Mobile Forensics

Perkembangan jumlah pengguna aplikasi Instant Messenger (IM) yang sangat pesat menyebabkan naiknya potensi tindakan kriminal dilakukan melalui aplikasi IM. Fitur keamanan data aplikasi IM yang ditujukan untuk melindungi privasi penggunanya, digunakan oleh pelaku kriminal untuk menyembunyikan bukti digital dari aktivitas kriminalnya. Penelitian ini membahas mengenai analisa dan perbandingan bukti digital dari aplikasi IM pada Android yang telah diunduh sebanyak 500 juta orang di Play Store, yaitu WhatsApp, Telegram, Line, dan IMO. Proses analisa dilakukan pada bukti digital dari penggunaan fitur yang ada di aplikasi IM, sehingga proses pengumpulan data dibantu dengan simulasi dari beberapa skenario yang berpotensi terjadi dalam tindakan kriminal. Teknik akuisisi data dilakukan dengan metode physical imaging untuk mendapatkan akses penuh pada memori smartphone. Hasil analisa disimpulkan dalam bentuk tabel perbandingan yang dapat dirujuk oleh investigator forensik ketika melakukan investigasi aplikasi IM yang diteliti. Hasil analisa menyatakan bahwa bukti digital dari aktivitas tukar menukar pesan, berkas media, dan kontak ditemukan. Hasil analisa juga memberikan penjelasan mengenai kemungkinan untuk menganbil bukti digital yang dihapus dan bagaimana cara memulihkannya dengan teknik data carving.

The proliferation of smartphones introduces new opportunities in digital forensics. One of the reasons is that smartphones are usually equipped with sensors (e.g. accelerometer, proximity sensor, etc.), hardware which can be used to infer the user's context. This context may be useful in a digital investigation, as it can aid in the rejection or acceptance of an alibi, or even reveal a suspect's actions or activities. Nonetheless, sensor data are volatile, thus are not available in post-mortem analysis. Thus, the only way to timely acquire them, in case such a need arises during a digital investigation, is by software that collects them when they are generated by the suspect's actions. In this paper we examine the feasibility of ad-hoc data acquisition from smartphone sensors by implementing a device agent for their collection in Android, as well as a protocol for their transfer. Then, we discuss our experience regarding the data collection of smartphone sensors, as well as legal and ethical issues that arise from their collection. Finally, we describe scenarios regarding the agent's preparation and use in a digital investigation.

The use of Information and Communication Technologies (ICT) in administrative and governmental bodies to improve the information and services offered to citizens, to guide the effectiveness and efficiency of public management, and to substantially increase the transparency of the public sector and Citizen participation is a determining indicator as well as the increasing use of mobile devices because of the ease and portability they offer, making it an important tool when transacting with electronic money. The high rate of use of these devices has generated a problem, vulnerability, which gives rise to cybercrime techniques. At present there is a lack of local and international agencies that regulate and control the use of mobile devices accompanied by a lack of knowledge regarding the vulnerabilities that the applications have. Taking into account this background arises the need to establish a fundamental objective and contribution in the present Research, which consists of performing a forensic analysis to mobile devices with Android Operating System, based on guidelines of the chain of custody, compliance stages and established phases and thus detect findings; nonconformities; Locate vulnerabilities and determine the main causes of the different types of events or crimes carried out from a mobile device in order to guarantee the principles of transparency, accessibility, preservation, legality and responsibility according to the Ibero-American Charter of Electronic Government [8]. In addition, an Integral Control Panel (CMI) evaluates indicators or metrics focused from the perspective of the Process and the Client, providing frequent monitoring on a board RGY-Semaphore System. Resumen El uso de las Tecnologías de Información y Comunicaciones(TIC) en los órganos administrativos y gubernamentales para mejorar la información y los servicios ofrecidos a los ciudadanos, orientar la eficacia y eficiencia de la gestión pública, e incrementar sustantivamente la transparencia del sector público y la participación de los ciudadanos es un indicador determinante así como el uso creciente de dispositivos móviles debido a la facilidad y portabilidad que éstos ofrecen, convirtiéndose así en una herramienta importante al momento de realizar transacciones con dinero electrónico. El alto índice de utilización de estos dispositivos ha generado un problema, la vulnerabilidad, lo cual da origen a técnicas de cibercrimen. En la actualidad existe carencia de organismos locales e internacionales que regulen y controlen el uso de dispositivos móviles acompañados de falta de conocimiento en cuanto a las vulnerabilidades que los aplicativos poseen. Tomando en cuenta estos antecedentes surge la necesidad de establecer un objetivo fundamental y el aporte en la presente investigación, la cual consiste en realizar un análisis forense a dispositivos móviles con Sistema Operativo Android, basándonos en lineamientos de la cadena de custodia, cumplimientos etapas y fases establecidas y así detectar hallazgos; no conformidades; localizar vulnerabilidades y determinar cuáles fueron las causas principales de los diferentes tipos de eventos o delitos realizados desde un dispositivo móvil, a fin de garantizar los principios de transparencia, accesibilidad, conservación, legalidad y responsabilidad según la Carta Iberoamericana de Gobierno Electrónico [8]. Además mediante un Cuadro de Mando Integral (CMI), se evalúa indicadores o métricas enfocadas desde la perspectiva del Proceso y del Cliente, brindando un seguimiento frecuente en un tablero RGY – Sistema de Semáforos.

In recent past, there are a lot of research advancements in mobile forensics tools. This is so due to increase usage of mobile phones in storage of information, law enforcement, mobile online transactions, and also negatively by criminals due to increased computational capabilities. Mobile forensics devices continue to remain a very challenging task due to poor user data retrieval techniques for evidence retrieval. Recently, third party applications assume a veritable feet because it is supported by majority of mobile devices platforms, thereby making it easy to extract information of its users' for future criminal audit. This paper proposes an evidence data retrieval method from InstagramApp using two networks based platforms (that is, pure peer-to-peer (PPP) and special cluster peer (SCP) based), whose concept is to manage mobile device communication and generate multiple copies of users data/information to be dumped across three servers. The forensic test results were obtained from PPP and SCP developed to securely extract data from mobile devices. This shows that, SCP outperformed PPP in terms of the time taken to fulfil forensic auditor's request, throughput and broadband utilisation which are 42.82% to 57.18%, 56.81% to 43.19% and 35.41% to 64.53% respectively.

Completing our field season at Olduvai, where our team deployed forensic cleanroom methods to excavate early hominin tools at Bed I and II. Pervasive contamination in field and laboratory settings for residue analysis, especially starch grain research, convinced our group of the need for this approach. Sincere thanks to our Tanzanian colleagues, students, and local people for making this huge endeavor possible.

There is a growing demand  for  cloud  storage  services such  as  Dropbox,  Box,  Syncplicity and SugarSync. These public cloud storage services can store gigabytes of corporate and personal  data in remote  data  centres  around  the  world,  which  can  then  be  synchronized  to  multiple  devices. This creates an environment which is potentially conducive to security incidents, data breaches and other malicious  activities. The forensic investigation  of  public  cloud environments  presents  a  number  of new challenges for the digital forensics community. However, it is anticipated that end-devices such as  smartphones, will  retain  data  from  these cloud storage  services. This  research investigates  how forensic  tools that are currently available to practitioners can be  used to provide  a practical solution for  the  problems  related  to  investigating  cloud  storage  environments. The  research  contribution  is  threefold. First,  the  findings  from  this  research  support  the  idea  that  end-devices  which  have  been used to access cloud storage services can be used to provide a partial view of the evidence stored in the  cloud  service. Second,  the research provides  a  comparison  of  the  number  of  files  which  can  be recovered from different versions of cloud storage applications. In doing so, it also supports the idea that amalgamating the files recovered from more than one device can result in the recovery of a more complete dataset. Third,  the chapter contributes  to  the  documentation  and  evidentiary  discussion  of the  artefacts  created  from  specific  cloud  storage applications  and  different  versions  of  these applications on iOS and Android smartphones.