Tools Classification System

00:00

hi and welcome to everyday digital forensics. I'm your host just then, you said. And in today's module of mobile forensics, I want to go over the tools classification system

00:15

today is not sure where to go over the tool classifications system.

00:18

We're gonna break down into what Emanuel extractions. Illogical extraction, hex dumping, Jay tagging

00:24

chip off and micro reading when it comes to tools itself

00:30

before I can go over there,

00:32

take a moment. And do you recall what some of the challenges founds in mobile forensics are?

00:46

These are some of the challenges of mobile forensics, as discussed earlier. Most of them are is over on the fact that a mobile device is evolved out in nature. You have many streams of data pulling in and out many different types of protocols, such as Bluetooth, your NFC, your mobile data, your Web data,

01:06

your emails and everything in between.

01:08

There's also the fact that there's so many different models of mobile devices supporting operating systems and manufactures, which lead to multiple cables different specific drivers.

01:21

Can you think of any other challenges of normal forensics outside of this list?

01:26

Moving over to today's topic tools classification system

01:30

but a friend's ex tools they made.

01:33

These are This is a system used to classifying that specific tool set.

01:38

Not each tools the same, and not each tool can do exactly the same as the other one. So if you ever see the tool kit or forensic examiner, they may have multiple tools, software, hardware and so on to kind of support the different methods of extraction.

01:56

Your first method of extraction is your manual obstruction. This is a physical extraction of taking the device, logging in, scrolling through and

02:05

manipulating the buttons, the keyboard in touch screens just to get to the data unique

02:09

for extraction. This data recording could be used by an extra, not digital camera.

02:15

There's some tools that happens if I look to provide the forensics examiner with the ability to documenting

02:20

categorized. The information recorded more quickly,

02:23

however it's become more inclusive is difficult and perhaps unachievable. One. Encountering a

02:30

missing or broken LCD screen or damaged or missing Keeve keyboard innovates

02:38

some of the challenges that this also provides two examiners

02:40

is the fact that it's not. Only it's very time consuming can be impossible to recover deleted data,

02:46

but if the phones could figure to a language that's unknown to examiner,

02:51

it may be difficult to successfully navigate through the device itself.

02:55

Our next step is the logical extraction. This process starts based on a series of commands or the established connection.

03:02

This could be seen with the android debug bridged, a beady where you're connected to this particular device and you're able to send commands to that particular devices shop. If you understand

03:15

if you have the route credentials, you can also log in as a route and run even more commands.

03:22

The mobile device will respond accordingly, and these responses are returned to the workstation itself.

03:29

The Examiner should be aware of issues associated with specific connectivity methods as different connection types

03:36

and associated protocols may result in zeta being modified or different amounts or types of data being extracted.

03:45

Our next extraction method is hex dumping Jay Attack.

03:51

So the mix. These two were kind of joined together because their direct access to raw data in flash memory

03:57

there's a challenge with a tool parson and decoding the capture data itself. Heck, stumping is the process of uploading a modified boot loader into a protected area of memory such as RAM.

04:10

A series of commands is sent from the Flasher box, which is connected to the mobile device,

04:15

and to the first station. The Flasher box sets the mobile device itself into a diagnostic mode, and once in dynasty mold, the Flasher box captures all or sections of flash memory and sends it to the forensic workstation over the same communication linked used for uploading.

04:33

There are very rare cases where extractions can be accomplished using WiFi

04:40

and then Drake Tag, also known as Joint Test Action Group,

04:44

defines a common test interface for processor memory and others. Semiconductor chips examiners can communicate with a J tag compliant component by utilizing special purpose standalone programmer devices to probe to find test points. So what does this mean? So if you have access to the actual memory trip off

05:02

a device

05:03

using

05:05

up probe, you're able to actually point and find the J type here, you'll connect to it and extract data needed.

05:13

The methods typically evolved, attaching a cable from the workstation to the mobile devices J tag interface and access the memory via the devices Michael Processor to produce an image

05:24

J tag is very invasive, compared to the hacks thumping as it access to the connectors frequently require that the examiners dismantles some of the mobile devices to obtain access to establish the wiring connections.

05:40

Next on the list is chip off. This is accusation directly from flash memory.

05:46

It requires physical removal of fash memory

05:48

provides the ability to create binary images of that removed chits.

05:53

However, extensive training is required.

05:58

J tag is more commonly used in chip off in the sense

06:01

one of the challenges with chip off is there is a wider range of chip types. There's so many different raw data formats and the risk of causing physical damage to trip during the extraction point, maybe twice a risk for an examiner. That's why they rather use J tag, which connects directly to that devices ports rather than

06:20

extracting the chip itself.

06:25

Not for my Corinne.

06:27

This isn't there's no known US law enforcement's that's performed this level accusation, but this level accusation is possible.

06:34

It requires a team of experts, proper equipment, time and in depth knowledge of the preparatory information. Remember, mobile devices? There's a plethora of mobile devices, including hardware, software, the device itself.

06:48

This method itself is only attempted in high profile cases do the extreme technicalities,

06:55

and this requires recording the observation of the gates on a nano Nord chip using an electronic Michael trips. We won't get into too much detail on this on as there's no evidence off is actually being done

07:08

from a U. U S law enforcement.

07:11

So I hope you enjoyed today's video where we discussed the different tool quantification system such as the manual extraction, the logical extraction, the hex dumping and J tech your trip off and you're migrating.