Metrology - USB part 2

Continuing with the discussion relating to Metrology and Universal Serial Bus (USB) cables.

Metrology - http://trewmte.blogspot.co.uk/2015/05/metrology.html
In the first discussion it raised the observations iso9001 has been mentioned and this standard provides a useful guide on record keeping. In most cases users take for granted that the cable/lead/plug is ok and just swap it out if it is deemed not working? Simple questions:

1) Is there a cable/lead tester on the market?
2) What results can be obtained?
3) How to determine output results?
4) Compare manufacturing guidelines for MTTF and MTBF?
5) Can the results scrutinised be improved?
6) Can a minimum standard be achieved.

Metrology - USB part 1 - http://trewmte.blogspot.co.uk/2015/06/metrology-usb-part-1.html
Later the discussion raised the notion that smartphones, tablets and other devices fitting the description Size-Scaled Digital Technology (SSDT) using USB physical connectivity provides for the simplest of examination DUT illustrations e.g. the combination of three separate entities involved in inter-connection during an examination:

1) DUT (the target device (SSDT) containing suspected evidence
2) The physical medium (USB) to carry the source data to the examination tool
3) The examination tool (ET) used to extract and harvest evidence

And ended with the point that the discussion started out by referring to the physical medium USB to carry the source data from the DUT to the examination tool (ET). The relevance of doing so is that if the examiner eliminates the medium as the cause for failure or corrupted evidence then the logical conundrum that remains, is the DUT at fault, is the ET at fault or are both DUT/ET together faulty?

In order to eliminate the USB cable's involvement in the acquisition process as the source of causing corrupted data or inducing faults into the DUT requires expanding the investigation of what is known about USB tolerances or identified faults.

Mechanical Failures

Types of USB connector left to right (ruler in centimetres): micro-B plug, UC-E6 proprietary (non-USB) plug, mini-B plug, standard-A receptacle (upside down), standard-A plug, standard-B plug

The procedure required to dissect and strip back a USB plug from its cable. In itself, there is nothing special in this task being performed other than for revelation purposes to allow observations of what is happening underneath the main moulded cable covering, due to the fact that the human eye does not possess x-ray vision. This USB cable was chosen as it had visible signs of wear and tear at the USB plug end that connects to the device (DUT) and charging of a DUT was known to be intermittent.

The USB cable was terminated at either end with a mini-B plug and standard-A plug. The photo below shows the mini-B plug end has been dissected and stripped back.

 The standard coloured wiring is expressed as:

Pin 1		VCC (+5 V, red wire)
Pin 2		Data− (white wire)
Pin 3		Data+ (green wire)
Pin 4		Ground (black wire)

It was noticeable from a study of the separate coloured internal wire covers - Green, Red, Black and White ( For a quick reference source refer to https://en.wikipedia.org/wiki/USB. ) - that the Red wire cover was in fact a Pink in colour with deterioration (more brittle, easy to pull off covering) than the other coloured coverings.

Given that the mini-B plug is the end that is connected into the DUT raises concerns as to whether the wear and tear could cause damage to the DUT, too. As the Red(Pink) coloured cover concerns the power V_CC (+5 V, red wire) it is not difficult to speculate the potential for damage or failure and that on the balance of probability (at one of the end of the scale) the quality assurance programme should have identified this as a problem or issue to be addressed, (and at the other end of the scale) that beyond reasonable doubt the quality control processes should have removed this physical medium (USB cable) from the pool of tools/devices that could be used during an examination process.

The sampling rates for conducted Vbus and Vcc etc tests can be deduced from the USB standards. Full USB compliance test equipment maybe expensive for those who are trading as a one-man business. There are some simple test rigs out there which require the use of a digital multimeter and test cables that may offer a lower cost solution worth investigating.

One such rig is USB Tester from Fried Circuits http://friedcircuits.us/docs/usb-tester

Another rig from the same source is USB Tester and Phone Charging http://friedcircuits.us/docs/usb-tester-and-phone-charging/

Inexpensive rigs like these should not be a problem but it is essential to carefully document their use in your QA procedures and their requirement to be calibrated.

There are still numerous matters to discuss that have been identified regarding Metrology and USB, which shall be published shortly. The total sum of these discussion Parts build eventually to an identified set of criteria that examiners may wish to apply for QA purposes to reduce or remove the medium USB as having an adverse impact during data acquisition between a DUT and the ET.

Metrology

I haven't produced breakout web-links to the other forum discussions as this post is only raising a point about Metrology and standardisation in digital forensics.

A recent forum question posted by a PhD student sought ideas for a research area. I suggested the following:

You may wish to consider the process of:

(a) examination of mobile/feature/smart phones, embedded devices etc with respect to
(b) evidential examination aligned to iso17025 et al with specific attention interest and engagement to
(c) Metrology - tools used, processes in place and procedures followed
(d) to determine possible impact on evidential results and outcomes.

There is little published study in this area for digital forensics.

The above suggestion, along with suggestions made by others, produced a second forum thread specifically asking about standardisation in digital forensics testing and referred to my comments in the other forum thread. So I made further observations:

The reason why I mentioned Metrology is to actually see whether it is possible to have a minimum standard. In other words, start small and work in areas where commonality in agreement is high amongst those working in digital forensics.

Even before even writing test scripts or anything else start with e.g. the humble physical leads/cables and terminating plugs. They interface with the test tool and the target device. What forensics requirement should there be for these cables/leads/plugs e.g. VGA, DVI, HDMI, Ethernet etc etc. How many people keep a traceable record of what is being used to acquire evidence in the test lab.

iso9001 has been mentioned and this standard provides a useful guide on record keeping. In most cases user take for granted that the cable/lead/plug is ok and just swap it out if it is deemed not working? Simple questions:

1) Is there a cable/lead tester on the market?
2) What results can be obtained?
3) How to determine output results?
4) Compare manufacturing guidelines for MTTF and MTBF?
5) Can the results scrutinised be improved?
6) Can a minimum standard be achieved.

Mundane and tedious testing is never welcomed, but long before digital forensics raised its head these tests were going on. My own earlier experiences were in telecomms manufacturing. We worked with factory type approval guidelines BABT340 and iso9001. Record keeping and testing of tools was fundamental and mandatory to retain quality. Devices were subjected to standards such as bs6301, bs6305, bs6317, bs6789 etc. I still believe that BABT340 and other standards and guidelines for the manufacturing and supply of telecomms and datacomms products for placing on the marketplace are far more aligned to digital forensics and provide industry-specific stepping stones guidance towards minimum standards because all manufacturers were being channelled through the same process.

Just because some of the examples given by the above standards have been replaced with EU or other standards, doesn't mean to say we cannot learn from those industry-specific experience and adopt a similar system.

From what I see going on and hear from others in digital forensics labs cables/leads/plugs can be a source of problems in the acquisition process yet no common ground has been established for their use. There are ISO framework standards adopted for digital forensic labs, but those have been adopted after the fact of produced evidence. But what are the framework standards or common ground documentation directed towards the tools actually being used prior to acquisition and generation of evidence?