Category Archives: Android

High-tech sleuthing a geek’s dream for recently retired Victoria detective

Quote

Posted on by
Reply

An article from (http://www.timescolonist.com/) about Bob Elder one of the most knowledgeable Mobile Phone Forensic Examiners there is.

vka retire 344501 jpg High tech sleuthing a geeks dream for recently retired Victoria detective

In Bob Elder’s expert hands, a cellphone is a gold mine of crime-fighting information.

 

Elder recently retired from his job as a detective-constable with the Victoria Police Department. His last seven years on the force were spent with the Computer Forensic Unit, honing his ability to pull data from electronic devices.

 

The 51-year-old has developed such a knack for what he does that his knowledge is sought around the world — the result of a reputation gained from a regular travel schedule to teach his techniques to other professionals. As a result, he is often asked to weigh in on cases from far afield.

 

“I just did work on a homicide in Delaware,” Elder said, explaining that the case involved a man who killed his wife but claimed to have found her dead in the house.

 

“Based on using one of these advanced techniques, we were able to determine that he had actually been Googling the event from the time he killed her to the time it was reported to police. In that hour, he was Googling it to see if it had been reported, so that put him at the scene.”

 

Elder’s work has also meant dealing with child-pornography cases, including an investigation of a Victoria juvenile that took on international proportions. The juvenile turned out to be trading child pornography with people around the world, and Elder and others were able to delve into the operation by extracting chat logs and contact lists from a hard drive.

 

That led to a string of arrests in other locations over the next three or four years and the rescue of a number of children. Elder said the success and scope of the outcome makes it stand out among his cases.

 

Elder’s police career includes eight years as a Saanich reserve officer and 131Ú2 years with VicPD — time that also included a stint with the Strike Force, an undercover surveillance squad focused on drug cases. He said he jumped at the chance to work in computer forensics.

 

“I was always a geek from way back, so when the job came up to become part of the unit, I applied for it and got it.”

 

Elder’s role in cellphone-related investigations usually involves getting into the guts of the device, taking it apart and looking for data. He said criminals may lock their phones, but that won’t stop police.

 

“That’s where my expertise kind of comes in,” Elder said. “I deal mainly with the advanced mobile forensics at what we call the physical level, so I’m dealing with the actual memory chips on the [circuit] board as opposed to the device itself.”

 

Much of Elder’s knowledge has come from work done on his own time, and the results are considered groundbreaking, said Victoria police spokesman Bowen Osoko.

 

“I just had a passion for it,” Elder said.

 

Life beyond police work will involve transferring his skills to the private sector with Teel Technologies, an American mobile-device forensics company expanding into Canada. Elder will head up the company’s Canadian operations.

 

His new job will change his travel itinerary, which was previously confined to North America.

 

“Starting in June and July, I start teaching in the U.K., Germany, Brunei and other countries. All of these countries now are looking for that technology to be able to get into these phones.”

 

Following wider trends, police have been looking at fewer and fewer computers, and considerably more mobile devices, Elder said. Victoria police examine about 300 cellphones a year, he said.

 

“The trend is within five to seven years, they expect people won’t have computer towers in their house. It’ll all be smartphones or tablets, that kind of thing.”

 

Information gleaned from cellphones fits in well with the legal process, Elder said

 

“Things that we can find on them would include call logs, contacts, text messaging. Some of the cellphones now can hold up to 3,000 or 4,000 text messages, so that gives us pretty good evidence toward the file,” he said.

 

“If it’s a drug dealer and he’s got a thousand text messages, arranging buys and all of that kind of stuff, it’s really conclusive evidence when we take that to court.”

 

Elder’s retirement was accompanied by a Commendation for Meritorious Service from Victoria Police Chief Jamie Graham.

 

High-tech sleuthing a geek’s dream for recently retired Victoria detective – World – Times Colonist.

6 Persistent Challenges with Smartphone Forensics

Quote

Posted on by
Reply

smartphone040313 6 Persistent Challenges with Smartphone ForensicsSmartphones, the most popular mobile communications devices today, are also some of the most difficult to extract evidentiary data from. While many commercial forensic tools have made great strides in supporting data extraction, decoding, and analysis from iOS, Android, and BlackBerry devices, some challenges remain. What are they, and how are vendors responding?

1. A smartphone is never just a smartphone.
Vendors and operating systems can vary widely, particularly with Android, but also even within iOS and BlackBerry user groups. More than 40 iOS versions are commercially available, and are spread among six different iPhones, five iPads, and five iPod Touch devices.

As of 2012, the Google-owned Android is the rising star in the mobile industry. In the third quarter it was reported to have nearly 75% market share compared to less than 20% for iOS and less than 10% for BlackBerry. Based on a Linux kernel and able to run Java apps, each Android device family has a different operating system and architecture, and thus requires a dedicated solution. Complicating matters, some manufacturers—among them Alcatel, Huawei, and Motorola—have begun to use nonstandard Chinese chipsets, particularly MTK, in their Android devices.

Unlike iPhone users, it’s unusual for Android users to upgrade their operating systems. (Currently, the “old” Gingerbread, Android v2.3, remains the most popular OS; it’s installed on nearly half of all Android devices compared to Android 4.1, “Jelly Bean,” which runs on only about 10% of devices. Android 4.0, “Ice Cream Sandwich,” is installed on just under 30% of Android devices.) It’s also not possible to upgrade from just any version.

2. Data protection: passwords and encryption
Not only does data storage vary from device to device and OS to OS, but devices may also be passcode-protected and/or encrypted.

Obviously, it is easy to extract data from a smartphone with no passcode. iPhone passcodes fall into two categories: simple and complex. A mobile data extraction tool should be able to reveal a simple passcode automatically for all devices through iPhone 4; owing to improved Apple security measures, passcode extraction and bypass are not yet supported for iPhone 4s or iPhone 5. Following the passcode extraction process, it will be possible to extract and decrypt all data including protected files.

A complex iPhone passcode, however, takes more effort. The investigator needs to know, and manually insert, this type of passcode in order to extract and decrypt all data. This may take interviewing the subject or the subject’s close contacts. If the investigator cannot figure out what the passcode is, no mobile forensic tool exists that can bypass it. Some data can be extracted and decrypted, but not protected files.

Keychains are another important element of iOS password protections. The vault that stores passwords for any variety of services—social media accounts, WiFi connections, and so forth—the keychain is encrypted and protected. It should be possible for a mobile forensics tool to decrypt the keychain and thus provide the examiner with access to additional data, which may not be otherwise possible.

Like iPhones, Android devices can also be user-locked. Unlike iPhones, they often use a pattern lock which is typically not complex. Rooting the device, even temporarily, cannot be done with a locked device unless debug mode is enabled. This operation takes considerable expertise on the examiner’s part.

Bypassing the pattern lock altogether is optimal. A file system or physical extraction, once decoded, will provide the correct pattern or PIN code used to lock the device. Alternatively, if decoding is unsupported within the extraction tool, it should be possible to carve the PIN lock.

Following a physical extraction, a file system extraction using the pattern lock and ADB mode should be possible. However, not all physical extractions from every Android are also supported for decoding. That’s because chipsets and hardware can vary from device to device, which affects whether a forensic tool can reconstruct the file system.

In some cases, when the passcode or pattern lock cannot be bypassed, it may be possible to reveal the lock code, then turn on ADB debugging and perform a file system extraction. This effectively eliminates the need to reconstruct the file system from a physical extraction.

Encrypted content is a different matter. The BlackBerry, for example, requires codes to lock the device and then encrypt the content. The device lock is associated with encryption: the user can’t encrypt the content without first locking the device.

Although it may therefore be possible to extract some unencrypted data from before the device was locked, it is usually not possible to decrypt BlackBerry content without access to the password. Often, the examiner must get the user to provide the password and encryption key.

When the device belongs to an organization—the user’s employer—it may be possible to ask IT staff to reset the encryption key through the BlackBerry Enterprise Server (BES). The content will still be encrypted, but the device will be using a generic key. On devices running OS 4, 5, and 6, it may then be possible to decrypt the content on the fly, analyzing and then showing the data in readable format.

3. Prepaid “burner” phones
Prepaid phones have been a problem for some time, and continue to be a problem for law enforcement in particular. That’s because the disabled data port on these devices cannot be enabled, and vendors don’t make the devices’ APIs—the normal mode by which logical and file system extractions are completed—available to commercial forensic extraction tools’ developers.

File system extractions have the dual benefit of making more data—including some deleted data—available quickly. However, because it extracts only data from allocated space on a device’s memory, it still remains limited in some ways. It also requires a higher degree of expertise on the examiner’s part because it requires decoding.

Physical extraction, the bit-for-bit copy of the device’s internal flash memory, provides the fullest amount of accurate data because it obtains information from both allocated and unallocated space. However, it can be time consuming even with a good forensic tool; it requires decoding, and therefore demands the examiner to have explicit training or expertise.

4. There’s no app for that
Apps, not just available for iPhone or Android but also through device vendors like Samsung, Nokia, and LG—as well as from mobile carriers like T-Mobile and retailers like Amazon—are another challenge.

Apps are diverse, ranging from travel tools like navigation, traffic information, and weather; to social networking and location sharing; to banking and finance; to communications tools such as chat, instant messaging, and voiceover IP; to entertainment tools like video, television and radio broadcasting, and gaming. Hundreds of thousands of apps exist; billions of downloads have occurred.

Forensic tools’ support for mobile apps has only just begun in the past year or so, and covers only the most popular apps. iOS apps are sandboxed, so all of a single app’s data will be in its particular folder. With Android, however, this is not the case. At least some app data will be available with a logical or file system extraction.

However, obtaining app data through physical extraction means decoding. To decode app data, the mobile forensic tool must be able to perform a file system reconstruction. This is a challenging process owing to the way Flash file systems are implemented: designed to avoid delete cycles, they keep deleted information in the device’s memory. However, once the Flash file system has been reconstructed, it’s possible to start decoding the content, including locations, Bluetooth devices, device information, cookies, installed apps, Web history, and so on.

Because the SQLite databases that compose iOS and Android file systems can provide access to available and deleted databases, including deleted entries from a database, the ability to view tables and content—and search the data—can be of great evidentiary value.

5. Accurate data, forensic soundness
Boot loaders are currently considered the most forensically sound physical extraction method. While they do involve loading a piece of code onto the device, this happens before the forensic tool accesses any evidentiary data.

That’s because they replace the device’s normal boot loader, or the first set of operations that kick off the phone’s startup process and hand off to the main controlling program, like the operating system, which supports the main or major device operations. In addition, the operation they enable—the extraction—is read-only.

Boot loaders have the additional advantages of being generic and therefore applicable to entire device families—not specific devices. And they enable access to unallocated areas for a fully accurate extraction.

In some Android devices, however, boot loader use is not supported, and it may become necessary to temporarily root the device to perform physical extraction. A temporary root does not permanently change administrative permissions or other data on the device. Rather, it provides access to the operating system so that the examiner can enable ADB debugging and from there, image the device’s Flash memory for a full physical extraction. Following this process, upon reboot, the device is no longer rooted.

Temporary rooting is not as forensically sound as a boot loader because it does load the device’s operating system, which may be logged within the device. Examiners using this method should plan to thoroughly document each step they take throughout the process, and their results, in order to maintain a record of their actions to which they can comfortably testify at trial.

6. Some smartphone extractions remain unsupported.
What happens when a smartphone is locked and unsupported by forensic tools? Flasher box, JTAG, or chip-off extraction methods become necessary. All three enable physical extraction—a logical examination cannot be performed on an unsupported locked device. However, even this capability can be limited. For example, although it’s possible to use the chip-off process on an iPhone locked with a complex passcode, the data will be encrypted and thus not much use.

Both JTAG and flasher box methods are device-specific, and JTAG processes are only minimally documented, so they require an examiner to be well trained. Flasher boxes also require training, as they can be destructive and were made to write data; thus, in the hands of an untrained examiner, they may not be forensically sound. Chip-off extraction, meanwhile, is always destructive, as it physically removes residual data from the memory chip.

This is often the case with BlackBerry devices that are locked with unknown passwords. Until recently, BlackBerry chip-off data format was proprietary, and no commercial tools could decode it. Ongoing research and development in this area has enabled some vendors to provide decoding support for chip-off extractions.

Indeed, smartphone forensics is the result of years of research by many dozens of professionals, both commercial and freelance. That research can range from reverse engineering the device’s hardware, firmware, and communication protocols; to exploiting vulnerabilities within the device’s firmware, operating system, or encryption algorithms (often the result of programming oversights).

As smartphones evolve, so will their persistent forensic challenges. Analysis skills like data carving, programming that can add functionality to commercial tools, and labor-intensive techniques such as JTAG, chip-off, and flasher box procedures will continue to be necessary—as will the tools that can support these efforts.

As Cellebrite USA’s Engineering Product Manager, Ronen Engler ensures that Cellebrite’s forensics-focused R&D teams issue new features and releases to meet customer needs. Having worked in Fortune 1000 companies as well as startups, Ronen has nearly 20 years of practical electrical engineering experience and an M.S.E.E degree from NYU-Poly.

Christa M. Miller is the Director of Mobile Forensics Marketing for Cellebrite USA. Christa has worked for more than 10 years as a journalist, specializing in digital forensics and other high tech topics for public safety trade magazines including Law Enforcement Technology, Police & Security News, NW3C’s The Informant, and others. Christa is based in South Carolina.

6 Persistent Challenges with Smartphone Forensics | DFI News.

Incoming search terms:

  • forensic tool

How Hard is It to ‘De-anonymize’ Cellphone Data?

Quote

Posted on by
Reply
how 17 How Hard is It to De anonymize Cellphone Data? Rendering by Christine Daniloff/MIT of an original image by Yves-Alexandre de Montjoye et al.

The proliferation of sensor-studded cellphones could lead to a wealth of data with socially useful applications — in urban planning, epidemiology, operations research and emergency preparedness, among other things. Of course, before being released to researchers, the data would have to be stripped of identifying information. But how hard could it be to protect the identity of one unnamed cellphone user in a data set of hundreds of thousands or even millions?

According to a paper appearing in Scientific Reports, harder than you might think. Researchers at MIT and the Université Catholique de Louvain, in Belgium, analyzed data on 1.5 million cellphone users in a small European country over a span of 15 months and found that just four points of reference, with fairly low spatial and temporal resolution, was enough to uniquely identify 95 percent of them.

In other words, to extract the complete location information for a single person from an “anonymized” data set of more than a million people, all you would need to do is place him or her within a couple of hundred yards of a cellphone transmitter, sometime over the course of an hour, four times in one year. A few Twitter posts would probably provide all the information you needed, if they contained specific information about the person’s whereabouts.

The first author on the paper is Yves-Alexandre de Montjoye, a graduate student in the research group of Toshiba Professor of Media Arts and Science Sandy Pentland. He’s joined by César Hidalgo, an assistant professor of media arts and science; Vincent Blondel, a visiting professor at MIT and a professor of applied mathematics at Université Catholique; and Michel Verleysen, a professor of electrical engineering at Université Catholique.

Focusing the debate
Hidalgo’s group specializes in applying the tools of statistical physics to a wide range of subjects, from communications networks to genetics to economics. In this case, he and de Montjoye were able to use those tools to uncover a simple mathematical relationship between the resolution of spatiotemporal data and the likelihood of identifying a member of a data set.

According to their formula, the probability of identifying someone goes down if the resolution of the measurements decreases, but less than you might think. Reporting the time of each measurement as imprecisely as sometime within a 15-hour span, or location as imprecisely as somewhere amid 15 adjacent cell towers, would still enable the unique identification of half the people in the sample data set.

But while its initial application may be discouraging, de Montjoye and Hidalgo hope that their formula will provide a way for researchers and policy analysts to reason more rigorously about the privacy safeguards that need to be put in place when they’re working with aggregated location data.

“Both César and I deeply believe that we all have a lot to gain from this data being used,” de Montjoye says. “This formula is something that could be useful to help the debate and decide, OK, how do we balance things out, and how do we make it a fair deal for everyone to use this data?”

Everybody’s different
In the data set that the researchers analyzed, the location of a cellphone was inferred solely from that of the cell tower it was connected to, and the time of the connection was given as falling within a one-hour interval. Each cellphone had a unique, randomly generated identifying number, so that its movement could be traced over time. But there was no information connecting that number to the phone’s owner.

The researchers randomly selected a representative sampling from the set of 1.5 million cellphone traces and, for each trace, began choosing points at random. For 95 percent of the traces, just four randomly selected points was enough to distinguish them from all other traces in the database. In the worst (or, from another perspective, best) case, 11 measurements were necessary.

“There’s a concern with this data, to what extent can we preserve anonymity,” says Luis Bettencourt, a professor at the Santa Fe Institute who studies social systems. “What they are showing here, quite clearly, is that it’s very hard to preserve anonymity.”

But for Bettencourt, the uniqueness of people’s trajectories through cities is itself precisely the type of information that analysis of cellphone data is meant to uncover. “This is interesting, from a scientific point of view, to understand how people use urban space,” Bettencourt says. “It shows what kind of social systems cities are.”

The researchers suspect that similar relationships might hold for other types of data. “I would not be surprised if a similar result — maybe requiring more points — would, for example, extend to web browsing,” Hidalgo says. “The space of potential combinations is really large. When a person is, in some sense, being expressed in a space in which the total number of combinations is huge, the probability that two people would have the same exact trajectory — whether it’s walking or browsing — is almost nil.”

How Hard is It to ##Q##De-anonymize##Q## Cellphone Data? | DFI News.

Smartphone File Traces Sent to the Cloud

Quote

Posted on by
Reply

smartphone Smartphone File Traces Sent to the CloudWhen smartphone users upload files to cloud-based services, remnants of those files often remain on their handheld device, even if the data is meant to be stored only in the cloud, researchers have found.

The consequence is that hackers could potentially access files stored in the cloud, or get access to cloud accounts, using leftover data stored on your Android device, iPhone or other smartphone.

“That smartphones can essentially remember deleted information poses a huge risk to organizations that issue smartphones to employees and to organizations that don##Q##t explicitly disable the use of personal devices for work-related computing,” says Pravin Kothari, founder and CEO of CipherCloud, a maker of cloud encryption software.

The tracing of leftover data on smartphones is not for the layperson, Kothari says, but could be looked at as the modern-day equivalent of Dumpster-diving for personal information.

Smartphone File Traces Sent to the Cloud | DFI News.

Incoming search terms:

  • criminal and routine activities in online settings: gangs offenders and the internet

Frozen Android phones give up data secrets

Quote

Posted on by
Reply

66251086 frost menu Frozen Android phones give up data secretsChilling a phone makes its contents vulnerable to copying

Freezing an Android phone can help reveal its confidential contents, German security researchers have found.

The team froze phones for an hour as a way to get around the encryption system that protects the data on a phone by scrambling it.

Google introduced the data scrambling system with the version of Android known as Ice Cream Sandwich.

The attack allowed the researchers to get at contact lists, browsing histories and photos.

Cold start

Android##Q##s data scrambling system was good for end users but a “nightmare” for law enforcement and forensics workers, the team at Erlangen##Q##s Friedrich-Alexander University (FAU) wrote in a blogpost about their work.

To get around this, researchers Tilo Muller, Michael Spreitzenbarth and Felix Freiling from FAU put Android phones in a freezer for an hour until the device had cooled to below -10C.

The trio discovered that quickly connecting and disconnecting the battery of a frozen phone forced the handset into a vulnerable mode. This loophole let them start it up with some custom-built software rather than its onboard Android operating system. The researchers dubbed their custom code Frost – Forensic Recovery of Scrambled Telephones.

The Frost software helped them copy data on a phone that could then be analysed on a separate computer.

A chilled phone also helped their hacking project. Data fades from memory much more slowly when chips are cold which allowed them to grab the encryption keys and speed up unscrambling the contents of a phone.

PhD student Tilo Muller told the BBC that the attack generally gave them access to data that had been put in memory as users browsed websites, sent messages or shared pictures.

The researchers tested their attack against a Samsung Galaxy Nexus handset as it was one of the first to use Android##Q##s disk encryption system. However, they said, other phones were just as likely to be vulnerable to the attack. The team are planning further tests on other Android handsets.

While the “cold boot” attack had been tried on desktop PCs and laptops, Mr Muller said the trio were the first to try it on phones.

“We thought it would work because smartphones are really small PCs,” he said. “but we were quite excited that the trick with the freezer worked so well.”

The German research group is now working on defences against the attack that ensures encryption keys are never put in vulnerable memory chips. Instead they are only used in the memory directly attached to a phone##Q##s processor.

BBC News – Frozen Android phones give up data secrets.

Incoming search terms:

  • android phone system data

Cellebrite’s Experts Identify Mobile Forensics Trends for 2013

Quote

Posted on by
Reply

To gather this list, Cellebrite interviewed a number of prominent experts from law enforcement, corporations and universities, as well as industry analysts, familiar with mobile forensics, information security and e-discovery and the most advanced mobile forensic products available today. They highlighted the following nine trends as the most critical for investigative and legal professionals to prepare for the upcoming year:

  1. BYOD impacts the forensics industry. While “Bring Your Own Device” (BYOD) seemed to infiltrate the enterprise in 2012, the mobile forensics industry will confront the impact of this growing trend in the year ahead. BYOD adoption across the enterprise means that forensics professionals will encounter a greater number of compromised phones. According to John Carney, Chief Technology Officer, Carney Forensics, “For e-discovery experts, BYOD will mean contending with more devices that contain both personal and corporate evidence as well as an increase in legal challenges related to device access and privacy during corporate investigations.”
  2. Critical data: there’s an app for that. According to a 2012 Nielsen report, the average smartphone user has approximately 41 apps installed on a single device. “Whether it’s mobile messaging, personal navigation, social media or improving productivity – apps are going to dominate smartphones and tablets in 2013,” said Carney. “The ability to extract critical data stored in apps will become the new measuring stick by which investigators gauge the superiority of mobile forensics tools.”
  3. Smarter phones mean tougher encryption. “Expect to see more encryption of data on smartphones to protect personal privacy and corporate data, which will make forensic examination more challenging,” said Eoghan Casey, founding partner at CASEITE.Password technology, too, has advanced; pattern-screen locks have hindered forensic data extraction efforts. In 2013, look for mobile forensics tools to continue to find ways to bypass a greater number of passwords and device locks, as well as address advanced encryption technology.
  4. Investigators can’t put all their eggs into one mobile operating system. Though Android took 75 percent of the market in Q3 of 2012,for mobile forensics professionals, market share isn’t everything. As Paul Henry, security and forensics analyst, vNet Security, noted, “While Android is the predominant operating system, the bulk of the bandwidth is still taking place on Apple devices, making them critical to many investigations.” In addition, despite BlackBerry’s decline in recent years, Carney said: “Their popularity for over a decade will make them an important legacy device pertinent to investigations for years to come.”
  5. Windows 8 is the wildcard. Notwithstanding all the attention garnered by Android and Apple, the real wildcard for 2013 will be the rise of Microsoft in the mobile device market. While questions remain regarding how prevalent Microsoft devices will become, Cellebrite’s panel of experts predicts that the need for mobile forensic tools providing support for Windows 8 will increase in the New Year.
  6. Mobile devices advance as witnesses. Look for mobile devices and the data they contain to take center stage in both civil and criminal investigations in the year ahead. “Civil litigators are discovering that mobile device evidence is just as important as digital documents and email evidence,” said Carney. According to Heather Mahalik, mobile forensics technical lead at Basis Technology, “Now, more than ever before, e-discovery experts need comprehensive training in order to ensure the proper extraction of all relevant data from mobile devices.”
  7. The regulatory and legislative landscape remains uncertain. “Lawmakers and judges are looking at cell phones much more critically than they did computers,” said Gary Kessler, associate professor, Embry-Riddle Aeronautical Univ. and a member of the ICAC North Florida Task Force. “However, because few understand the nature of the technology, they are erring greatly on the side of caution. This speaks to the need for greater education regarding the scope and possibilities of mobile forensics and what it means for privacy and pre-trial discovery.”
  8. Mobile malware’s incidence will rise. In 2013, look for malware on smartphone platforms and tablets to increase exponentially, particularly on Android devices. According to Cindy Murphy, detective, computer crimes/computer forensics, Madison Wisconsin Police Department, “The intended uses of mobile malware will be very similar to non-mobile malware – steal money, steal information and invade privacy. For law enforcement and forensics professionals, mobile malware means dealing with potentially compromised devices that may help perpetrators cover their tracks, making it increasingly difficult for investigators to meet the threshold of reasonable doubt.”
  9. Data breaches via mobile will rise. “Mobile forensics vendors should resolve to provide stronger capabilities for enterprise wide smartphone investigations to support the investigation of data breaches targeting smartphones and the needs of e-discovery,” said Casey. Malware together with large-scale targeted intrusions into smartphones (targeting sensitive data) will raise enterprises’ risks for data destruction, denial of service, data theft and espionage.

“From the increasing use of mobile evidence to challenges stemming from the rise in tougher encryption methods, there are a number of areas that will demand the attention of mobile forensics professionals in the year ahead,” said Ron Serber, Cellebrite co-CEO. “As the industry continues to evolve, it will be critical for the law enforcement community, as well as the enterprise, to invest in proper training and ensure that their budgets allow them to meet the growing demand for comprehensive device analysis and data extraction.”

Cellebrite’s UFED provides cutting-edge solutions for physical, logical and file system extraction of data and passwords from thousands of legacy and feature phones, smartphones, portable GPS devices and tablets with ground-breaking physical extraction capabilities for the world’s most popular platforms — BlackBerry, iOS, Android, Nokia, Windows Mobile, Symbian and Palm and more. The extraction of vital evidentiary data includes call logs, phonebook, text messages (SMS), pictures, videos, audio files, ESN IMEI, ICCID and IMSI information and more.

Cellebrite’s panel of experts included:

  • Eoghan Casey, Founding Partner, CASEITE
  • John Carney, Chief Technology Officer, Carney Forensics; Attorney at Law, Carney Law Office
  • Paul Henry, Leading Security and Forensics Analyst, Principle at vNet Security; Vice President at Florida Association of Computer Crime Investigators; SANS Senior Instructor
  • Gary Kessler, Associate Professor, Embry-Riddle Aeronautical University; ICAC Northern Florida Task Force
  • Heather Mahalik, Mobile Forensics Technical Lead, Basis Technology; SANS Certified Instructor
  • Cindy Murphy, Detective Computer Crimes/Computer Forensics, Madison Wisconsin Police Department
  • Ron Serber, co-CEO, Cellebrite

Cellebrite’s Experts Identify Mobile Forensics Trends for 2013 | DFI News.