1 of 153

The Evolving World of Digital Forensics

Josiah Roloff, EnCE, CCE, CCLO, CCPA, CCME

Roloff Digital Forensics, LLC

2 of 153

Obligatory�Background

Began career in digital forensics: 2003

Investigated > 1700 cases

Consulted in > 400 trials

Testified as an expert > 90 times

    • Spokane Community Colleges: A.A.S. Network Engineering
    • Whitworth University: B.L.S. Liberal Studies, Program Management
    • Oregon State University: Certificate in Computer Forensics
    • New Technologies Institute (NTI): Certificate in Computer Forensics
    • EnCase Certified Examiner (EnCE)
    • International Society of Forensic Computer Examiners: Certified Computer Examiner (CCE)
    • Cellebrite Certified Logical Operator (CCLO)
    • Cellebrite Certified Physical Analyst (CCPA)
    • Cellebrite Certified Mobile Examiner (CCME)

Education/Certifications

3 of 153

Digital Evidence: The Cat and Mouse Game

4 of 153

5 of 153

6 of 153

A little time goes by…

7 of 153

8 of 153

9 of 153

Our Goals

THE EVOLUTION OF DIGITAL EVIDENCE

GENERAL DIGITAL FORENSIC CONCEPTS

THE CAT AND MOUSE GAME SURROUNDING THE IDENTIFICATION, COLLECTION, AND ANALYSIS OF DATA IN TODAY’S DIGITAL LANDSCAPE

10 of 153

11 of 153

The age-old question: What is digital forensics?

12 of 153

13 of 153

Close…but not exactly what we see on TV…

14 of 153

Identification

Collection/Preservation

Analysis

1

2

3

Presentation

4

Digital Forensics is the Art and Science of:

15 of 153

How do YOU use your digital devices?

16 of 153

What our digital devices lives (can) say about us…

Everything we have ever looked at, searched for, written about.

.

17 of 153

What our digital devices lives say about us…

Everything we have ever looked at, searched for, written about.

Every interest we have had, regardless of how fleeting it may (or may not) have been.

.

18 of 153

What our digital devices lives say about us…

Everything we have ever looked at, searched for, written about.

Every interest we have had, regardless of how fleeting it may have been.

Every communication we have had, or those who have used our devices have had on our behalf or otherwise.

19 of 153

What our digital devices lives say about us…

Everything we have ever looked at, searched for, written about.

Every interest we have had, regardless of how fleeting it may have been.

Every communication we have had, or those who have used our devices have had on our behalf or otherwise.

Every bit of financial information we have looked at, notated, and filed.

.

20 of 153

What our digital devices lives say about us…

Everything we have ever looked at, searched for, written about.

Every interest we have had, regardless of how fleeting it may have been.

Every communication we have had, or those who have used our devices have had on our behalf or otherwise.

Every bit of financial information we have looked at, notated, and filed.

Every journal entry we have created, blog posted to, and feedback provided.

.

21 of 153

What our digital devices lives say about us…

Everything we have ever looked at, searched for, written about.

Every interest we have had, regardless of how fleeting it may have been.

Every communication we have had, or those who have used our devices have had on our behalf or otherwise.

Every bit of financial information we have looked at, notated, and filed.

Every journal entry we have created, blog posted to, and feedback provided.

Every password and set of credentials used to access the most innocuous and sensitive areas of our life….…

.

22 of 153

What our digital devices lives say about us…

Where we travel.

23 of 153

What our digital devices lives say about us…

When we travel.

24 of 153

What our digital devices lives say about us…

How much we exercise.

25 of 153

What our digital devices lives say about us…

How much we exercise…or don’t.

26 of 153

27 of 153

Our #1 Criminal Case Type?

28 of 153

Homicide

29 of 153

But it isn’t just criminal litigation…

30 of 153

31 of 153

Why aren’t all digital forensic examinations equal?

32 of 153

Just like there are different lawyers...

33 of 153

Each person brings their own “special” skills to the equation.

34 of 153

Step 1: Identification

35 of 153

36 of 153

The original

Motorola DynaTAC released in 1984

37 of 153

Feature Phones

Flip phones became popular in the late 90s and this factor lasted until the early 2010s.

38 of 153

Question: When was the first text message sent?

39 of 153

40 of 153

41 of 153

42 of 153

43 of 153

44 of 153

45 of 153

46 of 153

47 of 153

48 of 153

49 of 153

50 of 153

Step 2: Collection/Preservation

51 of 153

The process depends on the source(s) of evidence…

52 of 153

Can we gain access it?

53 of 153

54 of 153

Luckily, we are dealing with humans!

55 of 153

Case Example

ALLEGED WORKPLACE HARASSMENT

- KIK (SNAP, WHATSAPP, ETC.)

- NATIVE TEXT

- PICTURES

WHERE IS THE EVIDENCE?

56 of 153

�Kik Content�

Where is the evidence?

- Kik content = Phones (both parties), Kik, Cloud Storage Providers

57 of 153

Phone Content

58 of 153

Service Provider “Kik” Content

59 of 153

60 of 153

61 of 153

Possible Cloud Content?

62 of 153

�Case Example�

Where is the evidence?

- Kik content = Phones (both parties), Kik, Cloud Storage Providers

- “Normal” SMS = Phones (both parties), Service Providers, Cloud Storage Providers

63 of 153

Why Service Providers?

64 of 153

Because their metadata allows for comparisons…

65 of 153

�Case Example�

Where is the evidence?

- Kik content = Phones (both parties), Kik, Cloud Storage Providers

- “Normal” SMS = Phones (both parties), Service Providers, Cloud Storage Providers

- Pictures/Multimedia = Phones (both parties), Kik, Cloud Storage Providers

66 of 153

�Case Example�

Where is the evidence?

- Kik content = Phones (both parties), Kik, Cloud Storage Providers

- “Normal” SMS = Phones (both parties), Service Providers, Cloud Storage Providers

- Pictures/Multimedia = Phones (both parties), Kik, Cloud Storage Providers

What if location data is of interest?

67 of 153

68 of 153

69 of 153

70 of 153

71 of 153

72 of 153

�Case Example�

Where is the evidence?

- Kik content = Phones (both parties), Kik, Cloud Storage Providers

- “Normal” SMS = Phones (both parties), Service Providers, Cloud Storage Providers

- Pictures/Multimedia = Phones (both parties), Kik, Cloud Storage Providers

Time is always of the essence.

73 of 153

Extractions of Digital Devices

74 of 153

What Happened to “Bit for bit” Forensic Extractions?

75 of 153

�Hard Drive Extractions�

- Forensic bit by bit copies

- Logical targeted copies

76 of 153

�Mobile Device Extractions�

- Manual

- Logical / Advanced Logical

- File System / Advanced Logical

    • Method 1
    • Method 2
    • Method 3
  • (Full) File System
    • Root, GrayKey, Elcomsoft, Cellebrite Premium/CAS
      • Before First Unlock (BFU), After First Unlock (AFU)

- Physical

77 of 153

LOGICAL

FILE SYSTEM

PHYSICAL

SMS

SMS

SMS

Contacts

Contacts

Contacts

Call Logs

Call Logs

Call logs

Media

Media

Media

Audio

Audio

Audio

Files

Files

Hidden Files

Hidden Files

Deleted Files

More Deleted Files

Mobile Device Extractions

78 of 153

Do I have access to ALL the relevant data?

You must understand your device(s) and the extraction type(s) available…

79 of 153

VISUAL EXAMPLE

Logical vs. Advanced Logical/FS vs. Full File System

80 of 153

“Logical”

81 of 153

“Advanced Logical”

82 of 153

“Full File System”

83 of 153

LOGICAL

ADV. LOGICAL

Full File System

Let’s Look More Closely…

84 of 153

What kind of data

exists on a mobile device?

It depends…

85 of 153

What about deleted data?

It depends…

86 of 153

“Non-Invasive” Extractions

Manual Search of Device

87 of 153

Non-Invasive Extractions

Manual Search of Device

88 of 153

Determine Extraction Type

Pay attention to “Logical”…

89 of 153

Other Indications

90 of 153

Please remember!

91 of 153

Quick Sidebar: What Story Does a Files Location Tell?

92 of 153

What About Inside the File?

93 of 153

You Can Go Further

94 of 153

You Need More?

95 of 153

But, what about the “Circle Of Confusion”?

96 of 153

Is it an original?

  • Internal Metadata: Created vs. Modified
  • File Name
  • File Location
  • File System Metadata: Created vs. Modified
  • Internal Structure Changes

And sometimes, tools just give themselves away…

97 of 153

98 of 153

�Why Can’t We Simply Trust the �

Chrome Browser Forensics

99 of 153

Invasive Extractions

JTAG

ISP

Chip-Off

100 of 153

�Case Examples�

The case of the mysterious barnacles

101 of 153

�But, what about other options?�

Jail-breaking

Super User

Root

102 of 153

�But, what about other options?�

Jail-breaking

Super User

Root

103 of 153

�How about we…

…”escalate our privileges”?

104 of 153

�Service Provider “Extractions”�

Subpoenas

Court orders

User credentials

105 of 153

106 of 153

Recognize this?

107 of 153

They produce this…

108 of 153

109 of 153

110 of 153

111 of 153

112 of 153

NELOS, PCMD, RTT, TrueCall, etc.

Verizon: RTT, EVDO, ALULTE, Levdort

Sprint: PCMD

T-Mobile/MetroPCS: TDOA, Timing Advanced Information, TrueCall

AT&T/Cricket: NELOS, LOCDBOR

113 of 153

Preservation Requests��AT&T/Cricket

114 of 153

Sprint

T-Mobile/MetroPCS

Verizon

115 of 153

Be Aware Of Challenges!

116 of 153

Quiz 1

Network Event Location System (NELOS) data should be requested from which Service Provider:

  1. T-Mobile/MetroPCS
  2. Verizon
  3. AT&T/Cricket
  4. Sprint

117 of 153

What about Geofencing?

118 of 153

119 of 153

So, it isn’t just the cellular service providers…?

120 of 153

121 of 153

122 of 153

123 of 153

Where is this information coming from?

124 of 153

A number of places

125 of 153

Embedded GPS Coordinates

126 of 153

127 of 153

“Location Services”

128 of 153

Please tell us more about location services

Google

  1. Cell Tower Data (least accurate)
  2. Wi-Fi Location Data (100 – 10 meters)
  3. GPS Location Data (up to 3 meters)

129 of 153

Google Data

130 of 153

Gmail Account

131 of 153

Date And Time

132 of 153

Location

133 of 153

Display Radius

134 of 153

The Maps Display Radius field reflects an estimated uncertainty value regarding the reported coordinate. Its value depends on a great many factors and is an approximation sufficient for its intended product uses.

135 of 153

Source of Data

136 of 153

Device

137 of 153

Data Retention

Google

Indefinitely – even if the user deletes their data and/or account.

If deleted, the data becomes “anonymized” (Google’s device ID is removed).

138 of 153

Additional Logged Data - Android Example

1. Movements and likeliness of them (e.g., walking, biking, driving, on mass transit)

2. Barometric pressure

3. Connected wireless networks and their MAC address

4. MAC address, signal strength, and frequency of nearby wireless access points

5. MAC address, identifier, type, and two measures of signal strength of every nearby Bluetooth beacon

6. Charge level of your phone battery and if the phone is currently charging

7. Voltage of your phone’s battery

8. GPS coordinates and elevation of your phone, and its anticipated accuracy

139 of 153

How this looks behind the scenes

140 of 153

141 of 153

Be Aware Of Challenges!

The “alibi”

142 of 153

Be Aware Of Challenges!

143 of 153

Be Aware Of Challenges!

144 of 153

Additional CSLI Data Points

145 of 153

But wait, there is more…

146 of 153

147 of 153

148 of 153

149 of 153

150 of 153

151 of 153

…and it is only going to get worse…

152 of 153

Summary

Digital media, social networks, cloud computing, cellular phone usage, and people’s reliance on such mediums is not going away.

Technology is only continuing to advance, and the legal arena is always going to be playing catch-up.

Understanding where the technology is and is headed, is an important first step for conducting the most thorough investigation possible.

153 of 153

Questions?

Contact Information

  • 509.230.4619 (mobile)
  • Josiah@roloffDF.com
  • http://www.RoloffDF.com
  • https://www.linkedin.com/in/josiahroloff/