Digital Forensics for Handheld Devices

Description

Approximately 80 percent of the world’s population now owns a cell phone, which can hold evidence or contain logs about communications concerning a crime. Cameras, PDAs, and GPS devices can also contain information related to corporate policy infractions and crimes. Aimed to prepare investigators in the public and private sectors, Digital Forensics for Handheld Devices examines both the theoretical and practical aspects of investigating handheld digital devices.

This book touches on all areas of mobile device forensics, including topics from the legal, technical, academic, and social aspects of the discipline. It provides guidance on how to seize data, examine it, and prepare it as evidence for court. This includes the use of chain of custody forms for seized evidence and Faraday Bags for digital devices to prevent further connectivity and tampering of evidence. Emphasizing the policies required in the work environment, the author provides readers with a clear understanding of the differences between a corporate investigation and a criminal investigation. The book also:

• Offers best practices for establishing an incident response policy and seizing data from company or privately owned digital devices
• Provides guidance in establishing dedicated examinations free of viruses, spyware, and connections to other devices that could taint evidence
• Supplies guidance on determining protocols for complicated crime scenes with external media and devices that may have connected with the handheld device

Considering important privacy issues and the Fourth Amendment, this book facilitates an understanding of how to use digital forensic tools to investigate the complete range of available digital devices, including flash drives, cell phones, PDAs, digital cameras, and netbooks. It includes examples of commercially available digital forensic tools and ends with a discussion of the education and certifications required for various careers in mobile device forensics.

Features

• Offers best practices for establishing an incident response policy and seizing data from company or privately owned digital devices
• Provides guidance in establishing dedicated examination machines free of viruses, spyware, and connections to other devices that could taint evidence
• Determines protocols for complicated crime scenes with external media and devices that may have connected with the handheld device
• Emphasizes using a chain of custody form for seized evidence and Faraday Bags for digital devices to prevent further connectivity and tampering of evidence

Table of Contents

• The Cell Phone
• The Cell Phone is Invented
• Cell Phone Models and Cell Phone Museums
• Cell Phone Protocols and Operating Systems
• Cell Phone Differences Worldwide
• Cell Phone Internal and External Storage
• The Need for a Faraday Bag
• A Survey of Tools to Investigate a Cell Phone
• The Investigative Computer and Precautions to Take
• GPS Camera Phones
• GPS Data in Picture
• GPS Accuracy and Variables
• Metadata - Linking Picture to Google Maps
• Faking GPS Data using Picasa3 and Google Earth
• Digital Camera
• Digital Camera History
• Digital Camera Operating Systems
• External Media
• Survey of Tools to Investigate a Digital Camera
• The Investigative Computer and Precautions to Take
• PDAs
• PDA History
• Learning About PDAs / Museum
• PDA Protocols, Connectivity, and Operating Systems
• The Investigative Computer and Precautions to Take
• Survey of Tools to Investigate a PDA
• GPS Devices
• GPS Device History
• GPS Operating Systems
• Survey of Tools to Investigate a GPS Device
• Corporate Investigations on a Netbook
• Authorized Requestors (Lead Investigations)
• HR, General Counsel, CIa
• Incident Response Team
• Chain of Custody
• Incident Response Policy
• Policy Infractions - Selling Stolen Items on eBay at Work
• The Need for Internet Usage Policies
• The Need for Computer Usage Policies
• The Need for Telephone Policies at Work
• The Need for a LaptoplNetbook Policy
• Silver Platter Doctrine (Turning Everything to the Police)
• Cell Phone Investigation Police
• Police find a Cell Phone at the Crime Scene
• Getting a Search Warrant
• Communication Data Warrants
• Fourth Amendment Exception
• Chain of Custody for Phone
• Susteen Secure View / Paraben Device Seizure, Examine Phone
• Using Evidence From Phone and Getting Suspects to Talk
• Police Have a Suspect for A Murder
• Seize Cell Phone
• Collect Pictures with GPS
• Metadata shows location of body and grave of victim
• Recovering Existing or Deleted Data from USB Devices
• USB Flash Drives
• USB File Systems
• Poker Chip USB drive
• Wristwatch USB drive
• Thumb Drive - Classic Style
• Lego Brick USB drive
• Pen - Digital Video Camera and USB Drive
• Survey of Tools to Recover Deleted Files
• Steganography, - Pictures with Embedded Documents
• Tools to perform Steganography
• Data Carving Tools to Detect Steganography
• Places to Work at Investigating Mobile Devices
• Private Investigators
• Lawyer
• Your Own Business
• Corporation / IT Security and Investigations
• DoD Contractor in Iraq or Afghanistan

Author Bio(s)

Eamon P. Doherty, PhD, CCE, SSCP, CPP, is an associate professor and the Cybercrime Training Lab director at Fairleigh Dickinson University (FDU), New Jersey. Dr. Doherty is a member of the High Tech Crimes Investigative Association, ASIS International, the FBI Infraguard, the American College of Forensic Examiners Institute, the FDU Digital Forensics Club, the IACSP, and the American Society of Digital Forensics & eDiscovery. Dr. Doherty has also assisted with some law enforcement cell phone investigations and is the chairman of the New Jersey Regional Homeland Security Technology Committee.

Dr. Doherty previously worked for Morris County Government in their M.I.S./I.S.D. section. Presently, Dr. Doherty has developed and taught many continuing education classes for FDU on the subjects of cell phone forensics, PDA forensics, and digital camera forensics.