1. Advanced Techniques in Forensic Examination of Smartphones
2010
(C) Oxygen Software,

2. Smartphones market growth
Data provided by FutureSource Consulting
Smartphones market is growing even while general mobile phones market falling
(C) Oxygen Software,

3. Smartphone is a small PC
Cell phone
Address book
Planner & Organizer
Messenger
Photo & Video camera
GPS navigator
Web client
Platform for 3rd party apps
(C) Oxygen Software,

4. Smartphone as: Cell phone
IMEI
Hardware & Software revision
Network information
Basic Information
Incoming, outgoing, missed calls history
Sent & received messages history
GPRS & Wi-Fi sessions log
Event log
IMSI
Phone numbers*
SMS messages*
SIM card
* - Usually these features are not utilized by smartphones
(C) Oxygen Software,

5. Smartphone as: Address book
Name fields: first, middle, last, nickname, prefix, suffix, joint name
Photo and personal ringing tone
Phone numbers: general, mobile, fax, video, pager, VoIP, push-to-talk
Postal addresses
Web pages and addresses
Company, department, job title
Text notes
Private info: birthday, spouse, children
Custom field labels
Multiple fields of the same type
Last modification date & time
Contacts information
List of caller groups & belonging contacts
Caller groups
List of assigned speed dials
Speed dials
(C) Oxygen Software,

6. Smartphone as: Planner
Meetings, reminders and anniversaries
Start date & time
Finish date & time
Alarm date & time
Recurrence
Last modification date & time
Calendar events
Task description
Deadline
Priority
Completion date & time
Tasks
Note text & date
Notes
(C) Oxygen Software,

7. Smartphone as: Messenger
Text messages (SMS)
Multimedia messages (MMS)
messages with attached files
BIO messages: vCard, vCal, configuration and others
Beamed messages: files sent via Bluetooth, IR or USB
Standard message folders
Custom message folders
Date & time
Service center timestamp
Information about deleted SMS messages
Messaging system
(C) Oxygen Software,

8. Smartphone as: GPS navigator
Last fixed GPS coordinates
Search history
Routes history
Last displayed map
Saved maps
List of favorite places
GPS Navigator
GPS coordinates in camera snapshots*
Cell coordinates in camera snapshots*
Cell coordinates for camera snapshots**
Cell coordinates for video records**
Cell coordinates for SMS messages**
Location tagger
* - Available in EXIF header for many new models
** - Available in smartphones with Nokia LifeBlog application installed
(C) Oxygen Software,

9. Smartphone as: Web client
Web cache files
Bookmarks
Pages view history
Last opened URLs
Search history
Cookies
Web browser
IP, Login (UID, ) and password*
Contacts list
Chat history
Calls history
IM client
* - Available for some IM clients
(C) Oxygen Software,

10. Smartphone as: PC Operating System apps 3rd party apps
Camera snapshots
Video clips
Voice records
Sounds and Podcasts
Wi-Fi networks list
Paired Bluetooth devices list
Activated SIM cards list
VPN profiles
Operating System apps
List of installed applications
Office documents
Application logs & data files
3rd party apps
(C) Oxygen Software,

11. Standard extraction methods
There are 2 standard ways to get forensic information from smartphones: logical and physical analysis
Data extracted using common PC-to-mobile communication protocols: AT, OBEX, SyncML
Smartphone connected to PC with a standard cable (or Bluetooth/IR adapter)
Logical analysis
Data extracted using direct memory reading (hex dump)
Smartphone (or its memory chip only) connected to special hardware
Physical analysis
(C) Oxygen Software,

12. Logical analysis for smartphones
Caller groups
Custom field labels
Speed dials
Messages from custom folders
Event log
Deleted messages information
Service center timestamps
GPS information
Location tagged data
Web browser data
IM client data
3rd party apps
General phone information
Contacts (simple), calls*, SMS, settings*
AT+
Nokia FBUS
Files*
OBEX
Contacts, calendar, notes, settings*, bookmarks, messages*
SyncML
General phone information
Contacts*
Calendar
Notes
Calls history
Messages*
Files*
Settings*
Bookmarks
* - Available data set is restricted and depends highly on manufacturer implementation
1) The information extracted by all logical protocols is only the top of the iceberg
2) All logical protocols were developed for data synchronization
(C) Oxygen Software,

13. Physical analysis for smartphones
How to deal with gigabytes of that?
(C) Oxygen Software,

14. Standard extraction methods: Summary
Physical analysis
All information can be extracted
Hard to perform
Very hard to analyze
Expensive software, special hardware needed
Logical analysis
Few information can be extracted
Easy to perform
Easy to analyze
Affordable software, no special hardware needed
(C) Oxygen Software,

15. How to extract data without a headache?
In 2002 Oxygen Software invented the 3rd way - analysis using a special agent application working inside smartphone OS
Physical analysis
All information can be extracted
Hard to perform
Very hard to analyze
Expensive software, special hardware needed
Analysis using Agent application
Most of the information can be extracted*
Easy to perform
Easy to analyze
Affordable software, no special hardware needed
Logical analysis
Few information can be extracted
* - Agent can extract all the information available for native OS applications
(C) Oxygen Software,

16. Agent application usage
General phone information & SIM card data
Contacts with all fields and custom field labels
Caller groups & Speed dials
Event Log
Calendar events
Tasks & Notes
Messages from standard and custom folders
Deleted messages information
Service center timestamp
Camera snapshots, video clips and voice records
File system
GPS & Location tagged information
Web browser cache & bookmarks
IM clients data
3rd party applications with their information
- Protected operating system files
- Memory dump
(C) Oxygen Software,

17. Afraid of writing to device?
Comparison of phone content changes when performing analysis using different approaches
SyncML protocol usage
Setting up sync parameters
Installing extra sync add-ons*
Running SyncML server
SyncML server generates synchronization log files
Agent application usage
Loading Agent to device
Installing Agent
Running Agent
Uninstalling Agent**
* - Extra sync add-ons installation may be needed to extract some additional information (e.g. MMS)
** - Agent does not generate any log files
Unlike Agent, SyncML server is not a forensically designed app and is out of full control from examiner. In addition - it makes more data modifications than Agent.
(C) Oxygen Software,

18. Summary
Smartphones is a considerable part of mobile device market FutureSource Consulting forecasts that, between 2008 and 2013, annual sales of smartphones will rise by 95% to over 300 million. It will be around 37% of all new mobile phones, up from 13% in Smartphones store much more important forensic information than plain cell phones Being a multiple-in-one device and having OS with open API smartphones are turning into small PCs with big memory sizes, wide set of preinstalled applications and huge number of available 3rd party applications. Standard extraction methods are less effective for smartphones All logical protocols were developed for sync purposes, thus they can only extract a top of the iceberg. Physical analysis of gigabyte hex dumps takes a lot of time. Agent application usage is the golden mean The Agent application approach, introduced by Oxygen Software in 2002, almost achieves the completeness of data extracted by physical methods. At the same time it works via standard cables and adaptors and allows to present the extracted data in readable and user-friendly format that is more peculiar to logical analysis.
(C) Oxygen Software,

19. Interested in more details?
Oxygen Forensic Suite 2010
Oxygen Forensics for iPhone
+44 (0) (UK)
OXYGEN (USA)
Oxygen Forensic Suite and Oxygen Forensic Suite 2010 a the trademarks of Oxygen Software.
Oxygen Software LLC was founded in year 2000 and since that time our business is a PC-to-mobile communication.
£499 Standard
£899 Professional
(C) Oxygen Software,