[IEEE IEEE Southeastcon 2009 (SOUTHEASTCON) - Atlanta, GA, USA (2009.03.5-2009.03.8)] IEEE Southeastcon 2009 - BlackBerry IPD parsing for open source forensics

$#((+ ()"%! &( '% &*( &(%)") $9J=B 5=F65B?G $=G<CF9 HF9M5 !9BFM (K9B "'--* -% *$"1/("* ,# -+.21$/ ,&(,$$/(,& $-/&( ,01(121$ -% $"',-*-&6 7$3(,(/!,)0 1/$6)(0'-/$ -4$,8&1$"'$#2 , 1'(0 ..$/ 4$ ./$0$,1 %/+$4-/) %-/ , -.$, 0-2/"$ *")$//6 ,1$/"1(3$ &$/ ")2.$01-/$ %(*$ %-/$,0("0 1--* 2/ /$0-,(,& %-/ #$3$*-.(,& , -.$, 0-2/"$ 3$/0(-, -% , ./0$/ (0 1- $,',"$ 1'$ 3(*!*$ -.$, 0-2/"$ %-/$,0(" 1--*0 , $5+.*$ -% 1'(0 "1$&-/6 -% 1--*0 (0 1'$ *$21' (1 ,$ (,1$,1(-, -% 1'(0 4-/) (0 1- +)$ 20$/0 -% *")$//60 4/$ -% 1'$ 32*,$/!(*(16 -% 1'$(/ (,%-/+1(-, -, 1'$(/ "-+.21$/0 -++$/"(* 1--*0 02"' 0 1'$ +!$/ *")$//6 -,3$/1$/ ..*("1(-, ./$0$,1*6 $5(01 '1 "-++$/"(* 1--* (0 !*$ 1- &1'$/ 1'$ +$00&$0 "-,1"10 /$"-/#0 +$+-0 "** *-&0 ,# 1'$ 10) *(01 %/-+ , %(*$ 1 1'$, $5.-/10 1'$0$ /$"-/#0 (, 3/($16 -% %-/+0 ,-1'$/ "-++$/"(* 1--* !6 /!$, ", $5.-/1 #1 (,1- "*-0$# 0-2/"$ %-/$,0(" 1--* )(10 02"' 0 ,"0$ ,# '(*$ 01(** 4-/) (, ./-&/$00 1'$ ./$*(+(,/6 /$02*10 (,#("1$ 1'1 1'$ +$1'-# #$3$*-.$# %-/ $51/"1(,& (,%-/+1(-, (0 3*(# '$ $,# &-* -% 1'(0 /$0$/"' (0 1- ./-#2"$ +-#$* 1'1 ", !$ #-.1$# !6 -.$, 0-2/"$ %-/$,0(" ./"1(1(-,$/0 (, 1'$(/ $5+(,1(-,0 ,# 1--*)(1 #$3$*-.+$,1 )<CB9G 5F9 BC @CB;9F 89J=79G H<5H <5J9 H<9 GC@9 DIFDCG9 C: H5?=B; GCIB8 HF5BG:CFA=B; =H =BHC 9@97HF=75@ G=;B5@G 5B8 HF5BGA=HH=B; H<CG9 G=;B5@G CJ9F 5 D5=F C: K=F9G CF A5BM D9CD@9 H<9 H9FA D<CB9 7CB>IF9G ID H<9 =A5;9 C: 5 79@@I@5F D<CB9 F5H<9F H<5B H<5H C: H<9 HF58=H=CB5@ H9@9D<CB9 @H<CI;< 79@@I@5F D<CB9G <5J9 5::CF898 GC7=9HM 5G 5 K<C@9 H<9 56=@=HM HC 7CAAIB=75H9 K<=@9 69=B; AC6=@9 H<9M <5J9 5@GC G9FJ98 5G F9DCG=HCF=9G :CF EI=H9 5 6=H C: D9FGCB5@ =B:CFA5H=CB IFF9BH@M H<9 79@@I@5F D<CB9 =G IB89F;C=B; 5B 9JC@IH=CB =BHC 5 89J=79 H<5H 75B BCH CB@M 9B56@9 7CAAIB=75H=CB 6IH GHCF9 85H5 A5B5;9 G7<98I@9G 5B8 9J9B DFCJ=89 F95@H=A9 =B:CFA5H=CB 65G98 CB H<9 @C75H=CB C: 5 D9FGCB -<9G9 GA5FHD<CB9G 5 7CA6=B5H=CB C: 5 D9FGCB5@ 8=;=H5@ 5GG=GH5BH 5B8 5 79@@I@5F D<CB9 5@GC <5J9 H<9 56=@=HM HC 657?ID 85H5 5B8 GMB7<FCB=N9 @C75@ 5DD@=75H=CBG K=H< 5 7CADIH9F H<9F96M @95J=B; 69<=B8 9J=89B79 H<5H 75B 69 7C@@97H98 6M :CF9BG=7 DF57H=H=CB9FG -<9 BIA69F C: @57?9FFM IG9FG <5G ;FCKB G=;B=:=75BH@M CJ9F H<9 @5GH M95F FCI;<@M 8CI6@=B; =HG A5F?9H G<5F9 HC D9F79BH 23 5B8 G9@@=B; A=@@=CB @57?9FFM IB=HG =B H<9 :=G75@ M95F 23 -<=G =B7F95G9 =B @57?9FFM IG9FG <5G 75IG98 5 GIF;9 =B H<9 IG5;9 C: @57?9FFM 9G?HCD ,C:HK5F9 :CF 89J=79 657?ID 09 7CB8I7H98 5B =B:CFA5@ GIFJ9M C: @57?9FFM IG9FG 5B8 :CIB8 H<5H 5DDFCL=A5H9@M D9F79BH 657? ID H<9=F 89J=79G IG=B; H<9 @57?9FFM 9G?HCD ,C:HK5F9 -<=G BIA69F =G G=;B=:=75BH K<9B H<9 F9GI@HG 5F9 9LHF5DC@5H98 65G98 C:: C: H<9 BIA69F C: IB=HG GC@8 CJ9F H<9 D5GH M95F J9B =: H<9 D9F79BH5;9 C: IG9FG H<5H 657?ID H<9=F @57?9FF=9G =G F98I798 HC 5 ACF9 7CBG9FJ5H=J9 9GH=A5H9 C: 5FCIB8 D9F79BH H<5H GH=@@ @95J9G A=@@=CB 7CADIH9FG K=H< ") :=@9G H<5H 75B 69 5B5@MN98 M =BHFC8I7=B; H<9=F @57?9FFM BH9FDF=G9 ,9FJ9F K<=7< 7CBB97HG HC A9GG5;=B; 5B8 7C@@56CF5H=CB G9FJ9FG GI7< 5G &=7FCGC:H L7<5B;9 +"&OG @57?9FFM <5G 697CA9 H<9 GA5FHD<CB9 C: 7<C=79 :CF 6IG=B9GG9G 695H=B; CIH H<9 )5@A -F9C 5B8 H<9 DD@9 =)<CB9 -<9G9 89J9@CDA9BHG A5?9 H<9 ") :=@9 :FCA 5 @57?9FFM 5 DF=A9 H5F;9H 5G CDDCG98 HC CH<9F G=A=@5F 89J=79G 0<9B 897=8=B; K<9H<9F H<9 D5FG9F 89F=J98 :FCA H<=G F9G95F7< G<CI@8 69 F9@95G98 HC H<9 CD9B GCIF79 7CAAIB=HM G9J9F5@ :57HCFG <58 HC 69 7CBG=89F98 -<9 :=FGH 5B8 ACGH D5F5ACIBH C: H<9G9 =GGI9G K5G HC 8=G79FB =: 6M F9@95G=B; CD9B GCIF79 GC:HK5F9 K9 5F9 GCA9<CK 9B56@=B; =BHFI89FG HC ;5H<9F D9FGCB5@ =B:CFA5H=CB =B 5 K5M H<5H KCI@8 69 CH<9FK=G9 8=::=7I@H HC C6H5=B -<=G =G BCH H<9 75G9 G=B79 7CAA9F7=5@ HCC@G 5@F958M 9L=GH @H<CI;< CIF :F5A9KCF? 5@@CKG CB9 HC D5FG9 ") :=@9G 5B8 DF9G9BH H<9 =B:CFA5H=CB 7CBH5=B98 H<9F9=B =B 5 A5BB9F H<5H =G 95GM HC =BH9FDF9H 5BM IG9F H<5H <5G 5779GG HC H<9 ") :=@9 CB 5 GMGH9A 75B J=9K =HG 7CBH9BHG 6M CD9B=B; =H K=H< 5 H9LH CF <9L 98=HCF ;F95H 895@ C: H<9 =B:CFA5H=CB K=@@ 5DD95F 5G 5B =B7CADF9<9BG=6@9 A5GG C: GHF5B;9 GMA6C@G M9H 7CBH5=B98 =B H<5H >IA6@9 5F9 7@95F =BGH5B79G C: ,"" GHF=B;G -<=G =G 89ACBGHF5H98 95G=@M K<9B 5B ") :=@9 =G =BDIH =BHC H<9 GHF=B;G DFC;F5A =B 5 .'"1@=?9 CD9F5H=B; GMGH9A 5B8 5@@ H<9 GH5B85F8 ,"" 7<5F57H9FG 5F9 9LHF57H98 Figure 1: IPD file structure

Documents

[IEEE IEEE Southeastcon 2009 (SOUTHEASTCON) - Atlanta, GA, USA (2009.03.5-2009.03.8)] IEEE Southeastcon 2009 - BlackBerry IPD parsing for open source forensics