Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.
Smart	  Phones	  and	  the	  Internet	  ::Societal	  Shi3s	  and	  the	  Age	  of	  the	  App	                            ...
Topics	  •  How	  and	  why	  smartphones	  are	  changing	  the	     game	  for	  online	  evidence	  •  What	  evidence	...
Societal	  ShiAs	  •  Research	  by	  Ericsson	  ConsumerLab	  suggests	     that	  people	  are	  finding	  it	  increasin...
Societal	  ShiAs	  •  To	  date	  35	  percent	  of	  US	  Android/iPhone	     users	  interact	  with	  non-­‐voice	  app...
Societal	  ShiAs	  •  AAer	  gePng	  out	  of	  bed	  23%	  of	  smartphone	     users	  access	  the	  internet	  via	  t...
Societal	  ShiAs	               16 Knight St., Norwalk, CT 06851 : (203) 855-5387             mike.harrington@teeltech.com...
Societal	  ShiAs	               16 Knight St., Norwalk, CT 06851 : (203) 855-5387             mike.harrington@teeltech.com...
Societal	  ShiAs	               16 Knight St., Norwalk, CT 06851 : (203) 855-5387             mike.harrington@teeltech.com...
Societal	  ShiAs	  •  Smartphones	  are	  becoming	  hubs	  through	     which	  people	  manage	  their	  social	  lives	...
Societal	  ShiAs	               16 Knight St., Norwalk, CT 06851 : (203) 855-5387             mike.harrington@teeltech.com...
Societal	  ShiAs	  •  Ericsson’s	  research	  suggests	  “Consumers	  expect,	     and	  increasingly	  depend	  on,	  the...
Societal	  ShiAs	  •  The	  overwhelming	  purpose	  for	  use	  of	  the	     smartphone	  is	  personal	  –	  80-­‐90%	 ...
Market	  •  Smart	  phone	  market	  expected	  to	  grow	  over	     55%	  in	  2011	      –  472	  million	  expected	  ...
Market	         16 Knight St., Norwalk, CT 06851 : (203) 855-5387       mike.harrington@teeltech.com : www.TeelTech.com
Android	  Market	  Share	                   16 Knight St., Norwalk, CT 06851 : (203) 855-5387                 mike.harring...
Considera<ons	  •  Working	  with	  other	  inves<gators	  •  How	  far	  to	  go?	                                      1...
Evidence	          16 Knight St., Norwalk, CT 06851 : (203) 855-5387        mike.harrington@teeltech.com : www.TeelTech.com
Third	  Party	  Applica<ons	  •  Over	  300k	  apps	  for	  sale	  in	  App	  Store	  •  There	  are	  many	  unauthorized...
Twi`er	  •  Two	  directories	     –  Documents	     –  Library	  •  Documents	     –  Com.atebits.twee<e.applica<on-­‐sta...
Twi`er	  •  Documents	  (cont’d)	     –  Com.atebits.twee<e.compose.a`achments	        •  Hashed	  numbers	  as	  file	  na...
Twi`er	         16 Knight St., Norwalk, CT 06851 : (203) 855-5387       mike.harrington@teeltech.com : www.TeelTech.com
Twi`er	            Username/Date	  Stamp	         16 Knight St., Norwalk, CT 06851 : (203) 855-5387       mike.harrington@...
Twi`er	         16 Knight St., Norwalk, CT 06851 : (203) 855-5387       mike.harrington@teeltech.com : www.TeelTech.com
Facebook	  •  In	  iOS	  most	  informa<on	  stored	  on	  server	  •  Important	  files	  -­‐	  /Library/Applica<ons/Faceb...
Facebook	          16 Knight St., Norwalk, CT 06851 : (203) 855-5387        mike.harrington@teeltech.com : www.TeelTech.com
Facebook	          16 Knight St., Norwalk, CT 06851 : (203) 855-5387        mike.harrington@teeltech.com : www.TeelTech.com
Skype	  •  Allows	  for	  VOIP	  calls	  on	  iOS	  devices	  connected	     by	  Wi-­‐Fi	      –  /Library/Skype/Applica<...
Skype	         16 Knight St., Norwalk, CT 06851 : (203) 855-5387       mike.harrington@teeltech.com : www.TeelTech.com
iOS	  GPS	  Ar<facts	  -­‐	  Maps	  •  Maps	  App	     –  P	  to	  P	  direc<ons	     –  Locate	  Points	  of	  Interest	 ...
iOS	  GPS	  Ar<facts	  -­‐	  Maps	                          16 Knight St., Norwalk, CT 06851 : (203) 855-5387             ...
iOS	  GPS	  Ar<facts	  -­‐	  Maps	  •  Bookmarks.plist	     –  Not	  easily	  viewable	  in	  plist	  editor	          •  ...
iOS	  GPS	  Ar<facts	  -­‐	  Maps	                          16 Knight St., Norwalk, CT 06851 : (203) 855-5387             ...
iOS	  GPS	  Ar<facts	  -­‐	  Maps	                          16 Knight St., Norwalk, CT 06851 : (203) 855-5387             ...
iOS	  GPS	  Ar<facts	  -­‐	  Maps	                          16 Knight St., Norwalk, CT 06851 : (203) 855-5387             ...
iOS	  GPS	  Ar<facts	  -­‐	  Maps	  •  Direc<ons.plist	     –  User	  requested	  point	  to	  point	  direc<ons	         ...
iOS	  GPS	  Ar<facts	  -­‐	  Maps	                     h8p://www.opinionatedgeek.com/                   dotnet/tools/base6...
Geotags	          16 Knight St., Norwalk, CT 06851 : (203) 855-5387        mike.harrington@teeltech.com : www.TeelTech.com
Geotags	  -­‐	  iOS	                   16 Knight St., Norwalk, CT 06851 : (203) 855-5387                 mike.harrington@t...
Geotags	  -­‐	  iOS	  •  Videos	  in	  iOS	  store	  Geo	  Data	  at	  the	  end	  of	  the	     file	                     ...
Geotags	  -­‐	  iOS	  •  Quick<me	  can	  be	  used	  to	  format	  Geo	  data	  in	     videos	  for	  quick	  viewing	  ...
Cellular	  Data	  •  =<	  iOS	  4.0	       –  Located	  in	  /Library/caches/loca<ond	            •  Cells.plist	         ...
Cellular	  Data	               16 Knight St., Norwalk, CT 06851 : (203) 855-5387             mike.harrington@teeltech.com ...
Cellular	  Data	               16 Knight St., Norwalk, CT 06851 : (203) 855-5387             mike.harrington@teeltech.com ...
Upcoming	  Training	       Advanced	  Smartphone	  Forensics	  •    Smartphone	  Forensics	       Mississauga,	  Ontario	 ...
QuesOons?	          16 Knight St., Norwalk, CT 06851 : (203) 855-5387        mike.harrington@teeltech.com : www.TeelTech.com
Upcoming SlideShare
Loading in …5
×

Smart Phones & the Internet

1,400 views

Published on

In this webinar presentation, Mike Harrington of Teel Technologies talked about the relationship between smartphone-based evidence and Internet-based evidence, and why investigators need to collect each.

Published in: Technology, Health & Medicine
  • Be the first to comment

Smart Phones & the Internet

  1. 1. Smart  Phones  and  the  Internet  ::Societal  Shi3s  and  the  Age  of  the  App   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  2. 2. Topics  •  How  and  why  smartphones  are  changing  the   game  for  online  evidence  •  What  evidence  can  be  found  on  smartphones   and  how  does  it  work  with  “tradi<onal”  online   evidence  gathering  •  Sugges<ons  for  how  far  to  go  with  smart-­‐   phone  evidence  and  how  to  work  in   conjunc<on  with  devices  and  online  evidence   gathering   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  3. 3. Societal  ShiAs  •  Research  by  Ericsson  ConsumerLab  suggests   that  people  are  finding  it  increasingly  difficult   to  live  without  a  connec<on  to  the  cloud  •  Prior  to  smartphones  people  used  the  internet   in  chunks  –  now  they  “jacked  in”  constantly  •  Consumers  are  forming  habits  integra<ng   internet  use  into  everyday  life  through  apps-­‐ cloud  dependency!   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  4. 4. Societal  ShiAs  •  To  date  35  percent  of  US  Android/iPhone   users  interact  with  non-­‐voice  applica<ons  on   their  smartphones  before  gePng  out  of  bed     –  The  most  common  ac<vity  checking  Facebook  –   18  percent  of  social  networking  users  log  in  while   their  heads  are  s<ll  on  the  pillow   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  5. 5. Societal  ShiAs  •  AAer  gePng  out  of  bed  23%  of  smartphone   users  access  the  internet  via  their  browsers,   24%  check  their  email  and  22%  check   Facebook  •  29%  use  Google  Maps  or  other  nav  tools  on   morning  commute  and  28%  listen  to  music   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  6. 6. Societal  ShiAs   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  7. 7. Societal  ShiAs   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  8. 8. Societal  ShiAs   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  9. 9. Societal  ShiAs  •  Smartphones  are  becoming  hubs  through   which  people  manage  their  social  lives  •   Ericsson  ConsumerLab  reports  smartphone   users  are  spending  considerable  <me  using     “everyday”  apps  -­‐integra<ng  internet  use  into   a  more  basic  level  of  everyday  life     16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  10. 10. Societal  ShiAs   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  11. 11. Societal  ShiAs  •  Ericsson’s  research  suggests  “Consumers  expect,   and  increasingly  depend  on,  the  ability  to  access   online  services  easily  at  low  cost  and  complexity   from  mul<ple  loca<ons  during  the  day.”  •  Among  Americans  using  portable  storage  devices   –  54  percent  were  interested  in  synchronizing  the   portable  storage  from  anywhere     –  51  percent  want  direct  exchange  between  portable   devices  and  online  secure  storage   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  12. 12. Societal  ShiAs  •  The  overwhelming  purpose  for  use  of  the   smartphone  is  personal  –  80-­‐90%  of   respondents  •  Consumers  connect  to  apps  on  an  emo<onal   level   –  Feeling  of  be`er  control  of  life   –  Feeling  of  belonging   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  13. 13. Market  •  Smart  phone  market  expected  to  grow  over   55%  in  2011   –  472  million  expected  shipped  in  2011   –  982  by  the  end  of  2015  •  Growth  is  four  <mes  faster  than  that  of   tradi<onal  mobile  phones  •  Emerging  markets  key  –  Asia/Pacific,  La<n   America   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  14. 14. Market   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  15. 15. Android  Market  Share   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  16. 16. Considera<ons  •  Working  with  other  inves<gators  •  How  far  to  go?   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  17. 17. Evidence   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  18. 18. Third  Party  Applica<ons  •  Over  300k  apps  for  sale  in  App  Store  •  There  are  many  unauthorized  applica<ons   from  jailbroken  phones  •  Can  contain  important  informa<on  •  Store  their  informa<on  using   –  Plists   –  Sqlite  databases   –  Text  files   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  19. 19. Twi`er  •  Two  directories   –  Documents   –  Library  •  Documents   –  Com.atebits.twee<e.applica<on-­‐state   •  Account  informa<on  and  followers   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  20. 20. Twi`er  •  Documents  (cont’d)   –  Com.atebits.twee<e.compose.a`achments   •  Hashed  numbers  as  file  names  -­‐  actual  a`achments   sent  with  tweets   –  Com.atebits.twee<e.streams   •  One  or  more  property  lists     –  tweet  handles  (user  names)  and  tweets   »  date  and  <me  values  in  absolute  <me   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  21. 21. Twi`er   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  22. 22. Twi`er   Username/Date  Stamp   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  23. 23. Twi`er   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  24. 24. Facebook  •  In  iOS  most  informa<on  stored  on  server  •  Important  files  -­‐  /Library/Applica<ons/Facebook   –  Friends.db   –  Com.facebook.Facebook.plist   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  25. 25. Facebook   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  26. 26. Facebook   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  27. 27. Skype  •  Allows  for  VOIP  calls  on  iOS  devices  connected   by  Wi-­‐Fi   –  /Library/Skype/Applica<on  Support/$user/     –  Phone  Logs   –  Chat  logs   –  Account  details   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  28. 28. Skype   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  29. 29. iOS  GPS  Ar<facts  -­‐  Maps  •  Maps  App   –  P  to  P  direc<ons   –  Locate  Points  of  Interest  (POI)   •  More  info   •  Direc<ons   –  Loca<on:  /Library/Maps   •  History.plist   •  Direc<ons.plist   •  Bookmark.plist   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  30. 30. iOS  GPS  Ar<facts  -­‐  Maps   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  31. 31. iOS  GPS  Ar<facts  -­‐  Maps  •  Bookmarks.plist   –  Not  easily  viewable  in  plist  editor   •  Data  is  base  64  encoded   –  Contains  loca<on   •  Cell  ID   –  This  is  Google’s  cell  ID  (cell  tower)  loca<on  database   •  Details   –  telephone  number   –  URL   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  32. 32. iOS  GPS  Ar<facts  -­‐  Maps   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  33. 33. iOS  GPS  Ar<facts  -­‐  Maps   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  34. 34. iOS  GPS  Ar<facts  -­‐  Maps   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  35. 35. iOS  GPS  Ar<facts  -­‐  Maps  •  Direc<ons.plist   –  User  requested  point  to  point  direc<ons   •  Start  and  stop  end  points   •  Turn  by  turn  direc<ons   –  Viewed  in  the  plist  editor  the  data  is  base  64   encoded   –  Can  be  decoded  in  a  hex  or  text  editor   •  Online  base  64  decoders     16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  36. 36. iOS  GPS  Ar<facts  -­‐  Maps   h8p://www.opinionatedgeek.com/ dotnet/tools/base64decode/   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  37. 37. Geotags   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  38. 38. Geotags  -­‐  iOS   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  39. 39. Geotags  -­‐  iOS  •  Videos  in  iOS  store  Geo  Data  at  the  end  of  the   file   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  40. 40. Geotags  -­‐  iOS  •  Quick<me  can  be  used  to  format  Geo  data  in   videos  for  quick  viewing   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  41. 41. Cellular  Data  •  =<  iOS  4.0   –  Located  in  /Library/caches/loca<ond   •  Cells.plist   •  Clients-­‐b.plist   •  H-­‐cells.plist   •  H-­‐wifi.plist  •  =>4.0   •  Located  in  /Library/caches/loca<ond   –  Clients.plist   –  Consolidated.db   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  42. 42. Cellular  Data   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  43. 43. Cellular  Data   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  44. 44. Upcoming  Training   Advanced  Smartphone  Forensics  •  Smartphone  Forensics   Mississauga,  Ontario    September  19th  -­‐  23rd       Device  Repair  and  Chip-­‐off  Forensics  •  Repair  +  Chip-­‐Off  Forensics   Wild  PCS  Training  Facility     Las  Vegas    Sept.  26th  -­‐  30th       Advanced  BlackBerry  Forensics  Training    •  BlackBerry  Forensics     Manchester,  England    October  3rd  -­‐  7th       Advanced  Mobile  Forensics  /     Flasher  Box  Forensics  •  Advanced  +  Flasher  Box  Forensics   SAIC  -­‐  McLean,  Virginia    October  11th  -­‐  13th       Device  Repair  and  Chip-­‐off  Forensics  •  Repair  +  Chip-­‐Off  Forensics   Wild  PCS  Training  Facility     Las  Vegas    Nov.  7th  -­‐  11th     16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com
  45. 45. QuesOons?   16 Knight St., Norwalk, CT 06851 : (203) 855-5387 mike.harrington@teeltech.com : www.TeelTech.com

×