Digital Forensic Technology: Evidence Recovery and Challenges

This report discusses the aspects of digital forensic technology, focusing on evidence recovery techniques for iPhone 4s and Samsung Galaxy Tab. It also highlights the challenges faced by digital forensic evaluation teams.

CO4514 Digital Forensic Technology
Your G Number
Assignment One

Digital Desktop
1. Introduction
This report aims to discuss the aspects of the digital forensic technology by considering the
case study provided in the appendix, about Zohra Bloggs. A discussion of the use of the
digital technology is provided in this report. The considered case study is the Zohra Bloggs
situation where she is the undergraduate student at University of the Central Lancashire and
she is pursuing BSc multimedia development. She carried the iPhone 4s mobile phone along
with her. The main purpose of using this phone is to stay in touch with the family and friends
through text messages, phone calls, iMessage and the using Skype. She also utilises this
device for listening music that could be downloaded by her from the Apple iTunes. She also
possess the Samsung Galaxy Tab 3 as her tablet device as it provides the ability of sharing
any data with the mobile phone. This case study is analysed and the assessed for
understanding the potential crimes or any kind of digital evidence that could be recovered.

2. My Digital Technology
No Device Justification Crime Available Evidence
1 Zohra Bloggs is the
undergraduate student at
University of the Central
Lancashire and she is pursuing
BSc multimedia development.
She carried the iPhone 4s
mobile phone along with her.
Apple products provide the
enhanced reliability and security.
The crimes that could be committed
using the iOS platform is the
creation of malware embedded
applications and place it in the app
store that could be downloaded by
the users and it would lead to the
seize of the contents and the data
on the phone by the malicious users
(Baig et al. 2017). It could lead to
seize or even delete the contents on
the iPhone.
The kind of applications that are
used for executing this attack leaves
a digital trail of the files shortcut
that could be used a digital evidence
of the attack (Cao et al. 2014). The
name of the malware is the
XcodeGhost that is originated from
the malicious version of the Xcode
that is the official tool for
developing the iOS and apps
(Chabot et al. 2014).
2 The main purpose of using
this phone is to stay in touch
with the family and friends
through text messages, phone
calls, iMessage and the using
Skype. She also utilises this
device for listening music that
could be downloaded by her
from the Apple iTunes.
Skype provides the better quality
video conferencing platform
without any lags or glitches
Skype could be used for accessing
the webcam illegally and gain some
explicit videos.
Evidence is the log file on the
computer and the software logs
about the calls.
3 She also possess the Samsung
Galaxy Tab 3 as her tablet
device as it provides the
ability of sharing any data
with the mobile phone.
Tablet are easy to handle and
customised for personal use.
Tablet could be used for hacking any
electronic equipment.
IP address of the device that is used
for hacking could be trailed for
discovering the attacker source
(Conlan, Baggili and Breitinger
2016).
4 Zohra utilises this tablet
device between the breaks of
the classes for communicating
with her friends and her
family using Facebook, and
Tablet also provides the improved
security.
Tablet could be used for hacking any
electronic equipment (Dang-Nguyen
et al. 2015).
IP address of the device that is used
for hacking could be trailed for
discovering the attacker source
(Holt, Bossler and Seigfried-Spellar
2015).

for sharing the photographs
on social media that is stored
on the cloud at iCloud.

3. Evidence Recovery
3.1 Evidence Recovery – iPhone 4s
3.1.1 Evidence Acquisition Techniques
The evidence recovery techniques that are commonly utilised and most effective for
the recovery of the data from the iOS devices are the manual acquisition, logical
acquisition, physical acquisition and the brute force acquisition (Kleinmann and
Wool 2014). In the manual acquisition techniques, the examiner uses the user
interface for the investigation of the content in the memory of the phone (Irons and
Lallie 2014). Hence the device is used as normal with the examiner taking the
required screenshots of the contents of the screens. It has been discovered that the
method comprise of some significant advantage as it makes unnecessary to use the
specialised tools or any kind of equipment for the transformation of the raw data
into the information that could be interpretable by the humans (Karie and Venter
2015).
3.1.2 Usefulness of acquisition techniques
The extraction of the file system is particularly useful for the understanding of the
file structure, history of the web browser or the usage of the apps and providing the
examiner with ability of performing any analysis with the conventional tools of
computer forensic. The physical acquisition suggests the bit-for-bit copy of the
complete physical store and hence it is the technique that is most similar for the
examination of the personal computer (Kleinmann and Wool 2014). The physical
acquisition comprises of the advantage of the allowing of the deleted files and the
data remnants that are to be examined (Karie and Venter 2015). The physical
extraction gains the information from device by the direct access to flash memories.
Commonly, it is harder to gain this information due to the fact that the authentic
equipment manufacturer of the device requires to secure against any kind of
arbitrary reading of the memory and hence any device might be locked for any
specific operator.
3.1.3 Acquisition Tools: Strengths and Weaknesses
Cellebrite forensic tool is used for the acquisition of digital evidence. Another
method that could be used for the retrieval of the evidence is the brute force
technique. It could be performed by any tools of 3rd party passcode brute force that
transmits the series of some passcodes to any particular device (Lang et al. 2014).
This technique is commonly considered as time consuming but it is increasingly
effective. The technique utilises the method of trial and error for the attempt of
creating the accurate combination of the PIN or the password for authenticating
access to the mobile device (Lang et al. 2014). Despite the fact that is consumes
significant time, this is considered as one of the best tools for employing if that
forensic professional is anyhow unable to gain the passcode. With the present

available software and the hardware, this has become significantly easy to break in
the encryption on the mobile devices password file for obtaining the passcode (Van
Beek et al. 2015). Two of the manufacturers have become immensely public from
the release of the iPhones, Cellebrite and the GrayShift (Agustina 2015). The
manufacturers are intended for the police department and the law enforcement
agencies. The Cellebrite forensic tool would be most suitable for the extraction of
any kind of evidence. The product called as UFED that is aimed at the digital forensic
is the hand held device with the optional desktop software, adapters, data cables
and several other peripherals. The UFED enables the recovery of the digital evidence
of the subject using the logical file system or the physical extractions.
3.1.4 Usefulness of acquired evidence – is it useful during prosecution?
The evidence that would be recovered from the iOS device are the IP address of the
server where the information was uploaded. This information would be significant in
the prosecution of the crime as it would help in determining the source of the attack
and also retrieve the files from the server where it has been stored (Vincze 2016).
This evidence would be immensely useful as it would provide the attacker source
and help in the prosecution of the attacker (Thethi and Keane 2014).
3.2 Evidence Recovery – Samsung Galaxy tab
Detailed information here about how to recover evidence from one of your devices.
You should talk about…
3.2.1 Evidence Acquisition Techniques
The evidence acquisition techniques that could be used for the extraction of the
evidence from the Samsung Galaxy tab is the physical acquisition technique.
3.2.2 Usefulness of acquisition techniques
The physical acquisition suggests the bit-for-bit copy of the complete physical store
and hence it is the technique that is most similar for the examination of the personal
computer. The physical acquisition comprises of the advantage of the allowing of the
deleted files and the data remnants that are to be examined (Karie and Venter
2015). The physical extraction gains the information from device by the direct access
to flash memories. Commonly, it is harder to gain this information due to the fact
that the authentic equipment manufacturer of the device requires to secure against
any kind of arbitrary reading of the memory and hence any device might be locked
for any specific operator. For getting around this kind of security, the vendors of the
mobile forensic tool frequently develop the respective boot loaders allowing the
forensic tool for accessing the memory (Cao et al. 2014). Commonly this technique is
divided into two phases which are the dumping phase and decoding phase.
3.2.3 Acquisition Tools: Strengths and Weaknesses

The strength of this SANS Investigative Forensic Toolkit is the better utilisation of the
memory, auto update of DFIR packages and the customisations and it comprises of
the latest forensic techniques and tools.
3.2.4 Usefulness of acquired evidence – is it useful during prosecution?
The evidence that would be recovered from the iOS device are the IP address of the
server where the information was uploaded (Van Baar et al. 2014). This information
would be significant in the prosecution of the crime as it would help in determining
the source of the attack and also retrieve the files from the server where it has been
stored (Vincze 2016). This evidence would be immensely useful as it would provide
the attacker source and help in the prosecution of the attacker (Van Beek et al.
2016).
4 Future Evidence Recovery
There are significant challenges that are faced by the digital forensic evaluation teams. Several
department are far behind the curve in the handling of the digital evidence. Some of the
reasons for this are the proliferation of the digital devices, rapid changes, limitations to the
budget and the lack of the proper opportunities of training (Watson and Dehghantanha 2016).
The digital evidence needs various tools and training in comparison to the physical evidence.
The range of the extraction modes could be need for obtaining the digital evidence from the
various sources or the kinds of the devices denotes that the collection and the utilisation could
be the multi-faceted challenge, and it potentially requires the building and the maintenance of
variety of the significant different technical capabilities and the expertise (Chabot et al. 2014).
Specifically, there are significant challenges related to the iOS 8 operating system as this
platform prevents Apple from the unlocking of the phones even during the request by any law
enforcement. As the server of Apple protects the data of the users of the device using the
enhanced security mechanisms and the protection of the strong passcode, it makes the
bypassing to the data significantly impossible and difficult.
5 Conclusions
Therefore, it can be concluded from the above discussion that the recovery of the digital
evidence might be difficult when the iOS devices are considered and it would have some
problems related to the retrieval of the information from the servers. Some of the reasons are
the personalised app store, enhanced quality of hardware and software and the appropriate
screen size of the mobile phone that makes it easy to use. While taking about the application
store, Apple and Google have the similar kind and number of apps that are available in the
respective app stores. The crimes that could be committed using the iOS platform is the
creation of malware embedded applications and place it in the app store that could be
downloaded by the users and it would lead to the seize of the contents and the data on the
phone by the malicious users. The evidence recovery techniques that are commonly utilised
and most effective for the recovery of the data from the iOS devices are the manual acquisition,

logical acquisition, physical acquisition and the brute force acquisition. The logical withdrawal
gains the information from devices using the authentic equipment manufacturer application
programming interface to synchronise of the contents of the phone using the personal
computer. Several department are far behind the curve in the handling of the digital evidence.
Some of the reasons for this are the proliferation of the digital devices, rapid changes,
limitations to the budget and the lack of the proper opportunities of training.

6 References
Agustina, J.R., 2015. Understanding cyber victimization: Digital architectures and the disinhibition
effect. International Journal of Cyber Criminology, 9(1), p.35.
Baig, Z.A., Szewczyk, P., Valli, C., Rabadia, P., Hannay, P., Chernyshev, M., Johnstone, M., Kerai, P.,
Ibrahim, A., Sansurooah, K. and Syed, N., 2017. Future challenges for smart cities: Cyber-security and
digital forensics. Digital Investigation, 22, pp.3-13.
Cao, G., Zhao, Y., Ni, R. and Li, X., 2014. Contrast enhancement-based forensics in digital
images. IEEE transactions on information forensics and security, 9(3), pp.515-525.
Chabot, Y., Bertaux, A., Nicolle, C. and Kechadi, M.T., 2014. A complete formalized knowledge
representation model for advanced digital forensics timeline analysis. Digital Investigation, 11,
pp.S95-S105.
Conlan, K., Baggili, I. and Breitinger, F., 2016. Anti-forensics: Furthering digital forensic science
through a new extended, granular taxonomy. Digital investigation, 18, pp.S66-S75.
Dang-Nguyen, D.T., Pasquini, C., Conotter, V. and Boato, G., 2015, March. Raise: A raw images
dataset for digital image forensics. In Proceedings of the 6th ACM Multimedia Systems
Conference (pp. 219-224). ACM.
Holt, T.J., Bossler, A.M. and Seigfried-Spellar, K.C., 2015. Cybercrime and digital forensics: An
introduction. Routledge.
Irons, A. and Lallie, H., 2014. Digital forensics to intelligent forensics. Future Internet, 6(3), pp.584-
596.
Karie, N.M. and Venter, H.S., 2015. Taxonomy of challenges for digital forensics. Journal of forensic
sciences, 60(4), pp.885-893.
Kleinmann, A. and Wool, A., 2014. Accurate modeling of the siemens s7 scada protocol for intrusion
detection and digital forensics. Journal of Digital Forensics, Security and Law, 9(2), p.4.
Lang, A., Bashir, M., Campbell, R. and DeStefano, L., 2014. Developing a new digital forensics
curriculum. Digital Investigation, 11, pp.S76-S84.
Thethi, N. and Keane, A., 2014, February. Digital forensics investigations in the cloud. In 2014 IEEE
international advance computing conference (IACC) (pp. 1475-1480). IEEE.
Van Baar, R.B., Van Beek, H.M.A. and Van Eijk, E.J., 2014. Digital Forensics as a Service: A game
changer. Digital Investigation, 11, pp.S54-S62.
Van Beek, H.M.A., van Eijk, E.J., van Baar, R.B., Ugen, M., Bodde, J.N.C. and Siemelink, A.J., 2015.
Digital forensics as a service: Game on. Digital Investigation, 15, pp.20-38.
Vincze, E.A., 2016. Challenges in digital forensics. Police Practice and Research, 17(2), pp.183-194.

Watson, S. and Dehghantanha, A., 2016. Digital forensics: the missing piece of the internet of things
promise. Computer Fraud & Security, 2016(6), pp.5-8.