Mobile Forensic Metamodel

Previous studies have mostly discussed mobile forensics only in data acquisition terms and only in a problem solving scenario, as a subset to computer forensics. These studies did not take mobile forensics beyond the paradigm that is known as computer forensics. Additionally, they have not addressed the elements of MF comprehensively, and the previous research in the MF domain did not focus on modeling the case domain information involved in investigations.

This paper develops a Mobile Forensic Metamodel (MFM) in order to clarify all the necessary activities required by investigators for conducting their task. In addition, it creates a unified view of mobile forensic in the form of a metamodel that can be seen as a language for this domain. A metamodeling approach is applied to ensure that the metamodel which is the outcome is complete and consistent.

A metamodel for mobile forensics investigation domain
CLICK TO DOWNLOAD .PDF

Free Mobile JTAG Training and Tools

Visitors to trewmte.blogspot.com may recall a discussion thread posted back in 2012 regarding a JTAG Tutorial http://trewmte.blogspot.co.uk/2012/09/jtag-tutorial.html. The purpose of that thread was to enable students, newcomers and experienced mobile/smart phone examiners to get a feel for JTAG before undertaking such examinations or purchasing tools etc.

Today, Kevin Swartz from www.nowsecure.com has released a FREE three-part training course specifically for JTAGing smart phones. Kevin has dropped a line to me saying "Hi Greg, yes, please feel free to link to any of our free resources pages: https://www.nowsecure.com/resources/".

The FREE three-part training course:

PDF Download: https://www.nowsecure.com/resources/jtag-forensics-training/

JTAG 101 videos:
https://www.youtube.com/playlist?list=PLkotz0CYBQDrXpvO0UZlmrUpQLtegPgWI

JTAG 102 videos:
https://www.youtube.com/playlist?list=PLkotz0CYBQDp_YMS_jMXSjKsvgWtL8e_p

Thanks Kevin. You're a decent chap for your kind gesture to help out students, newcomers and experienced examiners in the community.

JTAG Tutorial

JTAG Tutorial 

Certain mobile phones have no other access capability other than a test interface to allow for debugging and memory analysis capability other than to use JTAG (Joint Test Action Group) standard: IEEE 1149.1 : 1990 Standard Test Access Port and Boundary-Scan Architecture. IEEE 1149.1 : 2001 is available here: http://standards.ieee.org/findstds/standard/1149.1-2001.html   

There are various reading materials available by way of the internet that help an examiner understand the way in which JTAG can be used: 

http://www.corelis.com/education/JTAG_Tutorial.htm

What is JTAG?
Overview of the JTAG architecture and the new technology trends that make using JTAG essential for dramatically reducing development and production costs. The article also describes the various uses of JTAG and the tools available today for supporting JTAG technology.

Additional material: http://en.wikipedia.org/wiki/Joint_Test_Action_Group

Other materials that may interest:

Mobile Phone Chip Off - http://trewmte.blogspot.com/2011/02/mobile-phone-chip-off.html 

Mobile device forensics - http://en.wikipedia.org/wiki/Mobile_device_forensics

JTAG acquisition from Android - http://www.caseite.com/content/jtag-acquisition-android

Is JTAG forensically approved? - http://www.forensicfocus.com/Forums/viewtopic/p=6533275/