Forensic data acquisition from cloud‐of‐things devices: windows Smartphones as a case study

Abstract

The continued amalgamation of cloud technologies into all aspects of our daily lives and the technologies we use (i.e. cloud-of-things) creates business opportunities, security and privacy risks, and investigative challenges (in the event of a cybersecurity incident). This study examines the extent to which data acquisition from Windows phone, a common cloud-of-thing device, is supported by three popular mobile forensics tools. The effect of device settings modification (i.e. enabling screen lock and device reset operations) and alternative acquisition processes (i.e. individual and combined acquisition) on the extraction results are also examined. Our results show that current mobile forensic tool support for Windows Phone 8 remains limited. The results also showed that logical acquisition support was more complete in comparison to physical acquisition support. In one example, the tool was able to complete a physical acquisition of a Nokia Lumia 625, but its deleted contacts and SMSs could not be recovered/extracted. In addition we found that separate acquisition is needed for device removable media to maximize acquisition results, particularly when trying to recover deleted data. Furthermore, enabling flight-mode and disabling location services are highly recommended to eliminate the potential for data alteration during the acquisition process. These results should provide practitioners with an overview of the current capability of mobile forensic tools and the challenges in successfully extracting evidence from the Windows phone platform.commonplace. It is also likely that when criminals communicate, their communications are intentionally or even unintentionally captured by a smartphone prior to being stored in the interconnected cloud computing environment.When law enforcement agencies (LEAs) seek to extract evidence from smartphones, they turn to digital forensic practitioners, who in turn undertake a forensic investigation. Generally, there are four main stages in a digital forensic investigation that aim to bring digital evidence to a court [2]. The first three stages, identification, preservation and analysis of the digital evidence, are mainly conducted at the scene and/or at a forensic laboratory. The last stage, presentation, mainly involves the actual presentation of the collected evidence in a court of law. Data acquisition is part of the digital forensic investigation process and often falls within the preservation stage. Before data can be analyzed, it must be acquired, and often initially examined. However, few consumer devices are designed with forensic investigation in mind. This means that digital forensic researchers and practitioners are frequently examining new technologies to determine best practices and techniques for acquiring data and extracting evidence, within the bounds of the inherent limitations imposed by the device's hardware and software configuration. In a recent work, Ab Rahman et al. highlighted the importance of forensic readiness and proposed a forensic-by-design framework f...

A Two-Layer Dimension Reduction and Two-Tier Classification Model for Anomaly-Based Intrusion Detection in IoT Backbone Networks

“…A successful attack on the IoT infrastructure can have crippling effects. For example, compromise of IoT services in smart cities could easily lead to a major chaos or even life threatening situations (see [58], [59], [60]). In this paper, a model with two-layer dimension reduction and classification was proposed.…”

CFaaS: bilaterally agreed evidence collection

“…As a result, the researchers have determined that the power status of the mobile devices matter because a data alteration issue may occur if the device power state was not correctly handled at the beginning of the acquisition process. The result also revealed that support for Windows Phone devices by the tested mobile forensic tools was still limited [39].…”

Greening Cloud-Enabled Big Data Storage Forensics: Syncany as a Case Study

“…This final phase relates to the preparation and presentation of the information resulting from the analysis phase. As observed by Cahyani et al [68], [69], [70], it is important for forensics examiners to articulate and explain complex and technical forensic terminologies to the judiciary and juries in order for them to understand "how these crimes were committed, what digital evidence is and where it may exist, and how the process of digital evidence collection was undertaken by the forensic investigators" [71].…”