Smart Phones & the Internet

16 Knight St., Norwalk, CT 06851 : (203) 855-5387 [email protected] : www.TeelTech.com

Smart Phones and the Internet ::Societal Shi3s and the Age of the App


Topics

•  How and why smartphones are changing the game for online evidence

•  What evidence can be found on smartphones and how does it work with “tradi<onal” online evidence gathering

•  Sugges<ons for how far to go with smart-‐ phone evidence and how to work in conjunc<on with devices and online evidence gathering


Societal ShiAs

•  Research by Ericsson ConsumerLab suggests that people are finding it increasingly difficult to live without a connec<on to the cloud

•  Prior to smartphones people used the internet in chunks – now they “jacked in” constantly

•  Consumers are forming habits integra<ng internet use into everyday life through apps-‐cloud dependency!


Societal ShiAs

•  To date 35 percent of US Android/iPhone users interact with non-‐voice applica<ons on their smartphones before gePng out of bed – The most common ac<vity checking Facebook – 18 percent of social networking users log in while their heads are s<ll on the pillow


Societal ShiAs

•  AAer gePng out of bed 23% of smartphone users access the internet via their browsers, 24% check their email and 22% check Facebook

•  29% use Google Maps or other nav tools on morning commute and 28% listen to music


Societal ShiAs


Societal ShiAs


Societal ShiAs


Societal ShiAs

•  Smartphones are becoming hubs through which people manage their social lives

•  Ericsson ConsumerLab reports smartphone users are spending considerable <me using “everyday” apps -‐integra<ng internet use into a more basic level of everyday life


Societal ShiAs


Societal ShiAs

•  Ericsson’s research suggests “Consumers expect, and increasingly depend on, the ability to access online services easily at low cost and complexity from mul<ple loca<ons during the day.”

•  Among Americans using portable storage devices –  54 percent were interested in synchronizing the portable storage from anywhere

–  51 percent want direct exchange between portable devices and online secure storage


Societal ShiAs

•  The overwhelming purpose for use of the smartphone is personal – 80-‐90% of respondents

•  Consumers connect to apps on an emo<onal level – Feeling of beèr control of life – Feeling of belonging


Market

•  Smart phone market expected to grow over 55% in 2011 – 472 million expected shipped in 2011 – 982 by the end of 2015

•  Growth is four <mes faster than that of tradi<onal mobile phones

•  Emerging markets key – Asia/Pacific, La<n America


Market


Android Market Share


Considera<ons

•  Working with other inves<gators •  How far to go?


Evidence


Third Party Applica<ons

•  Over 300k apps for sale in App Store •  There are many unauthorized applica<ons from jailbroken phones

•  Can contain important informa<on

•  Store their informa<on using – Plists – Sqlite databases – Text files


Twièr

•  Two directories – Documents

– Library •  Documents

– Com.atebits.twee<e.applica<on-‐state •  Account informa<on and followers


Twièr

•  Documents (cont’d) – Com.atebits.twee<e.compose.aàchments

•  Hashed numbers as file names -‐ actual aàchments sent with tweets

– Com.atebits.twee<e.streams •  One or more property lists

–  tweet handles (user names) and tweets

»  date and <me values in absolute <me


Twièr


Twièr

Username/Date Stamp


Twièr


Facebook

•  In iOS most informa<on stored on server •  Important files -‐ /Library/Applica<ons/Facebook

– Friends.db – Com.facebook.Facebook.plist


Facebook


Facebook


Skype

•  Allows for VOIP calls on iOS devices connected by Wi-‐Fi – /Library/Skype/Applica<on Support/$user/ – Phone Logs – Chat logs – Account details


Skype


iOS GPS Ar<facts -‐ Maps

•  Maps App – P to P direc<ons – Locate Points of Interest (POI)

•  More info

•  Direc<ons – Loca<on: /Library/Maps

•  History.plist •  Direc<ons.plist •  Bookmark.plist





•  Bookmarks.plist – Not easily viewable in plist editor

•  Data is base 64 encoded – Contains loca<on

•  Cell ID –  This is Google’s cell ID (cell tower) loca<on database

•  Details –  telephone number –  URL









•  Direc<ons.plist – User requested point to point direc<ons

•  Start and stop end points •  Turn by turn direc<ons

– Viewed in the plist editor the data is base 64 encoded

– Can be decoded in a hex or text editor •  Online base 64 decoders



h8p://www.opinionatedgeek.com/dotnet/tools/base64decode/


Geotags


Geotags -‐ iOS


Geotags -‐ iOS •  Videos in iOS store Geo Data at the end of the file


Geotags -‐ iOS •  Quick<me can be used to format Geo data in videos for quick viewing


Cellular Data

•  =< iOS 4.0 – Located in /Library/caches/loca<ond

•  Cells.plist •  Clients-‐b.plist •  H-‐cells.plist •  H-‐wifi.plist

•  =>4.0 •  Located in /Library/caches/loca<ond

–  Clients.plist –  Consolidated.db


Cellular Data


Cellular Data


Upcoming Training Advanced Smartphone Forensics

•  Smartphone Forensics Mississauga, Ontario September 19th -‐ 23rd

Device Repair and Chip-‐off Forensics •  Repair + Chip-‐Off Forensics

Wild PCS Training Facility Las Vegas Sept. 26th -‐ 30th

Advanced BlackBerry Forensics Training •  BlackBerry Forensics

Manchester, England October 3rd -‐ 7th

Advanced Mobile Forensics / Flasher Box Forensics

•  Advanced + Flasher Box Forensics SAIC -‐ McLean, Virginia October 11th -‐ 13th

Device Repair and Chip-‐off Forensics •  Repair + Chip-‐Off Forensics

Wild PCS Training Facility Las Vegas Nov. 7th -‐ 11th


QuesOons?

Technology

Smart Phones & the Internet