Forensic Analysis of the Nintendo 3DS NAND

Exploring the Intersection between Databases and Digital Forensics

“…The authors extract data from such devices using multiple plugins developed by them (e.g., Autopsy Framework ). Finally, Pessolano et al (2019) review methods that allow forensic experts to obtain the following information from Nintendo 3DS: system activity, deleted images, Internet history items, relevant friends list information, the console's serial number and plaintext WiFi access point passwords.…”

“…Concerning this possibility, Williams et al (2021) analyze an intelligent fitness device (Fitbit Versa) using Cellebrite UFED and MSAB [Khobragade and Malik 2014] Data mining/generation -Data crawled from browser logs and data streams across networks and computers EXTR [Li et al 2014] Android Recov. Methods -Samsung Galaxy S3 SMS database considering data partition on device in three periods RECV [Liu et al 2016] Recovery of deleted record -Recovery of deleted records from SQLite3 through a new approach EXTR [Satrya et al 2016] Android Telegram -Database extracted from Telegram app text and audio artifacts from three Android mobile devices EVD [Grajeda et al 2018] Digital forensic artifacts -Data of digital forensic artifacts built from a proposed tool that stores artifacts, user account information and application logs activities EXTR [Awasthi et al 2018] Smart home hub -Data extracted from home hub (Securifi Almond), which allowed forensic analysis of artifacts related to user interaction in the hub EVD [Freiling and Hösch 2018] Evidence tampering -Data on a disk image was manipulated by graduate students to study tampered digital evidence RECV [Atwal et al 2019] Spotlight, Apple desktop -Base with Spotlight metadata (search tool, Apple) to search for persistence of deleted data in your metadata EVD [van Zandwijk and Boztas 2019] iPhone Health App -Investigates the use of data extracted from the iPhone Health application, which stores data about physical exercises performed by the user EXTR [Servida and Casey 2019] IoT, digital traces -Data from mobile apps (e.g., Nest and Wink hubs) and from IoT devices (e.g., cloud data from QBee Camera and the Swisscom Home App); Plugins were developed for data extraction EVD [Hosler et al 2019] Database for Video Forensics -Data of digital forensic videos composed by 2,000 videos from 46 physical devices representing 36 unique camera models EXTR [Pessolano et al 2019] Forensic analysis nintendo 3DS…”

Legal and ethical issues of pre-incident forensic analysis.

“…Exploiting vulnerabilities in some cases provides the investigator access to devices that would otherwise be inaccessible. Pessolano et al (2019) outlined a process for recovering Nintendo 3DS evidence that required use of a flashcart to exploit a vulnerability to access to the device. These flashcarts are advertised for illegally copying games and sale of these devices is now illegal in some jurisdictions.…”

“…Activities needed to aid understanding of a device may, in some cases, include the need to access and dump proprietary code for analysis (Dawson and Akinbi 2021). The limited support at present means that there may be the need to reverse engineer firmware to understand the operation of the device or to extract encryption keys to decrypt information held in the device (Pessolano et al 2019).…”

“…In pre-incident research a vulnerability may be used as a step in the process. Video-game hacking, on which some forensics methods rely (Pessolano et al, 2019) shares similarities to vulnerability researchers, searching for issues in software and hardware, but as a means to obtain additional access to a games system. Device manufacturers apply various methods and techniques, like cryptography and obfuscation, as a defence mechanism to keep the system and its contents hidden from those wanting to engage in hacking/reverseengineering of copy-protection mechanisms.…”