Smart Phones & the Internet

  • 757 views
Uploaded on

In this webinar presentation, Mike Harrington of Teel Technologies talked about the relationship between smartphone-based evidence and Internet-based evidence, and why investigators need to collect …

In this webinar presentation, Mike Harrington of Teel Technologies talked about the relationship between smartphone-based evidence and Internet-based evidence, and why investigators need to collect each.

  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Be the first to comment
    Be the first to like this
No Downloads

Views

Total Views
757
On Slideshare
0
From Embeds
0
Number of Embeds
0

Actions

Shares
Downloads
33
Comments
0
Likes
0

Embeds 0

No embeds

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
    No notes for slide

Transcript

  • 1. Smart  Phones  and  the  Internet  ::Societal  Shi3s  and  the  Age  of  the  App   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 2. Topics  •  How  and  why  smartphones  are  changing  the   game  for  online  evidence  •  What  evidence  can  be  found  on  smartphones   and  how  does  it  work  with  “tradi<onal”  online   evidence  gathering  •  Sugges<ons  for  how  far  to  go  with  smart-­‐   phone  evidence  and  how  to  work  in   conjunc<on  with  devices  and  online  evidence   gathering   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 3. Societal  ShiAs  •  Research  by  Ericsson  ConsumerLab  suggests   that  people  are  finding  it  increasingly  difficult   to  live  without  a  connec<on  to  the  cloud  •  Prior  to  smartphones  people  used  the  internet   in  chunks  –  now  they  “jacked  in”  constantly  •  Consumers  are  forming  habits  integra<ng   internet  use  into  everyday  life  through  apps-­‐ cloud  dependency!   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 4. Societal  ShiAs  •  To  date  35  percent  of  US  Android/iPhone   users  interact  with  non-­‐voice  applica<ons  on   their  smartphones  before  gePng  out  of  bed     –  The  most  common  ac<vity  checking  Facebook  –   18  percent  of  social  networking  users  log  in  while   their  heads  are  s<ll  on  the  pillow   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 5. Societal  ShiAs  •  AAer  gePng  out  of  bed  23%  of  smartphone   users  access  the  internet  via  their  browsers,   24%  check  their  email  and  22%  check   Facebook  •  29%  use  Google  Maps  or  other  nav  tools  on   morning  commute  and  28%  listen  to  music   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 6. Societal  ShiAs   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 7. Societal  ShiAs   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 8. Societal  ShiAs   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 9. Societal  ShiAs  •  Smartphones  are  becoming  hubs  through   which  people  manage  their  social  lives  •   Ericsson  ConsumerLab  reports  smartphone   users  are  spending  considerable  <me  using     “everyday”  apps  -­‐integra<ng  internet  use  into   a  more  basic  level  of  everyday  life     16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 10. Societal  ShiAs   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 11. Societal  ShiAs  •  Ericsson’s  research  suggests  “Consumers  expect,   and  increasingly  depend  on,  the  ability  to  access   online  services  easily  at  low  cost  and  complexity   from  mul<ple  loca<ons  during  the  day.”  •  Among  Americans  using  portable  storage  devices   –  54  percent  were  interested  in  synchronizing  the   portable  storage  from  anywhere     –  51  percent  want  direct  exchange  between  portable   devices  and  online  secure  storage   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 12. Societal  ShiAs  •  The  overwhelming  purpose  for  use  of  the   smartphone  is  personal  –  80-­‐90%  of   respondents  •  Consumers  connect  to  apps  on  an  emo<onal   level   –  Feeling  of  be`er  control  of  life   –  Feeling  of  belonging   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 13. Market  •  Smart  phone  market  expected  to  grow  over   55%  in  2011   –  472  million  expected  shipped  in  2011   –  982  by  the  end  of  2015  •  Growth  is  four  <mes  faster  than  that  of   tradi<onal  mobile  phones  •  Emerging  markets  key  –  Asia/Pacific,  La<n   America   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 14. Market   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 15. Android  Market  Share   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 16. Considera<ons  •  Working  with  other  inves<gators  •  How  far  to  go?   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 17. Evidence   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 18. Third  Party  Applica<ons  •  Over  300k  apps  for  sale  in  App  Store  •  There  are  many  unauthorized  applica<ons   from  jailbroken  phones  •  Can  contain  important  informa<on  •  Store  their  informa<on  using   –  Plists   –  Sqlite  databases   –  Text  files   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 19. Twi`er  •  Two  directories   –  Documents   –  Library  •  Documents   –  Com.atebits.twee<e.applica<on-­‐state   •  Account  informa<on  and  followers   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 20. Twi`er  •  Documents  (cont’d)   –  Com.atebits.twee<e.compose.a`achments   •  Hashed  numbers  as  file  names  -­‐  actual  a`achments   sent  with  tweets   –  Com.atebits.twee<e.streams   •  One  or  more  property  lists     –  tweet  handles  (user  names)  and  tweets   »  date  and  <me  values  in  absolute  <me   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 21. Twi`er   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 22. Twi`er   Username/Date  Stamp   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 23. Twi`er   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 24. Facebook  •  In  iOS  most  informa<on  stored  on  server  •  Important  files  -­‐  /Library/Applica<ons/Facebook   –  Friends.db   –  Com.facebook.Facebook.plist   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 25. Facebook   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 26. Facebook   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 27. Skype  •  Allows  for  VOIP  calls  on  iOS  devices  connected   by  Wi-­‐Fi   –  /Library/Skype/Applica<on  Support/$user/     –  Phone  Logs   –  Chat  logs   –  Account  details   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 28. Skype   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 29. iOS  GPS  Ar<facts  -­‐  Maps  •  Maps  App   –  P  to  P  direc<ons   –  Locate  Points  of  Interest  (POI)   •  More  info   •  Direc<ons   –  Loca<on:  /Library/Maps   •  History.plist   •  Direc<ons.plist   •  Bookmark.plist   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 30. iOS  GPS  Ar<facts  -­‐  Maps   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 31. iOS  GPS  Ar<facts  -­‐  Maps  •  Bookmarks.plist   –  Not  easily  viewable  in  plist  editor   •  Data  is  base  64  encoded   –  Contains  loca<on   •  Cell  ID   –  This  is  Google’s  cell  ID  (cell  tower)  loca<on  database   •  Details   –  telephone  number   –  URL   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 32. iOS  GPS  Ar<facts  -­‐  Maps   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 33. iOS  GPS  Ar<facts  -­‐  Maps   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 34. iOS  GPS  Ar<facts  -­‐  Maps   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 35. iOS  GPS  Ar<facts  -­‐  Maps  •  Direc<ons.plist   –  User  requested  point  to  point  direc<ons   •  Start  and  stop  end  points   •  Turn  by  turn  direc<ons   –  Viewed  in  the  plist  editor  the  data  is  base  64   encoded   –  Can  be  decoded  in  a  hex  or  text  editor   •  Online  base  64  decoders     16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 36. iOS  GPS  Ar<facts  -­‐  Maps   h8p://www.opinionatedgeek.com/ dotnet/tools/base64decode/   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 37. Geotags   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 38. Geotags  -­‐  iOS   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 39. Geotags  -­‐  iOS  •  Videos  in  iOS  store  Geo  Data  at  the  end  of  the   file   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 40. Geotags  -­‐  iOS  •  Quick<me  can  be  used  to  format  Geo  data  in   videos  for  quick  viewing   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 41. Cellular  Data  •  =<  iOS  4.0   –  Located  in  /Library/caches/loca<ond   •  Cells.plist   •  Clients-­‐b.plist   •  H-­‐cells.plist   •  H-­‐wifi.plist  •  =>4.0   •  Located  in  /Library/caches/loca<ond   –  Clients.plist   –  Consolidated.db   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 42. Cellular  Data   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 43. Cellular  Data   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 44. Upcoming  Training   Advanced  Smartphone  Forensics  •  Smartphone  Forensics   Mississauga,  Ontario    September  19th  -­‐  23rd       Device  Repair  and  Chip-­‐off  Forensics  •  Repair  +  Chip-­‐Off  Forensics   Wild  PCS  Training  Facility     Las  Vegas    Sept.  26th  -­‐  30th       Advanced  BlackBerry  Forensics  Training    •  BlackBerry  Forensics     Manchester,  England    October  3rd  -­‐  7th       Advanced  Mobile  Forensics  /     Flasher  Box  Forensics  •  Advanced  +  Flasher  Box  Forensics   SAIC  -­‐  McLean,  Virginia    October  11th  -­‐  13th       Device  Repair  and  Chip-­‐off  Forensics  •  Repair  +  Chip-­‐Off  Forensics   Wild  PCS  Training  Facility     Las  Vegas    Nov.  7th  -­‐  11th     16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  • 45. QuesOons?   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com