Forensic triage for mobile phones with decode

Proceedings of the 20th USENIX Security Symposium

Volumn , Issue , 2011, Pages 93-106

  Walls, Robert J ^a   Learned Miller, Erik ^a   Levine, Brian Neil ^a  

^a Biologically Inspired Neural and Dynamical Systems Laboratory   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

DIGITAL FORENSICS; DIGITAL STORAGE; DYNAMIC PROGRAMMING;

CRITICAL PROBLEMS; CUSTOM HARDWARES; DYNAMIC PROGRAMMING ALGORITHM; STORAGE FORMATS;

TELEPHONE SETS;

EID: 84864601404     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (25)

1. J. Caballero, P. Poosankam, C. Kreibich, and D. Song. Dispatcher: Enabling active botnet infiltration using automatic protocol reverse-engineering. In ACM Proc. CCS, pages 621-634, 2009.
2. J. Caballero, H. Yin, Z. Liang, and D. Song. Polyglot: Automatic extraction of protocol message format using dynamic binary analysis. In ACM Proc. CCS, pages 317-329, 2007.
3. Computer Crime and Intellectual Property Section, U.S. Department of Justice. Retention Periods of Major Cellular Service Providers. http://dgsearch.no-ip. biz/rnrfiles/retention.pdf, August 2010.
4. A. Cozzie, F. Stratton, H. Xue, and S. T. King. Digging For Data Structures. In Proc. USENIX OSDI Symposium, pages 255-266, Dec 2008.
5. W. Cui, J. Kannan, and H. J. Wang. Discoverer: Automatic protocol reverse engineering from network traces. In USENIX Security Symp, pages 1-14, 2007.
6. W. Cui, M. Peinado, K. Chen, H. J.Wang, and L. Irun-Briz. Tupni: Automatic reverse engineering of input formats. In Proc. ACM CCS, pages 391-402, 2008.
7. K. Fisher, D. Walker, and K. Q. Zhu. LearnPADS: Automatic tool generation from ad hoc data. In Proc. ACM SIGMOD, pages 1299-1302, 2008.
8. K. Fisher, D. Walker, K. Q. Zhu, and P. White. From dirt to shovels: Fully automatic tool generation from ad hoc data. In Proc. ACM POPL, pages 421-434, 2008.
9. S. Garfinkel, A. Nelson, D. White, and V. Roussev. Using purpose-built functions and block hashes to enable small block and sub-file forensics. In Proc. DFRWS Annual Forensics Research Conference, pages 13-23, Aug 2010.
10. J. E. Hopcroft, R. Motwani, and J. D. Ullman. Introduction to Automata Theory, Languages, and Computation. Addison-Wesley, 2000.
11. K. Jonkers. The forensic use of mobile phone flasher boxes. Digital Investigation, 6(3-4):168-178, May 2010.
12. N. Judish et al. Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations. US Dept. of Justice, 2009.
13. R. Karp and M. Rabin. Efficient randomized patternmatching algorithms. IBM J. Res. Dev., 31(2):249-260, March 1987.
14. R. Luk and R. Damper. Inference of letter-phoneme correspondences by delimiting and dynamic time warping techniques. In IEEE Intl Conf on Acoustics, Speech, and Signal Processing, volume 2, pages 61-64, Mar. 1992.
15. R. C. C. Milanesi, T. H. Nguyen, C. Lu, A. Zimmermann, A. Sato, H. D. L. Vergne, and A. Gupta. Market Share Analysis: Mobile Devices, Worldwide, 4Q10 and 2010. http://www.gartner.com/ DisplayDocument?id=1542114; see also http: //tinyurl.com/4zandx4, Feb 2011.
16. R. P. Mislan, E. Casey, and G. C. Kessler. The growing need for on-scene triage of mobile devices. Digital Investigation, 6(3-4):112-124, 2010.
17. National Gang Intelligence Center. National Gang Threat Assessment 2009. Technical Report Document ID: 2009-M0335-001, US Dept. of Justice, http://www.usdoj. gov/ndic/pubs32/32146, Jan 2009.
18. A. Pal and N. Memon. The evolution of file carving. Signal Processing Magazine, IEEE, 26(2):59 -71, March 2009.
19. A. Pal, H. T. Sencar, and N. Memon. Detecting file fragmentation point using sequential hypothesis testing. Digital Investigation, 5(S1):2-13, 2008.
20. G. Richard and V. Roussev. Scalpel: A frugal, high performance file carver. In Proc. DFRWS Annual Forensics Research Conference, August 2005.
21. S. Russell and P. Norvig. Artificial Intelligence: A Modern Approach. Prentice-Hall, Englewood Cliffs, NJ, 2nd edition edition, 2003.
22. A. Tridgell. Efficient Algorithms for Sorting and Synchronization. PhD thesis, Australian National University, Feb 1999.
23. J. Tuttle, R. J. Walls, E. Learned-Miller, and B. N. Levine. Reverse Engineering for Mobile Systems Forensics with Ares. In Proc. ACM Workshop on Insider Threats, October 2010.
24. A. Viterbi. Error bounds for convolutional codes and an asymptotically optimum decoding algorithm. IEEE Transactions on Information Theory, 13(2):260-269, April 1967.
25. Q. Xi, K. Fisher, D. Walker, and K. Zhu. Ad hoc data and the token ambiguity problem. In Proc. Intl Symp Practical Aspects of Declarative Languages, pages 91-106, 2009.