Forensic data acquisition from cloud-of-things devices: windows Smartphones as a case study

Concurrency and Computation: Practice and Experience

Volumn 29, Issue 14, 2017, Pages

  Cahyani, Niken Dwi Wahyu ^a,b   Martini, Ben ^a   Choo, Kim Kwang Raymond ^a   Al Azhar, AKBP Muhammad Nuh ^c  

^a UNIVERSITY OF SOUTH AUSTRALIA   (Australia)

^b TELKOM UNIVERSITY   (Indonesia)

^c Forensic Laboratory Centre of Indonesian National Police Headquarter   (Indonesia)

Author keywords

cloud of things forensics; data acquisition; digital evidence; mobile forensic tool; windows device forensics

Indexed keywords

COPYRIGHTS; DATA ACQUISITION; METALS; SECURITY OF DATA; TELEPHONE SETS;

ACQUISITION PROCESS; BUSINESS OPPORTUNITIES; CLOUD TECHNOLOGIES; CURRENT CAPABILITY; DIGITAL EVIDENCE; LOCATION SERVICES; MOBILE FORENSICS; SECURITY AND PRIVACY;

COMPUTER FORENSICS;

EID: 85020892568     PISSN: 15320626     EISSN: 15320634     Source Type: Journal    
DOI: 10.1002/cpe.3855     Document Type: Conference Paper

References (41)

1. Toosi AN, Calheiros RN, Buyya R. Interconnected cloud computing environments: challenges, taxonomy, and survey. ACM Computing Surveys 2014; 47(1):7:1–7:47.
2. McKemmish R. What is forensic computing? Trends and Issues in Crime and Criminal Justice 1999; 118:1–6.
3. Ab Rahman NH, Glisson WB, Yang Y, Choo K-KR. Forensic-by-design framework for cyber-physical cloud systems. IEEE Cloud Computing 2016; 3(1):50–59.
4. Windows Phone Architecture Overview. https://sysdev.microsoft.com/en-us/Hardware/oem/docs/Getting_Started/Windows_Phone_architecture_overview [16 July 2015].
5. Hernie D. Windows Phone 8 security deep dive. Slide presented at: MobCom Workshop. MobCom Workshop; 2013 Feb 6; Ledeberg, Belgium. https://www.msec.be/mobcom/ws2013/presentations/david_hernie.pdf [9 August 2014].
6. Gartner Says Smartphone Sales Surpassed One Billion Units in 2014. http://www.gartner.com/newsroom/id/2996817 [30 October 2015].
7. User Data Folder Layout. https://sysdev.microsoft.com/en-us/Hardware/oem/docs/Phone_Bring-Up/User_data_folder_layout [16 July 2015].
8. Windows Phone 8 Security Guide. http://www.microsoft.com/en-us/download/details.aspx?id=36173 [31 March 2014].
9. Thing VL, Ng K-Y, Chang E-C. Live memory forensics of mobile phones. Digital Investigation 2010; 7:S74–S82. doi:10.1016/j.diin.2010.05.010.
10. Casadei F, Savoldi A, Gubian P. Forensics and sim cards: an overview. International Journal of Digital Evidence 2006; 5(1):1–21.
11. Folder Layout. https://sysdev.microsoft.com/en-us/Hardware/oem/docs/Phone_Bring-Up/Folder_layout [16 July 2015].
12. Main OS Folder Layout. https://sysdev.microsoft.com/en-us/Hardware/oem/docs/Phone_Bring-Up/Main_OS_folder_layout [16 July 2015].
13. Removable User Data Folder Layout. https://sysdev.microsoft.com/en-us/Hardware/oem/docs/Phone_Bring-Up/Removable_user_data_folder_layout [16 July 2015].
14. Boot and UEFI. https://sysdev.microsoft.com/en-us/Hardware/oem/docs/Phone_Bring-Up/Boot_and_UEFI [16 July 2015].
15. Secure Boot and Device Encryption Overview. https://sysdev.microsoft.com/en-us/Hardware/oem/docs/Phone_Bring-Up/Secure_boot_and_device_encryption_overview [16 July 2015].
16. Windows Phone 8.1 Security Overview. http://www.microsoft.com/en-us/download/details.aspx?id=42509 [9 August 2014].
17. Windows Phone 8.1 Mobile Device Management Overview. http://www.microsoft.com/en-us/download/details.aspx?id=42508 [9 August 2014].
18. Taylor M, Hughes G, Haggerty J, Gresty D, Almond P. Digital evidence from mobile telephone applications. Computer Law & Security Review 2012; 28(3):335–339. doi:10.1016/j.clsr.2012.03.006.
19. Casey E, Turnbull B. Chapter 20—Digital evidence on mobile devices. In Digital Evidence and Computer Crime: Forensic Science, Computers, and the Internet. USA: Elsevier, 2011; 2–44.
20. Klaver C. Windows mobile advanced forensics. Digital Investigation 2010; 6(3):147–167. doi:10.1016/j.diin.2010.02.001.
21. Breeuwsma I. Forensic imaging of embedded systems using JTAG (boundary-scan). Digital Investigation 2006; 3(1):32–42. doi:10.1016/j.diin.2006.01.003.
22. van der Knijff R. Embedded systems analysis. In Handbook of Digital Forensics and Investigation. San Diego: Academic Press, 2010; 383–433.
23. Rehault F. Windows mobile advanced forensics: an alternative to existing tools. Digital Investigation 2010; 7(1):38–47. doi:10.1016/j.diin.2010.08.003.
24. Casey E, Bann M, Doyle J. Introduction to windows mobile forensics. Digital Investigation 2010; 6(3):136–146. doi:10.1016/j.diin.2010.01.004.
25. Grispos G, Storer T, Glisson WB. A comparison of forensic evidence recovery techniques for a windows mobile smart phone. Digital Investigation 2011; 8(1):23–36. doi:10.1016/j.diin.2011.05.016.
26. Kumar SS, Thomas B, Thomas K. An agent based tool for windows mobile forensics. In Digital Forensics and Cyber Crime. New York: Springer, 2012; 77–88.
27. Ehud DR. Windows phone 7/8 (WP7)—digital forensic investigation procedure and evidence recovery techniques. eForensics Magazine, October 2013; 2(23):36–40.
28. Jithin S, Satheesh Kumar S, Jinu Kumar S. A novel method for windows phone forensics. International Journal of Scientific & Engineering Research 2015; 6(1):1044–1047. doi:10.1016/j.jnca.2012.12.024.
29. Schaefer T, Höfken H, Schuba M. Windows phone 7 from a digital forensics' perspective. In Digital Forensics and Cyber Crime. New York: Springer, 2012; 62–76.
30. Canlar ES, Conti M, Crispo B, Di Pietro R. Windows mobile live SD forensics. Journal of Network and Computer Applications 2013; 36(2):677–648.
31. Murphy C. Windows Phone 8 Case Study: Forensic Artifacts & Challenges. https://files.sans.org/summit/Digital_Forensics_and_Incident_Response_Summit_2015/PDFs/WindowsPhone8ForensicArtifactsandCaseStudyCindyMurphy.pdf [31 October 2015].
32. Martini B, Do Q, Choo K-KR. Chapter 14—Conceptual evidence collection and analysis methodology for Android devices. In Cloud Security Ecosystem. Waltham, MA: Syngress, 2015; 285–307.
33. Guidelines on Mobile Device Forensics. NIST Special Publication 2014:800-101. nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-101r1.pdf [18 August 2015].
34. What Happens When You Press That Button? http://cellebrite.com/Pages/physical-extraction-of-mobile-data [30 October 2015].
35. Nepal S, Ranjan R, Choo K-KR. Trustworthy processing of healthcare Big data in hybrid clouds. IEEE Cloud Computing 2015; 2(2):78–84. doi:10.1109/MCC.2015.36.
36. Choo K-KR. Organised crime groups in cyberspace: a typology. Trends in Organized Crime 2008; 11(3):270–295. doi:10.1007/s12117-008-9038-9.
37. Choo K-KR. The cyber threat landscape: challenges and future research directions. Computers & Security 2011; 30(8):719–731. doi:10.1016/j.cose.2011.08.004.
38. Do Q, Martini B, Choo K-KR. A forensically sound adversary model for mobile devices. PLoS ONE 2015; 10(9):e0138449. doi:10.1371/journal.pone.0138449.
39. Yang TY, Dehghantanha A, Choo K-K R, Muda Z. Windows instant messaging app forensics: Facebook and Skype as case studies. PLoS ONE 2016; 11(3):e0150300. doi:10.1371/journal.pone.0150300.
40. Azfar A, Choo K-K R, Liu L. Android mobile VoIP apps: a survey and examination of their security and privacy. Electronic Commerce Research 2016; 16(1):73–111. doi:10.1007/s10660-015-9208-1.
41. Quick D, Martini B, Choo K-KR. Cloud Storage Forensics. Waltham, MA: Syngress Publishing / Elsevier, 2013.