Feeds

Will your mobile squeal to the police?

Digital forensics turns smartphones into supergrasses

High performance access to file storage

Analysis It's been 20 years since a UK drug dealer discovered too late the folly of keeping all his records on a Psion Organiser, helpfully providing police with names and addresses of customers and suppliers, as well as sales records*. Today's criminals aren't generally that stupid, but regardless, today's phones are perfectly capable of accumulating evidence without their help.

Mobile phone forensics is a decent-sized industry these days, with companies queuing up to help police extract every iota of information from handsets of every shape and size. There's no industry body as yet, so anyone can call themselves a mobile phone forensics specialist. But police forces tend to have preferred suppliers, and look to each other for recommendations.

Not that the police can just grab every phone they see for analysis - if you're stopped and searched they're only allowed to check for weapons (some supermodels notwithstanding, a mobile phone is not classed as a weapon). Even if you're suspected of a crime the police need to believe there might be pertinent evidence on the handset, or pick it up as a legal seizure during a raid.

Your new cellmate

In the UK it's also standard practice to scoop up mobiles belonging to the recently deceased, to see what they were doing prior to being dead.

Once legally seized the police can do what they like with a phone, though they'll take care not to compromise the evidence. The industry has produced a set of guidelines for police forces working with digital evidence (pdf), with the section on mobile phones having been recently updated (page 45).

The overriding concern is not to alter the data in any way, as that might compromise its integrity – providing a get-out clause for defence lawyers. For personal computers that means taking an image of the disk, leaving the original untouched; on mobile phones it's not quite that easy. Just getting the data off the phone might require the installation of an application, which could destroy important evidence.

Flash memory, of the type used in most smartphones, is not normally erased as such. Deleted data is marked as deleted, then overwritten when the space is needed - but there is a limit to how often Flash can be written, so the OS will avoid overwriting things for as long as possible (a process called wear-levelling) to ensure the whole memory is used.

For example: an iPhone may have 16GB of memory, but most users will only fill half that, and once full the data generally remains pretty static. So old information can hang around for years, and be extracted using the right forensic tools.

Jonathan Zdziarski, author of O'Reilly's iPhone Open Application Development, recently demonstrated how to do that using open source tools, by jail-breaking the handset. In fact Jonathan has demonstrated that clearing data off the iPhone is just about impossible, and he's been busy lifting personal data from refurbished iPhones using his hack.

Forensic software specialists Hex-Dump has a package called Pandora's Box which can lift data from a wide range of handsets without installing anything (and thus risking overwriting evidence), with support for the iPhone coming any day now.

Even the most basic handset has an address book and a list of recently dialled numbers, which can give investigators an insight into the life of the user. SMS messages, and address-book entries, stored on the SIM are not generally deleted – just marked as available space, so may be retrieved even when the user thinks they've gone.

*He also bought himself a £100,000 house, paid for in cash, while still signing on, so he wasn't just technically illiterate.

High performance access to file storage

More from The Register

next story
A black box for your SUITCASE: Now your lost luggage can phone home – quite literally
Breakfast in London, lunch in NYC, and your clothes in Peru
Broadband Secretary of SHEEP sensationally quits Cabinet
Maria Miller finally resigns over expenses row
Skype pimps pro-level broadcast service
Playing Cat and Mouse with the media
Beat it, freetards! Dyn to shut down no-cost dynamic DNS next month
... but don't worry, charter members, you're still in 'for life'
EE dismisses DATA-BURNING glitch with Orange Mail app
Bug quietly slurps PAYG credit - yet EE denies it exists
Like Google, Comcast might roll its own mobile voice network
Says anything's possible if regulators approve merger with Time Warner
Turnbull leaves Australia's broadband blackspots in the dark
New Statement of Expectations to NBN Co offers get-out clauses for blackspot builds
Facebook claims 100 MEEELLION active users in India
Who needs China when you've got the next billion in your sights?
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
HP ArcSight ESM solution helps Finansbank
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.