Presented in 2011 Symposium of Advanced Forensics

1. Smartphone Forensic
SungKyong Un
ETRI
2011.11.24

2. What is Smartphone Forensic?
■ To get clues and/or evidences from smartphones
source: Archigraphs@iconarhive source: samsum.com
2

3. Why?
source: http://www.asymco.com
3

4. Difference
4

5. Difference - Dummy vs. Smart
Item Dummy Smart
Target Models >1,000/Year >10/Year
OS Symbian, Qualcomm iOS, Android, Windows
Mobile, BlackberryOS
Interface Various USB
Acquisition Logical, Physical Logical, Physical,
Backup
Data Phone book, Call history, + Email, Web History,
SMS, Photo, Schedule Map, Location, SNS,
Message, App, ID/PW
DB Format Various Sqlite
3rd Party App - App Market
5

6. Which?
source: http://www.asymco.com
6

7. Difference - iOS vs. Android
Item iOS Android
Phone Manufacturer Apple Samsung, HTC,
Motorola, ...
App Market iTunes App Store Android, Amazon, SKT,
KT, Samsung, ...
Security Sandbox, App Screening, Sandbox, Permission,
App Singing, Passcode App Singing, Pattern
Lock, Location Finder, Screen Lock, Remote
Remote Lock, Remote Wipe, File Encryption
Wipe, File Encryption,
Encrypted Backup
Backup PC, iCloud -
Expansion Storage No Yes
Multitasking Limited Yes
7

8. Difference - iOS vs. Android
8

9. Difference - iOS vs. Android
9

10. Difference - iOS vs. Android
source: http://www.androidcentral.com source:http://http://forums.appleinsider.com/showt
hread.php?s=&threadid=124611
10

11. 11
Analysis
Tools
Acquisition
Acquisition

12. Analysis - Timeline
source: ETRI
12

13. Analysis - Relationship
source: ETRI
13

14. Analysis - Web Browsing
source: ETRI
14

15. Analysis - Location
source: ETRI
15

16. Analysis - Location
source: http://radar.oreilly.com/2011/04/apple-location-tracking.html
16

17. Analysis - App
Category App
Phone Call Skype, Viber, Google Voice, ...
Message Cacao Talk, iMessage, Twitter DM, Facebook Message, ...
SNS Twitter, Facebook, me2day, ...
Storage Dropbox, uCloud, SugarSync, Box.net, iCloud, ...
Key DataVault, 1Password, Strip, ...
17

18. Analysis - Communication Network
source: http://www.i2group.com/documents/video/ANB8_5_US.flv
18

19. Analysis - Social Network
source: http://www.youtube.com/watch?v=Q3rhx9MtUro
19

20. Challenge
source: http://theunderstatement.com
20

21. Challenge
■ Apple
• 425,000 Apps
• 15B Downloads
■ Google
• 200,000 Apps
• 0.5B Downloads
July, 2011
source: http://readwriteweb.com
21

22. Architecture
Backup Files
Analysis Request
Analysis Result
SW or
Web Browser
Presentation
USB
Connection
22