Smart Phones & the Internet
Upcoming SlideShare
Loading in...5
×
 

Smart Phones & the Internet

on

  • 959 views

In this webinar presentation, Mike Harrington of Teel Technologies talked about the relationship between smartphone-based evidence and Internet-based evidence, and why investigators need to collect ...

In this webinar presentation, Mike Harrington of Teel Technologies talked about the relationship between smartphone-based evidence and Internet-based evidence, and why investigators need to collect each.

Statistics

Views

Total Views
959
Views on SlideShare
953
Embed Views
6

Actions

Likes
0
Downloads
33
Comments
0

1 Embed 6

http://paper.li 6

Accessibility

Upload Details

Uploaded via as Adobe PDF

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

Smart Phones & the Internet Smart Phones & the Internet Presentation Transcript

  • Smart  Phones  and  the  Internet  ::Societal  Shi3s  and  the  Age  of  the  App   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Topics  •  How  and  why  smartphones  are  changing  the   game  for  online  evidence  •  What  evidence  can  be  found  on  smartphones   and  how  does  it  work  with  “tradi<onal”  online   evidence  gathering  •  Sugges<ons  for  how  far  to  go  with  smart-­‐   phone  evidence  and  how  to  work  in   conjunc<on  with  devices  and  online  evidence   gathering   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Societal  ShiAs  •  Research  by  Ericsson  ConsumerLab  suggests   that  people  are  finding  it  increasingly  difficult   to  live  without  a  connec<on  to  the  cloud  •  Prior  to  smartphones  people  used  the  internet   in  chunks  –  now  they  “jacked  in”  constantly  •  Consumers  are  forming  habits  integra<ng   internet  use  into  everyday  life  through  apps-­‐ cloud  dependency!   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Societal  ShiAs  •  To  date  35  percent  of  US  Android/iPhone   users  interact  with  non-­‐voice  applica<ons  on   their  smartphones  before  gePng  out  of  bed     –  The  most  common  ac<vity  checking  Facebook  –   18  percent  of  social  networking  users  log  in  while   their  heads  are  s<ll  on  the  pillow   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Societal  ShiAs  •  AAer  gePng  out  of  bed  23%  of  smartphone   users  access  the  internet  via  their  browsers,   24%  check  their  email  and  22%  check   Facebook  •  29%  use  Google  Maps  or  other  nav  tools  on   morning  commute  and  28%  listen  to  music   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Societal  ShiAs   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Societal  ShiAs   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Societal  ShiAs   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Societal  ShiAs  •  Smartphones  are  becoming  hubs  through   which  people  manage  their  social  lives  •   Ericsson  ConsumerLab  reports  smartphone   users  are  spending  considerable  <me  using     “everyday”  apps  -­‐integra<ng  internet  use  into   a  more  basic  level  of  everyday  life     16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Societal  ShiAs   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Societal  ShiAs  •  Ericsson’s  research  suggests  “Consumers  expect,   and  increasingly  depend  on,  the  ability  to  access   online  services  easily  at  low  cost  and  complexity   from  mul<ple  loca<ons  during  the  day.”  •  Among  Americans  using  portable  storage  devices   –  54  percent  were  interested  in  synchronizing  the   portable  storage  from  anywhere     –  51  percent  want  direct  exchange  between  portable   devices  and  online  secure  storage   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Societal  ShiAs  •  The  overwhelming  purpose  for  use  of  the   smartphone  is  personal  –  80-­‐90%  of   respondents  •  Consumers  connect  to  apps  on  an  emo<onal   level   –  Feeling  of  be`er  control  of  life   –  Feeling  of  belonging   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Market  •  Smart  phone  market  expected  to  grow  over   55%  in  2011   –  472  million  expected  shipped  in  2011   –  982  by  the  end  of  2015  •  Growth  is  four  <mes  faster  than  that  of   tradi<onal  mobile  phones  •  Emerging  markets  key  –  Asia/Pacific,  La<n   America   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Market   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Android  Market  Share   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Considera<ons  •  Working  with  other  inves<gators  •  How  far  to  go?   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Evidence   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Third  Party  Applica<ons  •  Over  300k  apps  for  sale  in  App  Store  •  There  are  many  unauthorized  applica<ons   from  jailbroken  phones  •  Can  contain  important  informa<on  •  Store  their  informa<on  using   –  Plists   –  Sqlite  databases   –  Text  files   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Twi`er  •  Two  directories   –  Documents   –  Library  •  Documents   –  Com.atebits.twee<e.applica<on-­‐state   •  Account  informa<on  and  followers   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Twi`er  •  Documents  (cont’d)   –  Com.atebits.twee<e.compose.a`achments   •  Hashed  numbers  as  file  names  -­‐  actual  a`achments   sent  with  tweets   –  Com.atebits.twee<e.streams   •  One  or  more  property  lists     –  tweet  handles  (user  names)  and  tweets   »  date  and  <me  values  in  absolute  <me   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Twi`er   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Twi`er   Username/Date  Stamp   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Twi`er   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Facebook  •  In  iOS  most  informa<on  stored  on  server  •  Important  files  -­‐  /Library/Applica<ons/Facebook   –  Friends.db   –  Com.facebook.Facebook.plist   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Facebook   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Facebook   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Skype  •  Allows  for  VOIP  calls  on  iOS  devices  connected   by  Wi-­‐Fi   –  /Library/Skype/Applica<on  Support/$user/     –  Phone  Logs   –  Chat  logs   –  Account  details   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Skype   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • iOS  GPS  Ar<facts  -­‐  Maps  •  Maps  App   –  P  to  P  direc<ons   –  Locate  Points  of  Interest  (POI)   •  More  info   •  Direc<ons   –  Loca<on:  /Library/Maps   •  History.plist   •  Direc<ons.plist   •  Bookmark.plist   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • iOS  GPS  Ar<facts  -­‐  Maps   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • iOS  GPS  Ar<facts  -­‐  Maps  •  Bookmarks.plist   –  Not  easily  viewable  in  plist  editor   •  Data  is  base  64  encoded   –  Contains  loca<on   •  Cell  ID   –  This  is  Google’s  cell  ID  (cell  tower)  loca<on  database   •  Details   –  telephone  number   –  URL   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • iOS  GPS  Ar<facts  -­‐  Maps   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • iOS  GPS  Ar<facts  -­‐  Maps   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • iOS  GPS  Ar<facts  -­‐  Maps   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • iOS  GPS  Ar<facts  -­‐  Maps  •  Direc<ons.plist   –  User  requested  point  to  point  direc<ons   •  Start  and  stop  end  points   •  Turn  by  turn  direc<ons   –  Viewed  in  the  plist  editor  the  data  is  base  64   encoded   –  Can  be  decoded  in  a  hex  or  text  editor   •  Online  base  64  decoders     16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • iOS  GPS  Ar<facts  -­‐  Maps   h8p://www.opinionatedgeek.com/ dotnet/tools/base64decode/   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Geotags   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Geotags  -­‐  iOS   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Geotags  -­‐  iOS  •  Videos  in  iOS  store  Geo  Data  at  the  end  of  the   file   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Geotags  -­‐  iOS  •  Quick<me  can  be  used  to  format  Geo  data  in   videos  for  quick  viewing   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Cellular  Data  •  =<  iOS  4.0   –  Located  in  /Library/caches/loca<ond   •  Cells.plist   •  Clients-­‐b.plist   •  H-­‐cells.plist   •  H-­‐wifi.plist  •  =>4.0   •  Located  in  /Library/caches/loca<ond   –  Clients.plist   –  Consolidated.db   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Cellular  Data   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Cellular  Data   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • Upcoming  Training   Advanced  Smartphone  Forensics  •  Smartphone  Forensics   Mississauga,  Ontario    September  19th  -­‐  23rd       Device  Repair  and  Chip-­‐off  Forensics  •  Repair  +  Chip-­‐Off  Forensics   Wild  PCS  Training  Facility     Las  Vegas    Sept.  26th  -­‐  30th       Advanced  BlackBerry  Forensics  Training    •  BlackBerry  Forensics     Manchester,  England    October  3rd  -­‐  7th       Advanced  Mobile  Forensics  /     Flasher  Box  Forensics  •  Advanced  +  Flasher  Box  Forensics   SAIC  -­‐  McLean,  Virginia    October  11th  -­‐  13th       Device  Repair  and  Chip-­‐off  Forensics  •  Repair  +  Chip-­‐Off  Forensics   Wild  PCS  Training  Facility     Las  Vegas    Nov.  7th  -­‐  11th     16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • QuesOons?   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com