Download presentation
Presentation is loading. Please wait.
Published byBaldric Craig Modified over 9 years ago
1
Hong-Kong, Mar-03-05 Mobile Data in Legal Proceedings and methods for Extraction, Analysis and Delivering Yuval Ben-Moshe Forensics Technical Director
2
Relevance
3
Why Mobile ESI? A treasure trove of information User accounts Contacts Call history SMS Messages Messages Google Mail and Yahoo! Messenger Skype Chat History of Google Maps, Dynamic Dictionary Automatic Screen Shots Apps stored data Deleted
4
Mobile Evidence is Admissible in Court Sihlali v. South African Broadcasting Corporation, Ltd. (J700/08) [2010] ZALC Rash text message: "I Quit" Employment resignation by SMS text message was a legally-effective notice in “writing”
5
Mobile Evidence may need to be Preserved Regas Christou v. Beatport, LLC (D. Colo. January 23, 2013),Regas Christou v. Beatport Court sanctioned the defendants for taking “no steps to preserve text messages” leading to a spoliation sanction.
6
Concepts and Challenges of Mobile Device Forensics
7
Yet Another Computer
8
Not
9
Extraction Methods Logical Extraction File System Extraction Physical Extraction
10
Logical Extraction Results A well formatted report: Call logs, Contacts, SMS messages, Videos, Photos, Audio, Music
11
Logical Extraction File System Extraction Physical Extraction Extraction Methods
12
File System Extraction Results SMS, Contacts, Call Logs, MMS, Notes, Applications, Voice Mails, Calendar, Bluetooth, GPS, Notes, Bookmarks, Skype, Chat, Cookies, Facebook Content .plist files containing great forensic data ‘keychain-2.db’ - Networks the user connected to including Wi-Fi, VPN, Bluetooth and the Apple iTunes Store ID. Other databases contain information from Apps
13
Logical Extraction File System Extraction Physical Extraction Extraction Methods
14
Contacts Including Deleted
15
Detailed Call Log, Including Deleted
16
Skype Contacts Including Deleted
17
Application Usage Details
18
WiFi Access History
19
GPS Locations History
20
User Pattern Lock 2020
21
3->2->1->4->7->8->9 2121
22
Timeline Analysis
23
Graphical Timeline Analysis
24
Real life Case - Logical Vs Physical Additional evidence recovered using Physical: 22,000+ images 59 videos 1000+ audio files 16,000+ locations 60+ chats (included Facebook and Skype) 30+ MMS 3300+ text files
25
Changing the “Undue Burden” and Proportionality Equations Gathering information from mobile devices is easy and intuitive Mobile stored information has many unique artifacts; just one can tip your case The bar for “Undue burden” argument has been raised It is more likely to be “Proportionate”
26
UFED Touch
28
Decoding, Analysis & Reporting UFED Reader UFED Logical Analyzer UFED Physical Analyzer Multilingual User Interface Advanced Search Bookmarks and Tags Timeline view Multiple Project Instant Search Conversational View Generate and customized Reporting.ufd Support Watch List Hex Image view and search Advanced Carving Chain Manager Python Scripting Shell Advanced Decoding SQLite DB browser Installation License FreeUFED LogicalUFED Ultimate
29
Mobile Data as a Piece in the Puzzle Mobile data is only as valuable as it can be weighted within the whole dataset UFED output is already available for processing with: Exterro Fusion, Nuix, Palantir. More integration projects are on-going
30
Recap
32
RAPRAP
33
Richer Accessible Proportionate
34
Questions
35
Thank You Yuval Ben-Moshe Yuvalbm@Cellebrite.com
Similar presentations
© 2025 SlidePlayer.com. Inc.
All rights reserved.