Forensic Triage for Mobile Phones with DEC0DE Robert J. Walls Erik - PowerPoint PPT Presentation

Forensic Triage for Mobile Phones with DEC0DE Robert J. Walls Erik Learned-Miller Brian Neil Levine Department of Computer Science University of Massachusetts Amherst This work was supported in part by NSF award DUE-0830876. rjwalls@cs.umass.edu forensics.umass.edu

rjwalls@cs.umass.edu 2 forensics.umass.edu

Evidence e c n e d i v E e c n e d i v E rjwalls@cs.umass.edu 2 forensics.umass.edu

Forensic Triage: Acquire evidence quickly , accurately , and on-scene . rjwalls@cs.umass.edu 3 forensics.umass.edu

Forensic Triage: Acquire evidence quickly , accurately , and on-scene . > Done before a full examination rjwalls@cs.umass.edu 3 forensics.umass.edu

DEC0DE: Forensic Triage for Phones DEC0DE rjwalls@cs.umass.edu 4 forensics.umass.edu

Why phones ? rjwalls@cs.umass.edu 5 forensics.umass.edu

Phones record our lives . rjwalls@cs.umass.edu 7 forensics.umass.edu

Phones contain evidence . rjwalls@cs.umass.edu 8 forensics.umass.edu

Proprietary OS + Little Documentation = Unknown Formats rjwalls@cs.umass.edu 10 forensics.umass.edu

Triage options now ? rjwalls@cs.umass.edu 11 forensics.umass.edu

Option 1: Browsing Option 2: Commercial tools rjwalls@cs.umass.edu 12 forensics.umass.edu

Option 1: Browsing Drawbacks rjwalls@cs.umass.edu 13 forensics.umass.edu

Option 1: Browsing Drawbacks > May not be possible rjwalls@cs.umass.edu 13 forensics.umass.edu

Option 1: Browsing Drawbacks > May not be possible > Modifies the phone rjwalls@cs.umass.edu 13 forensics.umass.edu

Option 1: Browsing Drawbacks > May not be possible > Modifies the phone > Misses important information rjwalls@cs.umass.edu 13 forensics.umass.edu

Option 2: Commercial Tools Drawbacks rjwalls@cs.umass.edu 14 forensics.umass.edu

Option 2: Commercial Tools Drawbacks > Cost Prohibitive rjwalls@cs.umass.edu 14 forensics.umass.edu

Option 2: Commercial Tools Drawbacks > Cost Prohibitive > Does not support all phones rjwalls@cs.umass.edu 14 forensics.umass.edu

Option 2: Commercial Tools Drawbacks > Cost Prohibitive > Does not support all phones > Still misses important information! rjwalls@cs.umass.edu 14 forensics.umass.edu

Option 3: DEC0DE rjwalls@cs.umass.edu 15 forensics.umass.edu

Option 3: DEC0DE Advantages rjwalls@cs.umass.edu 16 forensics.umass.edu

Option 3: DEC0DE Advantages > Extracts information directly from storage rjwalls@cs.umass.edu 16 forensics.umass.edu

Option 3: DEC0DE Advantages > Extracts information directly from storage > File system and OS agnostic rjwalls@cs.umass.edu 16 forensics.umass.edu

Option 3: DEC0DE Advantages > Extracts information directly from storage > File system and OS agnostic > Quick ( < 20 minutes ) rjwalls@cs.umass.edu 16 forensics.umass.edu

Raw Storage DEC0DE Block Hash Filtering Inference Records rjwalls@cs.umass.edu 22 forensics.umass.edu

Raw Storage DEC0DE Component 1: Block Hash Filtering Block Hash Filtering Inference Records Process: > Divide storage into blocks > Compare block hash to library > Filter duplicates rjwalls@cs.umass.edu 23 forensics.umass.edu

Evaluation: BHF rjwalls@cs.umass.edu 24 forensics.umass.edu

Evaluation: BHF rjwalls@cs.umass.edu 25 forensics.umass.edu

Raw Storage DEC0DE Component 1: Block Hash Filtering Block Hash Filtering Inference Records Evaluation Summary: > Filtered 69% on average > Lot of overlap between phones of same model rjwalls@cs.umass.edu 26 forensics.umass.edu

Inference? Raw Storage DEC0DE Block Hash Simple, just use regular expressions. Filtering Inference Records rjwalls@cs.umass.edu 27 forensics.umass.edu

Raw Storage DEC0DE Component 2: Block Hash Filtering Inference Inference Process: Records > Encode formats using Probabilistic Finite State Machines (PFSM) > Parse using Viterbi’s Algorithm > Remove false positives using decision tree. rjwalls@cs.umass.edu 28 forensics.umass.edu

Phone number: Call log: rjwalls@cs.umass.edu 29 forensics.umass.edu

Raw Storage DEC0DE Component 2: Block Hash Filtering Inference Inference Post Processing: Records > Simpler to encode certain features > Reduces complexity of state machines > Increases precision rjwalls@cs.umass.edu 30 forensics.umass.edu

Component 2: Raw Storage DEC0DE Block Hash Inference Evaluation Filtering Inference Records Process: Step 0 > Pick phone set Step 1 > Pick target record types Step 2 > Manually create state machines Step 3 > Acquire Raw Storage Step 4 > Run DEC0DE rjwalls@cs.umass.edu 31 forensics.umass.edu

Step 0 > Pick phone set rjwalls@cs.umass.edu 32 forensics.umass.edu

Step 2 > Manually create state machines rjwalls@cs.umass.edu 35 forensics.umass.edu

Evaluation: Inference Recall : Fraction of records recovered. Precision : Fraction of results that are actual records. Development Set Evaluation Set rjwalls@cs.umass.edu 39 forensics.umass.edu

Forensic Triage for Mobile Phones with DEC0DE Robert J. Walls Erik - PowerPoint PPT Presentation

Forensic Triage for Mobile Phones with DEC0DE Robert J. Walls Erik Learned-Miller Brian Neil Levine Department of Computer Science University of Massachusetts Amherst This work was supported in part by NSF award DUE-0830876.

AND FORENSIC ASSESSMENT SERVICES TRIAGE TEAM (FASTT) Bekah Bock, LCSW DPBH Rural Clinics

Evaluating the Accuracy of Data Collection on Mobile Phones: Collection on Mobile Phones: A

Triage Training Describe role of triage and use of the triage tag Demonstrate how to fill

The Adoption of Network Goods Evidence from the Spread of Mobile Phones in Rwanda Daniel

Ubiquitous and Mobile Computing CS 528: Using Mobile Phones to Write in Air Jie Lou Computer

Micro-Blog: Sharing and Querying Content Through Mobile Phones and Social Participation

TRIAGE AND PATHWAYS IN MEDIUM SECURE CARE Harry Kennedy Executive Clinical Director National

Speech Technology for Mobile Phones Part I : ASR, and TTS on the Mobile phone Rajesh M. Hegde

Security Levels for Web Authentication Using Mobile Phones Anna Vapen and Nahid Shahmehri

AmbientTalk A scripting language for mobile phones Tom Van Cutsem Software Languages Lab

Mobile Security: how smart are mobile phones today? Prof. Alessio Merlo DIBRIS University of

Triage in Trouble Hospital emergency rooms are busy Patients are impatient Triage

Why This Workshop? In 2009 the Research Council of the National Academy of Sciences issues a

Fast and Generic Malware Triage Using openioc_scan Volatility Plugin TAKAHIRO HARUYAMA

Challenges in Crime Scene Investigation Technical challenges in forensic STR profiling

Objectives 1. Articulate the rationale for restructuring forensic evaluation reports 2. Identify

Master Boot Record (MBR) A Forensic Perspective Villanova University Department of

ForgetMeNot: Memory-Aware Forensic Facial Sketch Matching Authors: Ouyang, Hospedales, Song, Li

The Bro Network Security Monitor Network Forensics with Bro Matthias Vallentin UC Berkeley /

Topics in Security: Forensic Signal Analysis Markus Kuhn, Andrew Lewis Computer Laboratory

Linguistics. Invitation to a Dialogue GSFL Roundtable 2017 Sune Auken University of Copenhagen

Biometrics for Forensics: A few words with examples in Fingerprint, Face and Handwriting Prof.

Learning Disability Community Forensic Services - A Workforce Skills Framework Lisa Proctor,

Digital Investigation Full System Memory Dump Acquisition of volatile memory is an essential