Writing To Mobile Phones Under Examination

Writing To Mobile Phones Under Examination

There is always the debate as to what amounts to "forensic" processes and whether that can be left to human intervention to do that, whether a device alone can do that or whether it is the combination of human intervention and the device working together that can fulfil the objective? Perhaps germane and relevant to the above question is (1) knowing the potential of each to write to a mobile telephone should be understood first? (2) Whether, as a consequence of using the process, what data are or might be altered/lost? (3) To then decide whether "forensic" is an appropriate and applicable statement to label the process in the first place?

The discussion below starts to address Point 1. When examining mobile telephones there are at least five separate categories under which an examiner can or may write to a mobile telephone due to automated processes (indirect intervention) and/or direct human intervention. The categories and their contents below are not exhaustive, but have been used to illustrate some elements involved with Point 1.

A) Standard powering ON (direct human intervention) a mobile telephone can invoke automated processes (indirect intervention):

- wearleveling - can overwrite physical data

- updating files - writes new content to file

- setting off calendars alarms

B) Connecting data aquisition devices (direct human intervention) to mobile telephones to obtain stored data (indirect intervention):

- AT Command sets; to instruct mobile to identify its profile, fetch data (IMEI and SMS text messages etc). The example below illustrates a typcial communication of seeking the profle of a mobile telephone and the response received:-

SENDING frametype 0x00/length 0x08/8


41A54T2B+43C47G4DM49I0D AT+CGMI.


1 "AT+CGMI"


2 "Sony Ericsson"


3 "OK"


RECEIVED frametype 0x00/length 0x1F/31


41A54T2B+43C47G4DM49I0D 0D 0A 53S6Fo6En79y2045


AT+CGMI...Sony E


72r69i63c73s73s6Fo6En0D 0A 0D 0A 4FO4BK0D 0A


ricsson....OK..


Manufacturer info received


Sony Ericsson [Manufacturer: Sony Ericsson]





SENDING frametype 0x00/length 0x09/9


41A54T2B+43C53S43C53S3F?0D


AT+CSCS?.


1 "AT+CSCS?"


2 "+CSCS:


"GSM""


3 "OK"





SENDING frametype 0x00/length 0x0A/


10 41A54T2B+43C53S43C53S3D=3F?0D


AT+CSCS=?.


1 "AT+CSCS=?"


2 "+CSCS: ("GSM","IRA","8859-1","UTF-8","UCS2")"


3 "OK"





RECEIVED frametype 0x00/length 0x40/64


41A54T2B+43C53S43C53S3D=3F?0D 0D 0A


2B+43C53S43


AT+CSCS=?...+CSC


53S3A:20 28


(22"47G53S4DM22"2C,22"49I52R41A22"2C S:


("GSM","IRA",


22"3883883553992D-31122"2C,22"55U54T46F2D-38822


"8859-1","UTF-8"


2C,22"55U43C53S32222"29)0D 0A 0D 0A 4FO4BK0D 0A ,


"UCS2")....OK..

- Simply connecting a plug and cable to a mobile phone will write a nibble of data to the phone's memory in order to register the communications path along which data shall pass

C) By use of a communications protocol (direct human intervention) in order to extract and harvest data from a mobile telephone can write and overwrite data (indirect intervention):

- Bluetooth: to pair devices requires an identical code to be loaded by examiner on to the mobile telephone and can overwrite previously stored code

- Some Symbian mobile telephones require an agent to be loaded on to the phone in order for the examiners devices to communicate with the phone and then has to be deleted after examination

- Hex-dumping can require the use of flash boxes to flash clips (code) to flash memory that can overwrite blocks of data containing user data

D) To gain access to a mobile telephone may require the entry (direct human intervention)of security codes -

- Passwords/PINS

- Re-setting Passwords/PINs

E) Examiners using devices to select (direct human intervention) specific data can cause the operating system of a mobile telephone to handle data in a particular way (indirect intervention):

-some smart phones write to files in order to keep track of data and in some instances shift data around to accommodate the "fetch" request for certain data

Essentially the categories and content illustrated above merely sets the stage to highlight what an examiner faces when seeking to conduct data aquisition from a mobile telephone. Plug and play (PnP) devices cannot be used in isolation, that they need supervision (direct human intervention). Direct human intervention, with ot without a device, can have consequences too. Furthermore the mobile telephone under examination can as a consequence react to direct human intervention, as well as indirect intervention.