clearly make your life better, more complete and you will be “a better person”. I, for one, will be drinking less, going to the gym more and organising my garage – I know I will, because I’ve said I will on the first day of the New Year …

Aside from that though, here are some Information/Computer Security resolutions that you might like to give some thought to adding to your list. Like all good resolutions, these have value, but they are much more effective if you actually keep them up!

(1) Good for your security, and good for the environment – if you aren’t using the computer or router, switch it off or put it to sleep. It’s pretty challenging to break into a computer that is switched off, your carbon emissions go down and more importantly, if you are a climate change sceptic like me, so does your electricity bill. Unless your computer is performing an active task why leave it on? Boot times from sleep are negligible on modern systems, and if you really can’t spare 30 seconds to boot your computer – I think you might need to re-evaluate your life …

(2) We’re all guilty of this one, and I know so many security professionals that say the same, we reuse passwords – we have one or two _good_ passwords (complex 8 to 10 characters etc.) that we use for everything, making the assumption that, because it is a strong password that protects us. The trouble is that all websites aren’t created equal, just because we trust Amazon doesn’t mean that we should trust bargainbooksonline.cz – yet we do. True, some of us are looking for the SSL certificates and the like, but to be honest – if they are then storing the password in plain text in a MySQL database that is accessible to the world and his dog then it makes no difference. As much as you can – don’t reuse passwords...

Read more at http://www.forensicfocus.com/simon-biles

Resurrecting Deadbeats

by Craig Ball

About the Author Craig Ball is a Texas lawyer who limits his practice to service as a court-appointed special master and consultant in computer forensics and electronic discovery.

An op-ed piece in the New York Times called Begging for Your Pay describes the humiliating ordeal of freelancers forced to hound clients to recover thousands of dollars of compensation. It brings to mind the occasional posts on computer forensics lists where our colleagues vent about unpaid invoices.

Sometimes, the unpaid forensic examiners wonder if they must throw good money after bad or whether they can refuse to appear at deposition or trial. Other times, the posts prompt discussion of recourse—lawyerly letters, withheld work product or lawsuits. More than anything, these list posters seek commiseration: reassurance that he or she is not the only knucklehead who let a deadbeat run up a big tab.

Sometimes, we are so anxious to get new business that we don’t protect ourselves against bad business. Bad business is worse than no business because bad business costs you money.

Any business that extends credit to its customers risks non-payment. We don’t think of computer forensics as a business that extends credit, but when you work without retainer or the retainer is used up, you’re financing your client’s investigation and must take steps to limit your credit risk.

In tough times, clients will impose on your goodwill to finance litigation. If you want to be their bank, be sure you’re adequately compensated and acting in compliance with credit regulations, then be prepared for default. A mechanic has a lien on the car being repaired, but you can’t sell client data to defray unpaid bills.

Here are some of the steps I take to insure prompt payment and guard against default...

Read more at http://www.forensicfocus.com/craig-ball

Pre-Emptive Digital Forensics Research

by Chris Hargreaves

About the Author Dr Chris Hargreaves is a lecturer at the Centre for Forensic Computing at Cranfield University in Shrivenham, UK.

In August 2010 it was announced that Google Wave would not be continuing as a stand-alone product, having been available to the general public for just 2-3 months. In that time period, it is unlikely that much research had begun into the digital artefacts left by Google Wave. However, if an investigation of a machine from that time-period required an examination of a suspect’s use of Google Wave, such research would need to be retrospectively carried out. This article discusses the advantages and disadvantages of pre-emptive and reactive digital forensics research.

Predicting the future is quite hard. This can be evidenced by the many quotes that are used as examples of failed predictions. Unfortunately the provenance of some of these quotes is questionable, but many are attributable:

“This ‘telephone’ has too many shortcomings to be seriously considered as a means of communication”, Western Union (1878)
“Heavier-than-air flying machines are impossible”, Lord Kelvin (1895)
“A rocket will never be able to leave the Earth’s atmosphere”, New York Times, (1936)
“I think there is a world market for about five computers", Thomas J. Watson (1943)
"Computers in the future may weigh no more than 1.5 tons", Popular Mechanics (1949)
“There is no reason anyone would want a computer in their home", Ken Olson (1977)
”640K ought to be enough for anybody”, Bill Gates (1981)

Despite the difficulty in predicting the success or failure of a particular technology, this is precisely what is required in order to conduct pre-emptive research in digital forensics. In this article, pre-emptive research refers to any research conducted that is not in response to a current investigation and is conducted in order to acquire some knowledge in advance of encountering a particular technology in a real investigation. Reactive research is the opposite, and is research that is conducted during an investigation in response to encountering some artefacts left by a suspect’s use of a particular technology...

Read more at http://www.forensicfocus.com/chris-hargreaves

Sample search warrants and affidavits

A number of sample search warrants and affidavits is now available at http://www.forensicfocus.com/search-warrants (many thanks to the Forensic Focus member who submitted them).

Please consider submitting similar sample documents for your own jurisdiction to act as examples for other investigators. Discussion of issues surrounding search warrants is encouraged and should be directed towards the forums.