In this webinar presentation, Mike Harrington of Teel Technologies talked about the relationship between smartphone-based evidence and Internet-based evidence, and why investigators need to collect each.
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
Smartphones Changing Online Evidence
1. Smart
Phones
and
the
Internet
::Societal
Shi3s
and
the
Age
of
the
App
16 Knight St., Norwalk, CT 06851 : (203) 855-5387
mike.harrington@teeltech.com : www.TeelTech.com
2. Topics
• How
and
why
smartphones
are
changing
the
game
for
online
evidence
• What
evidence
can
be
found
on
smartphones
and
how
does
it
work
with
“tradi<onal”
online
evidence
gathering
• Sugges<ons
for
how
far
to
go
with
smart-‐
phone
evidence
and
how
to
work
in
conjunc<on
with
devices
and
online
evidence
gathering
16 Knight St., Norwalk, CT 06851 : (203) 855-5387
mike.harrington@teeltech.com : www.TeelTech.com
3. Societal
ShiAs
• Research
by
Ericsson
ConsumerLab
suggests
that
people
are
finding
it
increasingly
difficult
to
live
without
a
connec<on
to
the
cloud
• Prior
to
smartphones
people
used
the
internet
in
chunks
–
now
they
“jacked
in”
constantly
• Consumers
are
forming
habits
integra<ng
internet
use
into
everyday
life
through
apps-‐
cloud
dependency!
16 Knight St., Norwalk, CT 06851 : (203) 855-5387
mike.harrington@teeltech.com : www.TeelTech.com
4. Societal
ShiAs
• To
date
35
percent
of
US
Android/iPhone
users
interact
with
non-‐voice
applica<ons
on
their
smartphones
before
gePng
out
of
bed
– The
most
common
ac<vity
checking
Facebook
–
18
percent
of
social
networking
users
log
in
while
their
heads
are
s<ll
on
the
pillow
16 Knight St., Norwalk, CT 06851 : (203) 855-5387
mike.harrington@teeltech.com : www.TeelTech.com
5. Societal
ShiAs
• AAer
gePng
out
of
bed
23%
of
smartphone
users
access
the
internet
via
their
browsers,
24%
check
their
email
and
22%
check
Facebook
• 29%
use
Google
Maps
or
other
nav
tools
on
morning
commute
and
28%
listen
to
music
16 Knight St., Norwalk, CT 06851 : (203) 855-5387
mike.harrington@teeltech.com : www.TeelTech.com
9. Societal
ShiAs
• Smartphones
are
becoming
hubs
through
which
people
manage
their
social
lives
•
Ericsson
ConsumerLab
reports
smartphone
users
are
spending
considerable
<me
using
“everyday”
apps
-‐integra<ng
internet
use
into
a
more
basic
level
of
everyday
life
16 Knight St., Norwalk, CT 06851 : (203) 855-5387
mike.harrington@teeltech.com : www.TeelTech.com
11. Societal
ShiAs
• Ericsson’s
research
suggests
“Consumers
expect,
and
increasingly
depend
on,
the
ability
to
access
online
services
easily
at
low
cost
and
complexity
from
mul<ple
loca<ons
during
the
day.”
• Among
Americans
using
portable
storage
devices
– 54
percent
were
interested
in
synchronizing
the
portable
storage
from
anywhere
– 51
percent
want
direct
exchange
between
portable
devices
and
online
secure
storage
16 Knight St., Norwalk, CT 06851 : (203) 855-5387
mike.harrington@teeltech.com : www.TeelTech.com
12. Societal
ShiAs
• The
overwhelming
purpose
for
use
of
the
smartphone
is
personal
–
80-‐90%
of
respondents
• Consumers
connect
to
apps
on
an
emo<onal
level
– Feeling
of
be`er
control
of
life
– Feeling
of
belonging
16 Knight St., Norwalk, CT 06851 : (203) 855-5387
mike.harrington@teeltech.com : www.TeelTech.com
13. Market
• Smart
phone
market
expected
to
grow
over
55%
in
2011
– 472
million
expected
shipped
in
2011
– 982
by
the
end
of
2015
• Growth
is
four
<mes
faster
than
that
of
tradi<onal
mobile
phones
• Emerging
markets
key
–
Asia/Pacific,
La<n
America
16 Knight St., Norwalk, CT 06851 : (203) 855-5387
mike.harrington@teeltech.com : www.TeelTech.com
16. Considera<ons
• Working
with
other
inves<gators
• How
far
to
go?
16 Knight St., Norwalk, CT 06851 : (203) 855-5387
mike.harrington@teeltech.com : www.TeelTech.com
18. Third
Party
Applica<ons
• Over
300k
apps
for
sale
in
App
Store
• There
are
many
unauthorized
applica<ons
from
jailbroken
phones
• Can
contain
important
informa<on
• Store
their
informa<on
using
– Plists
– Sqlite
databases
– Text
files
16 Knight St., Norwalk, CT 06851 : (203) 855-5387
mike.harrington@teeltech.com : www.TeelTech.com
20. Twi`er
• Documents
(cont’d)
– Com.atebits.twee<e.compose.a`achments
• Hashed
numbers
as
file
names
-‐
actual
a`achments
sent
with
tweets
– Com.atebits.twee<e.streams
• One
or
more
property
lists
– tweet
handles
(user
names)
and
tweets
» date
and
<me
values
in
absolute
<me
16 Knight St., Norwalk, CT 06851 : (203) 855-5387
mike.harrington@teeltech.com : www.TeelTech.com
35. iOS
GPS
Ar<facts
-‐
Maps
• Direc<ons.plist
– User
requested
point
to
point
direc<ons
• Start
and
stop
end
points
• Turn
by
turn
direc<ons
– Viewed
in
the
plist
editor
the
data
is
base
64
encoded
– Can
be
decoded
in
a
hex
or
text
editor
• Online
base
64
decoders
16 Knight St., Norwalk, CT 06851 : (203) 855-5387
mike.harrington@teeltech.com : www.TeelTech.com
39. Geotags
-‐
iOS
• Videos
in
iOS
store
Geo
Data
at
the
end
of
the
file
16 Knight St., Norwalk, CT 06851 : (203) 855-5387
mike.harrington@teeltech.com : www.TeelTech.com
40. Geotags
-‐
iOS
• Quick<me
can
be
used
to
format
Geo
data
in
videos
for
quick
viewing
16 Knight St., Norwalk, CT 06851 : (203) 855-5387
mike.harrington@teeltech.com : www.TeelTech.com
41. Cellular
Data
• =<
iOS
4.0
– Located
in
/Library/caches/loca<ond
• Cells.plist
• Clients-‐b.plist
• H-‐cells.plist
• H-‐wifi.plist
• =>4.0
• Located
in
/Library/caches/loca<ond
– Clients.plist
– Consolidated.db
16 Knight St., Norwalk, CT 06851 : (203) 855-5387
mike.harrington@teeltech.com : www.TeelTech.com