Showing posts with label Mobile Forensics. Show all posts
Showing posts with label Mobile Forensics. Show all posts

Sunday, June 18, 2017

Mobile Forensic Metamodel


Previous studies have mostly discussed mobile forensics only in data acquisition terms and only in a problem solving scenario, as a subset to computer forensics. These studies did not take mobile forensics beyond the paradigm that is known as computer forensics. Additionally, they have not addressed the elements of MF comprehensively, and the previous research in the MF domain did not focus on modeling the case domain information involved in investigations.

This paper develops a Mobile Forensic Metamodel (MFM) in order to clarify all the necessary activities required by investigators for conducting their task. In addition, it creates a unified view of mobile forensic in the form of a metamodel that can be seen as a language for this domain. A metamodeling approach is applied to ensure that the metamodel which is the outcome is complete and consistent.

A metamodel for mobile forensics investigation domain
CLICK TO DOWNLOAD .PDF

Tuesday, June 06, 2017

Not Comfortable Fit for Digital Forensics - ISO17025



Within the digital forensics arena there is discomfort amongst labs, academia, businesses and practitioners that ISO/IEC 17025 'General requirements for the competence of testing and calibration laboratories' is not a comfortable fit for digital forensics. Very few digital forensics laboratories and businesses have been accredited so far. To get an understanding of concerns obtained from a pretty good base-data of opinion from replies to UK ISO 17025 Digital Forensics Survey 4/24/2017 created by Professor Peter Sommer, the results have been published and are available here http://goo.gl/KP0HOn .

Not to second guess the Forensic Science Regulator (FSR) there is , of course, the October 2017 deadline looming and the outcomes of that deadline might impact on the way forward. However, I regularly keep an eye on Lab Accreditation and Best Practice Guides (as you can see from some of the pdf tabs open in the above screen shot) in context with digital forensics in order to note the changing approach to digital forensics. The new breeze appears to suggest digital forensics blowing towards ISO standards e.g.

ISO/IEC 27042: 2015. Information Technology - Security Techniques - Guidelines for the Analysis and Interpretation of Digital Evidence.

ISO/IEC 27037: 2012. Information Technology - Security Techniques - Guidelines for Identification, Collection, Acquisition and Preservation of Digital Evidence.

Currently, but this may change, these standards are not substitutes for accreditation. That does not mean though digital forensics may not branch off and have its own unique accreditation and standards. It may well be the British Standards Institute (BSI) may need to produce an equivalent standard for the UK based upon an example of the old BS5750 approach. BS5750 and ISO9000 do enable the UK Government's requirement to be met for "inclusion" of single-person organisations and SMEs to play apart in the economy and not be excluded from it due to globalism or restraint of trade practices or over-burdensome control measures.

Previously, I drew attention to how in the US, Karin Athanas, Program Manager at the American Association for Laboratory Accreditation (A2LA), produced an article titled "Accreditation for the One-Person Organization - The smallest laboratories can teach us the biggest lessons.". This article defined that smaller business entities could achieve accreditation to ISO/IEC17025: http://trewmte.blogspot.co.uk/2016/10/isoiec-1702517020-one-person.html


The UK ISO 17025 Digital Forensics Survey 4/24/2017 isn't the first time attention has been drawn to ISO/IEC17025 that it should works for all, not the few. If the latter accreditation doesn't work then maybe another route will need to be found.


Saturday, October 15, 2016

ISO/IEC 17025/17020 - One-Person Organisation

Having just finished part two of the work study into QA and Laboratory Accreditation MTEB UK SEMINARS 2016 II v03- QA Lab Accreditation.pdf ( http://trewmte.blogspot.co.uk/2016/10/qa-and-laboratory-accreditation.html ) I came across this cracking article by Karin Athanas, Program Manager at the American Association for Laboratory Accreditation (A2LA) titled "Accreditation for the One-Person Organization - The smallest laboratories can teach us the biggest lessons." ( http://forensicfoundations.com/resources/Documents_CLR/2016_10_3_SUMMER.pdf )

Basically Karin's article helps us understand that one, two or three person/s organisation/s should not be put off but can and should apply for ISO/IEC 17020 and 17025 as the requirements are not insurmountable, particularly when it comes to allocation to whom the quality manager's role, audits etc. will be allocated and deemed to be responsible. I also read this to mean that ABs might need to widen their scope to appreciate many roles in a accredited system can be held by one person.

Karin's article is a recommended read.

Sunday, October 09, 2016

QA and Laboratory Accreditation

MTEB UK SEMINARS 2016 II v03- QA Lab Accreditation.pdf
Read more - updated link http://tinyurl.com/zr2oqyp

QA and Laboratory Accreditation. Previously, lab criteria applied to mobile phone forensic testing was randomly applied:

- various industry standards
- public and private approach to best practice
- guidelines/training courses
- Some certified ISO9001, some sought UKAS accreditation.

The introduction of a UK Forensic Science Regulator (FSR), there are now mandated ‘Codes of Practice and Conduct’, standards and accreditation applicable to mobile phone forensic evidence:

- ISO/IEC 17025 e.g. requirements for the competence to carry out tests and calibrations...
- ISO/IEC 17020 e.g. scene of crime and in the field activity
- UKAS Accreditation

The FSR’s strategy moves the goalposts away from simply applying industry best practice and random approaches to a common purpose – provision of forensic science across the criminal justice system is "subject to an appropriate regime of scientific quality standards"

That common purpose approach has been developing for approximately 6 years but only really in the last several years ISO/IEC 17025:2005 has  started to make its mark and the first accreditation to requirements of Forensic Science Regulator’s ‘Codes of Practice and Conduct’ was  2014.

- still early days for the public and private sectors
- very small number of organisations accredited for mobile phone forensic evidence
- it could be said we are all pioneers to new endeavours
- common purpose does not dilute ‘speciality’ distinguishing one organisation from another
- FSR deadlines for public sector forensic science overall 2017-2020
- e.g. Law enforcement mobile phone forensic test laboratory accreditation by Oct 2017
- Lead times of 18-months to implement suggests 2017 deadline could be missed
- ‘devil in the detail’ causing much more work than at first thought

There is increased demand for practical solutions and helpful insights that may assist prepare for accreditation.

Thursday, October 09, 2014

Reverse Engineering For Beginners

Steve Hailey*, who kindly sent out a reminder about Reverse Engineering for Beginners, that this is guide with "Lots of great information that will be especially helpful for reverse engineering malware that you come across in your investigations......" It is  "652 pages, all free. You do not need to give out your personal information or subscribe to anything..."

The original link to get the publication is no longer current. However, a copy can still be downloaded using the following link: http://web.archive.org/ 

*Steve is President/CEO CyberSecurity Institute, a practicing Consultant, Digital Forensic Examiner and works also as an Educator, InfoSec Author & Lecturer

Saturday, February 08, 2014

Smart/Mobile Devices Brand Names Listing

Examiners regularly come into contact with Brand name mobile/smart devices and the list is continuously increasing. The problem that increase creates is that there is no one website that holds a complete list.  The listing below identifies how many Brand names I have managed to harvest at this stage. I shall be updating this listing as I go along and adding useful info that examiners may find of interest.

Number - Smart/Mobile Devices Brand Names Listing

3 Skypephone


A - Smart Devices Brand Names Listing

Acer
Airo Wireless
Alcatel
Allview
Altek
Amoi
Amazon
AnexTEK
AnyCool
AnyDATA
Apple
Asus
Archos
Arnova
AT Mobile
AT&T
AU (KDDI)
Audiovox
Auro
Axia

B - Mobile/Smart Device Brand Name Listing

Barnes And Noble
BBK Mobiles
Bell
Bendix King
Benefon
BenQ
BenQ-Siemens
Bird
BlackBerry
Blu
Bluebird
Blumax
BMW
Bookeen
Bushnell


C - Mobile/Smart Device Brand Name Listing

Cal Comp
Camangi
Canmore
Casio
Cat Mobile
Cect
Celkon
Changhong
Changjiang
Cheacomm
China Mobile
Cingular
Claro
CLIE
Concord
Coolpad
Cowon
CPA
Creative
Cricket
CSL



D - Mobile/Smart Device Brand Name Listing

Daewoo
Dallab
Danger
Dapeng
Dell
Donod
Dopod
Doro
Duet



E - Mobile/Smart Device Brand Name Listing

E-Ten
Enol
Emgeton
EMobile
Emporia
EPhone
Era
Ericsson
Eten
Ever
Everex
Evolve
Eyo


F - Mobile/Smart Device Brand Name Listing

Fifth Media
Firefly Mobile
Fly
Fly-Ying
Fujifilm
Fujitsu-Siemens
Fusion Garage



G - Mobile/Smart Device Brand Name Listing

G-Five
G-Tide
Garmin
Garmin-Asus
General Mobile
Gigabyte
Gionee
GiSTEQ
Global High Tech
GlobalSat
Google
GPS Technologijos
Gresso
Grundig


H - Mobile/Smart Device Brand Name Listing

Haier
Handspring
Helio
Hertz
Hewlett Packard (HP)
Highscreen
Hisense
HKC
Holux
Hop-on
HTC
Huawei
Hyundai (Electronics)


I - Mobile/Smart Device Brand Name Listing

IBM
Icemobile
I-mate
I-MOBILE
Innostream
I-node
I-teq
INQ
Insignia
iPAC
iPro
Iridium
I-teq
IzenMobile


J - Mobile/Smart Device Brand Name Listing

Jaga
JCB
Jincen
Jolla
JVC



K - Mobile/Smart Device Brand Name Listing

Karbonn Mobiles
Kendo
Kinpo
KPN
K-Touch
Kyocera



L - Mobile/Smart Device Brand Name Listing

Lark
Laser
Lava
Lemon Mobiles
Lenovo
Levi's
LG
Limited Label
Linx
Lowrance
Lumigon


M - Mobile/Smart Device Brand Name Listing

Magellan
Manta
Mappy
Maxon
MaxWest
MediaTek
Meizu
MemUp
Micromax
MIO
MiTAC
Mitsubishi
Mivvy
Mobiado
Mobin-Nova
Mobistel
ModeLabs
Modeo
Modu
Motorola
MTK
MTT
MWg
myPhone



N - Mobile/Smart Device Brand Name Listing

NavGear
Navin
Navitech
Navman
NDrive
Nec
Neonode
Newgen
Nexian
Nextar
NG Mobile
Nikon
Niu
No Brand
Nokia
Nordic
NotionInk
Novogo
NTT DoCoMo



O - Mobile/Smart Device Brand Name Listing

O2
Okta
Okwap
Olympus
Oppo
Opticon 
Orange
Orsio


P - Mobile/Smart Device Brand Name Listing

Packard-Bell
Palm
Panasonic
Pantech
Papago
Paragon Wireless
Parla
PCD
Pharos
PC-EPhone
Philips
Philips PDA
Pidion
Plum
Pocket Navigator
Prestigio
Psion
Puma


Q - Mobile/Smart Device Brand Name Listing

Qigi
Qool Labs
QStarz
Qtek
Quanta
Quest



R - Mobile/Smart Device Brand Name Listing

Rand-McNally
Reliance
Rogers
Rover
RoverPC


S - Mobile/Smart Device Brand Name Listing

Sagem
Samsung
SanDisk
Sanyo
Saygus
SciPhone
Sendo
Sewon
SFR 
Sharp
Siemens
SiGMATek
Sigmatel
Sim Valley
SK Telecom
SKY
Skype
Smart GPS
Socket Mobile
SoftBank
Sonim
Sony
SonyEricsson
Soutec
Spice
Sprint
Sunno
SVP
SwissCom
Sylvania


T - Mobile/Smart Device Brand Name Listing

TagHeuer
Takara
Tatung
TDS
TechFaithWireless
Telecom New Zealand
Telit
Tel.Me
Telsda
Telstra
Terrestar
Thuraya
Tiger
T-Mobile
TomTom
Torg
Toshiba
Toshiba PDA
TranSystem
Turkcell



U - Mobile/Smart Device Brand Name Listing

Ubiquam
UBiQUiO
UMX
Unnecto
UTano
UTStarcom


V - Mobile/Smart Device Brand Name Listing

Velocity Mobile
Ventus
Verizon
Verzo
Vertu
VeryKool
Videocon
Viewsonic
Virgin Mobile Lobster
Visor
vivo
Vizio 
VK Mobile
Vodafone
Voxtel


W - Mobile/Smart Device Brand Name Listing

WayWay
Wentto
WND


X - Mobile/Smart Device Brand Name Listing

XCute
Xiaomi
XKSSTEL
Xolo
XPhoneX


Y - Mobile/Smart Device Brand Name Listing

Yezz
Yoo Digital


Z - Mobile/Smart Device Brand Name Listing

Zakang
ZAP
ZEN Mobile
Zonda
ZTE

Saturday, September 28, 2013

MTEB Diploma CSUT2 Partner

 


Diploma for SIM and USIM Technology Examination
Mobile Telephone Diploma Core
Diploma:CSUT2


Partner Support
The Mobile Telephone Examination Board (MTEB) are pleased announce that Quantaq Solutions (http://www.quantaq.com/about.htm) have agreed to be the MTEB Diploma CSUT2 Partner. Quantaq Solutions role is as a "Partner Support". This role entails

- providing trial copies of software
- respond to technical enquiries that a student may require to make

to assist with the student's Diploma.

Moreover, Quantaq Solutions will host an MTEB webpage solely for use by MTEB Diploma Students so that students can have acess to the software and post questions to seek technical assistance.

Quantaq logoMTEB selected to work with Quantaq Solutions as a "Partner Support" because of their existing experience with (U)SIM/smart card examination tools, their range of independent, stand-alone tools to analyse (action commands/receive responses) on SIM/Smartcard and their highly regarded technical knowledge and experience in the fields of:

SIM, smartcards, NFC, RFID, M2M, location, DRM, security, cryptography, Mobile Wallet, technology, innovation, patents, technical design authority, standardisation, proof-of-concepts and software development

Gary Waite

Leading the "Partner Support" on behalf of Quantaq Solutions is Gary Waite. Gary is very well known in the mobile forensics arena for his work on the tools the (U)SIM forensic tools USIM Detective (USIM-D) and USIM Detective Professional (USIM-DP).

His experience and technical background further underpin his credentials of his expertise:
- Founder of Quantaq Solutions
- Past Vice Chair of the Smart Card Group GSM Association
- Test software supplier to Global Certification Forum (GCF) Field Trial Guidelines
- Authored the original ETSI GSM 11.17 standard. This standard formalised the core test processes and procedures for SIM Cards and remains at the heart of (U)SIM testing, programming and examination today.
- First to introduce recording in CUST File (EF) a particular handset's IMEI on SIM Card, which is important, evidentially
- Employed as Technology Manager for the last 11 years with a well know international Mobile Network Operator
- Skilled in C/C++/Java
- Holds a Degree from the University of Abertay Dundee - Electrical & Electronic Engineering, Electronic Engineering

Diploma:CSUT2
Free trial access to the following tools will be made available to Diploma Students. 

USIMdetective - http://www.quantaq.com/usimdetective.htm
USIMexplorer - http://www.quantaq.com/usimexplorer.htm
USIMexplorer - http://www.quantaq.com/usimcommander.htm
USIMprofiler - http://www.quantaq.com/usimprofiler.htm

Diploma for SIM and USIM Technology Examination
Mobile Telephone Diploma Core
Diploma:CSUT2


The latest MTEB Diploma Modules Guide is MTEdipl 2.2 can be downloaded here:
https://dl.dropboxusercontent.com/u/84491783/MTEdipl%202.2.pdf



MTEB Diploma CSUT2 Partner

 


Diploma for SIM and USIM Technology Examination
Mobile Telephone Diploma Core
Diploma:CSUT2


Partner Support
The Mobile Telephone Examination Board (MTEB) are pleased announce that Quantaq Solutions (http://www.quantaq.com/about.htm) have agreed to be the MTEB Diploma CSUT2 Partner. Quantaq Solutions role is as a "Partner Support". This role entails

- providing trial copies of software
- respond to technical enquiries that a student may require to make

to assist with the student's Diploma.

Moreover, Quantaq Solutions will host an MTEB webpage solely for use by MTEB Diploma Students so that students can have acess to the software and post questions to seek technical assistance.

Quantaq logoMTEB selected to work with Quantaq Solutions as a "Partner Support" because of their existing experience with (U)SIM/smart card examination tools, their range of independent, stand-alone tools to analyse (action commands/receive responses) on SIM/Smartcard and their highly regarded technical knowledge and experience in the fields of:

SIM, smartcards, NFC, RFID, M2M, location, DRM, security, cryptography, Mobile Wallet, technology, innovation, patents, technical design authority, standardisation, proof-of-concepts and software development

Gary Waite

Leading the "Partner Support" on behalf of Quantaq Solutions is Gary Waite. Gary is very well known in the mobile forensics arena for his work on the tools the (U)SIM forensic tools USIM Detective (USIM-D) and USIM Detective Professional (USIM-DP).

His experience and technical background further underpin his credentials of his expertise:
- Founder of Quantaq Solutions
- Past Vice Chair of the Smart Card Group GSM Association
- Test software supplier to Global Certification Forum (GCF) Field Trial Guidelines
- Authored the original ETSI GSM 11.17 standard. This standard formalised the core test processes and procedures for SIM Cards and remains at the heart of (U)SIM testing, programming and examination today.
- First to introduce recording in CUST File (EF) a particular handset's IMEI on SIM Card, which is important, evidentially
- Employed as Technology Manager for the last 11 years with a well know international Mobile Network Operator
- Skilled in C/C++/Java
- Holds a Degree from the University of Abertay Dundee - Electrical & Electronic Engineering, Electronic Engineering

Diploma:CSUT2
Free trial access to the following tools will be made available to Diploma Students. 

USIMdetective - http://www.quantaq.com/usimdetective.htm
USIMexplorer - http://www.quantaq.com/usimexplorer.htm
USIMexplorer - http://www.quantaq.com/usimcommander.htm
USIMprofiler - http://www.quantaq.com/usimprofiler.htm

Diploma for SIM and USIM Technology Examination
Mobile Telephone Diploma Core
Diploma:CSUT2


The latest MTEB Diploma Modules Guide is MTEdipl 2.2 can be downloaded here:
https://dl.dropboxusercontent.com/u/84491783/MTEdipl%202.2.pdf



Friday, August 30, 2013

Lawful Interception - Cloud/Virtual Services

Lawful Interception - Cloud/Virtual Services

As more and more people move to mobile/wireless devices to access virtual services so mobile forensics is having to expand its boundaries too in order to cope with cloud/virtual servcies. Many people misunderstand mobile forensics and see its role limited to arguments on good practice and methodology (extract and harvest data from mobile/smart phones). This narrow view is completely wrong but has arisen as mobile forensics is being labelled in some quarters as a sub-category of e.g. computer forensics in criminal proceeding. However, mobile forensics encompasses a wide area and on principals of science fact that computer forensics can operate:

- criminal investigation
- civil investigation
- contract and commerical ventures
- consultancy
- education
- public services/national security     

In civil cases there is the investigation process, for example, of requiring examination of the mobile/smart phone as the conduit between confidential information being jettisoned to a secret file in the Cloud, because there is no trail of bread crumb data evidence on the PC/laptop. Radio signals are not part of computer forensics, unless we all ursurp the laws of physics and rename, for instance, radio signals as computer signals just to be able to lock mobile forensics to computer forensics; it would be just absurd. The investigatory elements requires knowing whether the device is capable of working with HSPA etc as opposed to suggesting full blown data streaming occurs on basic GSM transmission technology. In other words the investigator must be realistic in his/her approach. That equally means understand cell site analysis so that the investigator knowns to understand the advantages of, for instance, MIMO in the wireless arena and the base station set up for that purpose.

Mobile Cloud usage is on the increase and therefore public servcies/national security will equally require to understand any loopholes that exist. Mobile forensics provided for consultancy or in education again requires obtaining facts and understanding processes and procedures as indeed does contract and commercial ventures that require accuracy in description and terms for technology usage.  

It is upon that basis this blog discussion introduces Lawful Interception - Cloud/Virtual Services so that whilst law enforcement and national security would seem the obvious target audience, it doesn't take that much effort to realise how all the other categories in which mobile forensics operates equally benefit from knowing the subject matter.

I am not able to provide masses of info or say too much on this issue but I thought trewmte blog readers might be interested in several informative documents about the subject matter. You may even appreciate the irony of making the downloads for these documents via Dropbox.

----------------

As a primer this is a very helpful document:

ETSI TR 102 997 V1.1.1 (2010-04)
Initial analysis of standardization requirements for Cloud services

The present document describes standardisation requirements for cloud services. It is based on the outcome of the ETSI TC GRID Workshop, "Grids, Clouds and Service Infrastructures", 2 and 3 December 2009. This event brought together key stakeholders of the grid, cloud and telecommunication domains to review state of the art and current trends. Needs for standardisation, with a particular focus on the emerging area of cloud computing and services, were discussed. The present document introduces and expands on the conclusions reached. This is not an exhaustive survey and is intended to serve as the basis for future work.

https://www.dropbox.com/s/nt095ho1jkbxjt9/tr_102997v010101p.pdf

---------------------------------

A useful guide to the mechanisms needed to enable eWarrants to function in the global marketplace.

ETSI TR 103 690 V1.1.1 (2012-02) Lawful Interception (LI); eWarrant Interface

The present document presents a high-level description of an interface mechanism - the eWarrant Interface - for receipt of requests for measures producing real-time or stored information by an issuing authority possessing lawful authorization to initiate such a request. The eWarrant Interface is a generic, extensible interface intended to be fully compatible with all existing kinds of requests for these purposes - as well as support future ones, including local
requirements and languages or character sets. The eWarrant Interface is not intended to replace existing implementation-specific mechanisms found, for example, in the Retained Data Handover Interface.

The present document describes an electronic interface. Annex B describes work flow for an eWarrant in different jurisdictions and a means for discovering related information. Annex C describes how this interface may be adapted and made interoperable for manual and legacy techniques. The present document provides a high-level description of the interface mechanism. It defines basic principles of interoperability, and provides recommendations for the types of data that are delivered. It provides a recommendation on the choice of data modelling languages, but the present document does not give a normative structure for the delivery of eWarrant messages. It is envisaged that a later Technical Specification will add the required details for a full implementation.

https://www.dropbox.com/s/16csgxf3ut33c1w/tr_103690v010101p.pdf

----------------------------------

Here is the draft standard being worked on that will eventually be the agreed standardised approach to interception for Cloud and Virtual Services that occurs trans-border.

Draft ETSI DTR 101 567 V0.1.0 (2012-05) Lawful Interception (LI); Cloud/Virtual Services (CLI)
The present document provides an overview on requests for handover and delivery of real-time information associated with cloud/virtual services. The report identifies Lawful Interception needs and requirements in the converged cloud/virtual service environment, the challenges and obstacles of complying with those requirements, what implementations can be achieved under existing ETSI LI standards, and what new work may be required to achieve needed Lawful Interception capabilities. Cloud Services in whichever forms they take (Infrastructure, Software, Platform or combinations of these) are often trans border in nature and the information required to maintain Lawful Interception (LI) capability or sufficient coverage for LI support may vary in different countries, or within platforms of different security assurance levels. This work aims to ensure capabilities can be maintained while allowing business to utilise the advantages and innovations of Cloud Services and was undertaken cooperatively with relevant cloud security technical bodies.

https://www.dropbox.com/s/0knuausa0h1wupq/tr_101567v010101p.pdf

Thursday, August 29, 2013

Mobile Forensics Diplomas

Following on from the article Forensic Erosion ( http://trewmte.blogspot.co.uk/2013/07/forensic-erosion.html ) the MTEB Diplomas fill the gap between a time limited (expiration) certificate and a Degree course. You may not have seen it but I did produce six MTEB Diploma options and posted it here - http://trewmte.blogspot.co.uk/2010/05/diplomas-mobile-telephone-evidence.html . Moreover, it could help Universities focus their approach to producing Mobile Forensics Degrees with applicants holding a Diploma using it for credits towards the Degree.

The excellent feature of a possessing a Diploma is that it continues to have a value as representation of a person's knowledge, skills and experience similar to a BSc/MSc/PhD. Certificates (e.g. product training certificates) are useful but unless you purchase training year in year out for that same product, which the product can undergo regular changes, waving a five or ten year old certificate may be considered as to its relevance to the evidence or work of a person has been involved.

When a Diploma is undertaken it enables the student to demonstrate current knowledge, skills and experience whilst defining future objectives such as processes and procedures desired to be achieved or occurring in the current marketplace.

A Diploma does not require the student to develop a "new" or "unique" design, process or proposition previously undiscovered (unlike BSc, MSc or PhD trial and error) but demonstration of the student's existing knowledge and how to deploy those skillsets and experience with what works and only express where the subject sees marketplace events or targets to be achieved.

Diplomas are considerably less expensive than BSc, MSc and PhD as they are of a shorter study/submission period, thus present current knowledge, skills and experience to be known sooner and recognised (put to work) in current markets, without limitation of an expiration date associated with a product Certificate at one end of the scale or outdated by the time final semester (BSc/MSc/PhD) is achieved at the other end of the scale.

A Diploma module e.g. * Diploma for ME and UE Technology Examination - Mobile Telephone Diploma Core CMSU3 - enables a candidate to consider mobile/smart phone examination as a specific subject or consider the ME/UE in connection with/to:

* Foundation/Research Skills and/or
* QA and Evidence Handling and/or
* association with SIM and USIM Technology Examination and/or
* Call Records and Network Records Analysis and/or
* Cell Site Analysis

Thus permutation options for submission of a Diploma report may include the expression of ME and UE Technology Examination in isolation or include one or more of the above subjects.

The latest MTEB Diploma Modules Guide is MTEdipl 2.2 ( https://dl.dropboxusercontent.com/u/84491783/MTEdipl%202.2.pdf )

Sunday, July 28, 2013

Forensic Erosion

The BBC website identifies a report by MPs that presents findings that many see as the chaotic forensic landscape in Britain today: http://www.bbc.co.uk/news/science-environment-23436303.

But there are other issues needing to be addressed, too.

Marketplace
In some ways the situation reminds me when I responded back in 2005, along with many others I should add, to a public consultation document on legal aid and engagement of consultants and experts in the UK. There is only so much that one can put into a document with the natural expectation that further questions would be asked of the author about its content in order to undestand the minutiae operating behind any opinion or solutions put forward. The solution I put forward was to remodel and reduce or remove regional distortion with respect to the expert fees and the forensics landscape.


Specific Skillset Education (SSE)
As many of you will know I have never pretended to come from an academic background, and despite many attempts by some to insult me due to their own fears that non-academics can know considerably more, I took their hostile approach and made positive of their negative approach by calling for academic qualifications in the area of forensics with which I am concerned - http://trewmte.blogspot.co.uk/2009/01/mobile-forensics-and-evidence-degrees.html. Germane and relevant then why, with the explosive growth and use of mobile communications, after four years there still no standalone academic qualifications in mobile forensics and evidence? There are some academic forensics courses that placed this important area into one-off mini-module to another degree course but it has been and still is plainly obvious that could never meet the standard automatically expected from proper academic skillsets qualifications that were and are needed. The current situation raises the notion that a person need not be academically qualified to intellectualise this subject, but would still require huge knowledge, skillsets and experience to get through. However, concerns about ready-made tools have given rise to what the professional community has called and is calling 'push button forensics' ( http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4906 ) that implants the notion qualifications are not necessary. Alternatively, it is also noted Universities simply may not possess the knowledge, skillsets and experience to impart what is needed to students. What is needed is specific skillset education (SSE) to avoid jack of all trades, master of none.

Possible Solution
Perhaps the House of Commons Science and Technology Committee could look at giving support to people (like me and others) and allow us together with Parliament to create qualifications directly linked to a Prize Degree coming from the House of Commons Science and Technology Committee enabling citizens of this country to re-connect with Parliament. This would create a cushion. In other words, people want more out of Parliament and not just to feel but actually enjoy the experience Parliament serves all areas. Having a Parliamentary Commitee qualification can help do that.

Of course, my observations maybe seen as a novel idea but it would actually fill the gaps being left open by Universities that are unable to deal with a fast changing society and technology revolution and where people with long term knowledge, skill and experience are not working as University lecturers.         





Sunday, February 17, 2013

Cyber Wrapping

Susan Brenner has had published her article 'Cyber-threats and the Limits of Bureaucratic Control' published in MINN. J. L. SCI. & TECH. [Vol. 14:1] and downloadable from the link below. Susan's brief synopsis is available here: http://cyb3rcrim3.blogspot.co.uk/2013/02/fyi-maybe-new-article-on-cyberthreats.html. A further link to material for review is here: University of Minnesota http://conservancy.umn.edu/handle/144222.

This is a very useful and informative article from Susan and sets out challenges about understanding the impact of 'cyber-' and how a "State" copes with control of such threats.

The marketplace is burgeoning with 'cyber courses' e.g. with content such as: "cyber attack and defense, digital analysis, computer forensics, security policies and strategies, risk analysis, ethical and legal issues, operational processes, cyber crime, and more" (http://www.excelsior.edu/web/news/college-news/-/blogs/five-cybersecurity-programs-certified-to-meet-the-nsa%E2%80%99s-committee-on-national-security-systems-cnss-training-standards) which appears to suggest cyber people have been unable to distinguish cyber as a platform of its own without subsuming e.g. computer forensics and therefore dismantling this job title and work in an attempt to top it.

My original thinking when getting to grips to understand what the cyber-people wanted to show when the approach started back in 2000 was that, irrespective of the technology, it is the fundamental messages/signals, instructions or information included and transmitted through electrical impulses, analogue/digital signalling and so on would complement existing investigatory, examination and forensics programmes and employment and tools. Instead, cyber appears to want to cast a veil over all of these mature approaches to make everything science/technology neutral and claim they are subsets of cyber.

Fundamentally, cyber is a subset to all forms of communication mediums, transmitters and receivers and the technology that interprets communications and signalling. Moreoever cyber-attack/crime/etc is a 50/50 proposition and a subset of "intention" (pragmatically and legally) and must be judged in that context when compared to a "mistake" where the person had no intention to generate an attack but an unwanted outcome occurs anyway.

Download: http://conservancy.umn.edu/bitstream/144222/1/Cyber-Threats-by-Susan-Brenner-MN-Journal-Law-Science-Tech-Issue-14-1.pdf

Tuesday, September 20, 2011

7.5 trillion mobile communications

7.5 trillion mobile communications

My recent post discussed mobile growth areas, as many have at this blog (just search past posts) and highlights the current European trend with smart-phones. A recognition of the British localised trends in the mobile marketplace can be read about here: UK_CMR_2011_FINAL.pdf

A news article about an Ovum report suggests the quantity of mobile -calls -texts -images and video messages will reach 7.5 trillion this year.  Moreover, it is reported:  "In a new forecast, the independent telecoms analyst also predicts that the market will generate revenues of $153 billion this year, up 8% on last year’s performance."

From analysis of a number of cross-market conditions by various market analysts these indicators provide useful coordinates about the future of mobile forensics and evidence. It is very positive, but there is a natural consequence of that success; adjustments will need to be made. Those trends cannot help but bring change and imply there will be a need for transformation from the current investigatory set up and a shake up of the stoggy and bloated surface-level superficiality stifling and damaging the approrpriate structural processes inherent in the mobile forensics and evidence tree, perhaps illustrated by the way in which honey-fungus of the genus Armillaria variety eats at the very core of a tree.

Saturday, July 23, 2011

Mobile Markets: Nokia 'Mobile Man'...it tells of a story

Mobile Markets: Nokia 'Mobile Man'...it tells of a story

This excellent construction, made up entirely of mobile phones, is Nokia's collaborative project with Beijing postal service to encourage recycling of mobile phones that can be handed in at post offices, according to the news article at news.cnet.com.   


It's great to see projects like, which tend to draw promotions using creative and talented ideas demonstrating the evolving and transforming world of mobile phones and its market places. Back in 2007 I posted on another creative work cellphone-transformer, which, yet again, shows a design that captures the imagination displaying the versatile uses to which a mobile phone might be put.

The business and ecomonic philosophy that resides behind these creative images equally tells of a story of growth and success. If recycling is happening then, perhaps, that is as a likely consequence of mobile ubiquity taking hold. That is a nice statement, but can I back it up?  I don't have my finger on every financial and market research pulse, but, apart from anecdotal references, there are various stats out there from the market research firms. Indeed, back in 2008 I blogged (staggering-figures-for-mobile-phone) on the state of the mobile data market when the economic downturn (which appears to have started in 2007 so we are led to believe) had got a firmer grip on global markets. In 2010 the stats still showed extraordinary figures (text.it), although the exact detail where all this activity occurs to generate such figures may not be obvious. It may be compelling to want to know how many consumers send text and mms messages (see OFCOM website for stats), but that is not the full picture. There are the other data markets in business to consider, such as the M2M market place (winwin) and comments by industry pundits on the mobile payments market (cellular-news).

It is useful to see how industry people collate information and bring amassed facts together in order to express their views and vision on what all the facts mean to them in aggregrate. An example of this can be seen in Tomi Ahonen's enthusiastic commentary found in Insiders Guide To Mobile (lulu) with references to trillion dollar market, over 4 billion users and the segmented factors when drawn together identified to him what is forecast for mobile. A view of one segment of the mobile phone market, apps, is simply a further illustration of information to be sourced to underpin market trends (windows-phone-apps-reach-new-market), another is sales and market penetration, such as Apple's iPhone outrageously outstanding sales growth.

If I removed from the context of the above commentary discussion about modern technology, and simply focussed on what an image might communicate, I could have been talking about social, cultural and economic life that might have been depicted by way of an 18th/19th century painting (irrespective of whether the painting is by an impressionist or not). Whilst the image above may not be an old master piece, the image still has a story to explicitly convey and that, in forensic terms, requires understanding all or part of any implicit subtext the image can also communicate.

My forensic skills, acquired over the years, meant that my reaction to seeing this image (even though photo/art imagery is not my subject), was to look at it as evidence and then set out to see what I could deduce from there. In reality we do this everyday in our work. We see a SIM card. We then want to know what it is and what is inside. In order to know what we are dealing with we need to know how it works and what can be held inside and whether all or part thereof can be revealed. Moreover, we need to know what amounts to 'conformance' and within that framework which conforming element is 'mandatory' and which is 'optional'. Once we have that background we can then begin to understand what is 'non-conforming' and/or 'unusual'. This path can equally be taken when dealing with mobile phones and RF investigations.

In conclusion, the subtext of this discussion can be revealed. However mobile phones maybe presented to the world, it is our job in forensics not to change that messsage, but to break down the presentation into its various building block elements in order that we know how each piece works and then how the pieces fit together and work and cooperate together.  This is because a true forensic standard requires of the individual to obtain knowledge by way of commentary, appropriate training, standards, specs and investigation, that includes examination and testing (trial and error), which is one side of the coin. The other side of this coin is knowing what the 'thing' in its final state is intended to do, which requiries understanding of the market place it which the 'thing' is to be adopted.  Using skills and techniques like these provide for a rich source of experience, too. Essentially, learning to bring all the pieces that are needed into play and being able to demonstrate that identifies the forensic examiner working with a well hone, self-principled approach of high standard.

For MTEB students, the summer recess is now here. Sure, have a great time and relax and enjoy the break, but don't waste valuable time. Great people strive in life because they want to go beyond what has already been achieved. Take time out from relaxing to bring together the exposure you have had to mobile knowledge and experience you have acquired, thus far. Select a particular line of investigative enquiry and see how far you get with it. I have identified some links above to illustrate a way forward or choose a different subject matter; remember to be able to demonstrate the primary basics of 'bush' methodology.

Sunday, July 03, 2011

HTML5: holds a future for and after other mobile apps

HTML5: holds a future for and after other mobile apps

I have just written about mobile apps and forensics (windows-phone-apps-reach-new-market) because it is here and now and requires attention. An aspect of Forensics though is equally not being blinked to future trends. The question of future trends was asked by the House of Commons Science and Technology Committee in their recent report cmselect 855. It is really worth the time and effort to download and read this report.

HTML5 is a future trend and one that has already started to take hold. As nebusiness's The Journal pointed out (http://www.nebusiness.co.utechnology-leap-set-to-make-apps-redundant) "HTML5 builds on the technology of the existing internet but, as every web user knows, if you lose your connection, you lose your work. With HTML5 you don’t – you can go from connected to disconnected and never notice: files can be saved locally and remotely when needed, just like normal apps. Quietly, we’re starting to see more HTML5 apps, like that of the FT, which work on all devices. The FT app is amazing. Try it out. It’s all in HTML5 and as good as, if not better, than a native iPhone app."

With HTML5 there is a sense that forensics might see improvement in interpreting data that could be properly rendered for viewing; currently this can require other apps to assist that process. Moreover, vast quantities of unintelligible random code and data which could not be rendered by handsets can be found during physical dumps that no one really makes sense to identify what it is. Were unravelling and decoding of random code/data to be explained in itself it still might not explicitly or implicity confirm whether the handset user could see/access rendered versions of that code and data on the handset screen or select content by using the handset UI. HTML5 may yet assist in solving some of these issues, so is it a future trend forensic practitioners should be aware?

Well, I think it is something that cannot be excluded largely due to the fact it is at present being used, mobile browsers are making use of it and widely used mobile handsets support or portions of it in e.g. Apple's iOS 4.2, Android, Samsung, Nokia and so on.

So what can HTML5 do for mobile web browsing?
Well, it helps standardise those issues which had previously been problematical to mobile web browsing and, for mobile web developers, to get testable, cross-platform and standards-based interface for developing content that, prior to HTML5, required _fit_the_need_of_the_technology_ methods or proprietory APIs to achieve the level of rendering needed for rich content and browsing.

HTML5 and Forensics
It opens up the door for new or improved evidence. Do remember, particularly for those readers not involved with forensics, evidence doesn't necessarily mean recovered data that is detrimental or that some massive spying operation is in progress. Mobile HTML5 could have benefits to assist retain data that could help resolve a dispute, track a missing person and so on. Location awareness, localised data caching when mobile connectivity is lost and a range of other features that I shall be discussing later on.

What is possible to say at this stage, omitted data previously breaking the chain of causation needed for forensic evaluation may well be greatly assisted by HMTL5 but without a forensic examiner having to put, metaphorically speaking, all his/her sought artefact-eggs into one evidential-methodology basket. Nice !

Tuesday, November 16, 2010

iPhone - Evidence Handset Reader Tools

iPhone - Evidence Handset Reader Tools

Two questions:

1) How many 'evidence' handset reader tools can you name off the top of your head?
2) And how many of those tools extract and harvest data from iPhones?

In answer to question one we know we can at least identify thirteen (13) tools and the answer to question two is also at least thirteen (13) tools. The answers can be found in 'iPhone Forensics White Paper' published by viaForensics. The authors of the document are Andrew Hoog and Katie Strzempka.

The number of tools now available and sold into the marketplace is a bit of surprise because in most cases a large portion of the forensic community do not own one copy of each of these tools as it is not strictly necessary. It is quite useful, though, to see a report like this that brings together at least 13 tools so that there is a record of the existent of these tools and how they are viewed in relation to their usefulness.

What I like about this report is that it is produced entirely independent of any of the handset reader software manufacturers and the authors/publishers were not compensated in any way for the work and effort that went to researching and testing each tool.  I should also point out that I am not being compensated in anyway either for mentioning the researchers/publishers or this White Paper.

I wont spoil the fun for you of reproducing the findings and results recorded in the White Paper, but you can read about them for yourself at the weblink below:

http://viaforensics.com/education/white-papers/iphone-forensics/

Saturday, July 31, 2010

Deleted messages uncovers fake rape claim

Deleted messages uncovers fake rape claim

Having specialised in the UK for many years dealing with deleted data and having published many papers on 'deleted content', 'deleted text messages', 'deleted data mobiles' and 'deleted data may not amount to possession' when this subject raises its head it is worth making a record of it for later discussion.

There are many aspects about deleted data that require to be considered in detail before making an allegation (Prosecution/Defence, Plaintiff/Respondent etc) and simply finding deleted data and saying well it is here let's use it is not always a good idea.

The details of an Australian criminal case reported recently involving recovered deleted data showed the content of a text message imported an entirely different context about an allegation of rape.

------------------------------------------------------------
Rape charges dropped after deleted messages recovered from iPhone

A MAN'S business and reputation are tainted, a young woman's HSC and mental health are in tatters and prosecutors have been ordered to pay more than $30,000 in legal costs for a bungled rape investigation on Sydney's northern beaches.

http://www.smh.com.au/digital-life/mobiles/rape-charges-dropped-after-deleted-messages-recovered--from-iphone-20100727-10ueq.html
------------------------------------------------------------

This case shows an example where deleted data can be effective. Past cases I dealt with are illustrative of what can be found in deleted data such as a daughter who accused her father of rape when in fact she didn't want to admit to having sexual relations with a boyfriend her parents knew nothing about. Or the case of a man's body that was found where a family stated they had never visited them, only to find a deleted photo of the man in their living room.

For further information about deleted data contact:
trewmte@gmail.com

Tuesday, July 27, 2010

Mobile Telephone Evidence (MTE) VOL7 MTE02 2010

Mobile Telephone Evidence (MTE) VOL7 MTE02 2010
.
- Market Trends
.
- Self Destructing SMS Message
.
- Mobile Antenna Forensics (MAF)
.
- Historical Abstracts for GSM Cell Site Analysis©
.
- Product News
.
- Latest News US iPhone Jailbreaking Ruling
.
Now in its seven year MTE Newsletter latest edition is now available for download:
.
http://www.4shared.com/document/q0Nm6UMP/MTE_VOL7__MTE02_2010.html
.
Cell Site Analysis Fundamental:
http://www.4shared.com/document/7AjcSbww/MTEB_CSAF_Booking_Form.html
.
MTEB Forensic Student Conference for Wireless......
http://www.4shared.com/document/oeE-mCp-/MTEB_Student_bookingform.html

Thursday, July 08, 2010

5-Billion Mobile Subscriptions forecast by Q4-2010

Mobile market forecasts all predict the heavily reliance on GSM/3G/LTE and Mobile WiMax etc over the next 15 years. This is something I have been predicting for the last 10 years. Naturally, mobile forensics will need to play its part and hence the reason for the MTEB educational programme for students and experienced individuals.

Worldwide Mobile Subscriptions Forecast To Exceed Five Billion By 4Q-2010

Singapore -- ABI Research forecasts over five billion mobile subscriptions by the end of 2010, with an approximate 4.8 billion connections having been reached by the end of the year's first quarter. Much of this growth will be registered in developing markets in Africa and the Asia-Pacific region.

Africa remains the fastest growing mobile market with a YoY growth of over 22%. Mobile penetration in Asia-Pacific will rise significantly to 65% by the end of 2010. "This unprecedented growth is driven by India and Indonesia, which have together added over 150 million subscriptions in the past four quarters," comments ABI Research analyst Bhavya Khanna. "Falling monthly tariffs and ultra-low-cost mobile handsets have democratised the reach and use of the mobile phone, and aggressive rollouts by mobile operators in these countries will see the current rate of subscriber addition maintained for some time to come."

At the other end of the spectrum, developed countries in North America and Europe continue to add subscriptions despite already having crossed the 100% penetration threshold. Driving this growth in subscriptions are new mobile devices and the ‘third screen' - including netbooks, tablet computers, USB dongles and e-book readers. "The success of Apple's iPad 3G shows that even operators in saturated markets can add subscriptions by introducing innovative and user-friendly devices," says vice president of forecasting Jake Saunders.

In addition, the introduction of 4G data networks such as WiMAX and LTE will see more consumers ditch their cables and access the Internet through mobile broadband connections. Operators such as Clearwire in the United States and Yota in Russia have seen consumers turn to their networks as fast and mobile alternatives to fixed-line broadband.

For more information visit www.abiresearch.com.

SOURCE: ABI Research

5-Billion Mobile Subscriptions forecast by Q4-2010

Mobile market forecasts all predict the heavily reliance on GSM/3G/LTE and Mobile WiMax etc over the next 15 years. This is something I have been predicting for the last 10 years. Naturally, mobile forensics will need to play its part and hence the reason for the MTEB educational programme for students and experienced individuals.

Worldwide Mobile Subscriptions Forecast To Exceed Five Billion By 4Q-2010

Singapore -- ABI Research forecasts over five billion mobile subscriptions by the end of 2010, with an approximate 4.8 billion connections having been reached by the end of the year's first quarter. Much of this growth will be registered in developing markets in Africa and the Asia-Pacific region.

Africa remains the fastest growing mobile market with a YoY growth of over 22%. Mobile penetration in Asia-Pacific will rise significantly to 65% by the end of 2010. "This unprecedented growth is driven by India and Indonesia, which have together added over 150 million subscriptions in the past four quarters," comments ABI Research analyst Bhavya Khanna. "Falling monthly tariffs and ultra-low-cost mobile handsets have democratised the reach and use of the mobile phone, and aggressive rollouts by mobile operators in these countries will see the current rate of subscriber addition maintained for some time to come."

At the other end of the spectrum, developed countries in North America and Europe continue to add subscriptions despite already having crossed the 100% penetration threshold. Driving this growth in subscriptions are new mobile devices and the ‘third screen' - including netbooks, tablet computers, USB dongles and e-book readers. "The success of Apple's iPad 3G shows that even operators in saturated markets can add subscriptions by introducing innovative and user-friendly devices," says vice president of forecasting Jake Saunders.

In addition, the introduction of 4G data networks such as WiMAX and LTE will see more consumers ditch their cables and access the Internet through mobile broadband connections. Operators such as Clearwire in the United States and Yota in Russia have seen consumers turn to their networks as fast and mobile alternatives to fixed-line broadband.

For more information visit www.abiresearch.com.

SOURCE: ABI Research