Windows mobile live SD forensics

Journal of Network and Computer Applications

Volumn 36, Issue 2, 2013, Pages 677-684

  Canlar, Eyüp S ^a,b   Conti, Mauro ^c   Crispo, Bruno ^d   Di Pietro, Roberto ^e  

^a SAPIENZA UNIVERSITY OF ROME   (Italy)

^b VU UNIVERSITY AMSTERDAM   (Netherlands)

^c UNIVERSITY OF PADOVA   (Italy)

^d UNIVERSITY OF TRENTO   (Italy)

^e ROMA TRE UNIVERSITY   (Italy)

Author keywords

Data acquisition; Mobile device forensics; PocketPC forensics; Window CE forensics; Windows Mobile Forensics

Indexed keywords

CRIMINAL INVESTIGATION; CRYPTOGRAPHIC KEY; ELECTRONICALLY ERASABLE PROGRAMMABLE READ-ONLY MEMORIES; FORENSIC EVIDENCE; ON-THE-FLY; POCKET-PC; RANDOM ACCESS MEMORIES; RELEVANT TARGET; WINDOWS MOBILES;

DATA ACQUISITION; PROM; RANDOM ACCESS STORAGE; SIGNAL ENCODING; SMARTPHONES;

MOBILE DEVICES;

EID: 84874723547     PISSN: 10848045     EISSN: 10958592     Source Type: Journal    
DOI: 10.1016/j.jnca.2012.12.024     Document Type: Article

References (40)

1. AccessData, Forensic Toolkit (FTK), 〈 http://accessdata.com/ products/forensic-investigation/ftk 〉 [accessed 03.07.12].
2. M. Bader, and I. Baggili iPhone 3GS forensics logical analysis using apple iTunes backup utility Small Scale Digital Device Forensics Journal 4 1 2010 1 15
3. Bolin D. Microsoft developers network (MSDN) - windows embedded CE 6.0 advanced memory management, 〈 http://msdn.microsoft.com/en-us/library/ bb331824.aspx 〉 [accessed 03.07.12].
4. F. Casadei, A. Savoldi, and P. Gubian Forensics and SIM cards an overview International Journal of Digital Evidence 5 1 2006 1 21
5. E. Casey, M. Bann, and J. Doyle Introduction to windows mobile forensics Digital Investigation 6 3-4 2010 136 146
6. CelleBrite, Universal forensic extraction device, 〈 http://www.cellebrite.com/forensic-products.html 〉 [accessed 03.07.12].
7. Chen S-W, Yang C-H, Liu C-T. Design and implementation of live SD acquisition tool in android smart phone. in: Proceedings of the 2011 fifth international conference on genetic and evolutionary computing, ICGEC '11, Washington, DC, USA: IEEE Computer Society; 2011. p. 157-62.
8. Dean S. Free disk encryption software for PCs and PDAs, 〈 http://www.freeotfe.org/ 〉 [accessed 03.07.12].
9. Dellutri F, Ottaviani V, Me G. MIAT-WM5: forensic acquisition for windows mobile PocketPC, in: Proceedings of the workshop on security and high performance computing, as part of the 2008 international conference on high performance computing & simulation; 2008. p. 200-5.
10. A. Distefano, and G. Me An overall assessment of mobile internal acquisition tool Digital Investigation 5 2008 S121 S127
11. htc-linux.org, Haret/documentation, 〈 http://htc-linux.org/wiki/ index.php?title=HaRET-Documentation 〉 [accessed 03.07.12].
12. Hengeveld W. XDA RAPI tools (itsutils), 〈 http://www.xs4all.nl/ ∼itsme/projects/xda/tools.html 〉 [accessed 03.07.12].
13. Hirohisa H. Crocus: a steganographic filesystem manager. in: Proceedings of the second ACM symposium on information, computer and communications security, ASIACCS '07. New York, NY, USA: ACM; 2007. p. 344-6.
14. HTC, HTC TyTnII and HTC HD2, 〈 http://www.htc.com 〉 [accessed 03.07.12].
15. Jansen, W., Ayers, R. Guidelines on cellphone forensics - recommendations of the national institute of standards and technology (NIST), 〈 http://csrc.nist.gov/publications/nistpubs/800-101/SP800-101.pdf 〉 [accessed 03.07.12].
16. C. Klaver Windows mobile advanced forensics Digital Investigation 6 3-4 2010 147 167
17. G. Lawton Improved flash memory grows in popularity Computer 39 1 2006 16 18
18. J. Lessard, and G.C. Kessler Android forensics simplifying cell phone examinations Small Scale Digital Device Forensics Journal 4 1 2010 1 12
19. MIAT Forensics, MIAT: mobile internal acquisition tool, 〈 http://miatforensics.org 〉 [accessed 03.07.12].
20. Microsoft Corporation, Microsoft developers network (MSDN) - memory architecture, 〈 http://msdn.microsoft.com/en-US/library/ee482940(v= WinEmbedded.60).aspx 〉; 2012a [accessed 03.07.12].
21. Microsoft Corporation, Microsoft developers network - system memory managment in windows CE.NET, 〈 http://msdn.microsoft.com/en-us/library/ ms836792.aspx 〉; 2012b [accessed 03.07.12].
22. Microsoft Corporation, Microsoft developers network (MSDN) - automatically run an application from a storage card, 〈 http://msdn.microsoft.com/en-us/library/bb159776.aspx 〉; 2012c [accessed 03.07.12].
23. Microsoft Corporation, Microsoft Developers Network (MSDN) - secure digital card host controller driver, 〈 http://msdn.microsoft.com/en-us/ library/ms894009.aspx 〉; 2012d [accessed 03.07.12].
24. Microsoft Corporation, Microsoft developers network (MSDN) - windows embedded, 〈 http://msdn.microsoft.com/en-us/library/ee504814(v=WinEmbedded. 0).aspx 〉; 2012e [accessed 03.07.12].
25. Micro Systemation,.XRY and XACT forensic tools, 〈 http://www.msab.com 〉 [accessed: 03.07.12].
26. National Institute of Standards and Technology (NIST), Specification for the ADVANCED ENCRYPTION STANDARD (AES), 〈 http://csrc.nist.gov/ publications/fips/fips197/fips-197.pdf 〉 [accessed 03.07.12].
27. Paraben Corporation, Paraben's device seizure, 〈 http://www.paraben.com/device-seizure.html 〉 [accessed 03.07.12].
28. S. Pavlov, and P. Belevsky Windows embedded CE 60 fundamentals 2008 Microsoft Press
29. PPCGEEKS, Ppcgeeks forum, 〈 http://forum.ppcgeeks.com/ 〉 [accessed 03.07.12].
30. F. Rehault Windows mobile advanced forensics an alternative to existing tools Digital Investigation 7 1-2 2010 38 47
31. OneNandTM flash - fusion memory featuring high-density NAND flash with a NOR interface, 〈 http://u-boot-all-in-one.googlecode.com/svn-history/r115/trunk/u-boot-2010.9/ Docs/onenand-brochure-200609.pdf 〉 [accessed 03.07.12].
32. S-Mobile, Security of software and services for mobile devices, 〈 http://s-mobile.cs.vu.nl/ [accessed 03.07.12].
33. Technologiestichting STW, sentinels research program, 〈 http://www.stw.nl/Programmas/Sentinels/ 〉 [accessed 03.07.12].
34. V.L.L. Thing, K. Ng, and E. Chang Live memory forensics for mobile phones Digital Investigation 7 Suppl. 1 2010 74 82
35. J. van den Bos, and R. van der Knijff TULP2G - an open source forensic software framework for acquiring and decoding data stored in electronic devices International Journal of Digital Evidence 4 2 2005 1 19
36. S.Y. Willassen Forensics and the GSM mobile telephone system International Journal of Digital Evidence 2 1 2003 1 17
37. XDA-Developers, Pdocread, 〈 http://forum.xda-developers.com/wiki/ index.php?title=Pdocread 〉; 2012a [accessed 03.07.12].
38. XDA-Developers, HaRET, 〈 http://forum.xda-developers.com/wiki/index. php?title=HaRET 〉; 2012b [accessed 03.07.12].
39. XDA-Developers, Xda-developers forum, 〈 http://forum.xda-developers. com/ 〉; 2012c [accessed 03.07.12].
40. R. Zax, and F. Adelstein FAUST forensic artifacts of uninstalled steganography tools Digital Investigation 6 1-2 2009 25 38