Feral Jundi

Wednesday, April 20, 2011

Technology: UFED Physical Pro–Handheld Mobile Phone Forensics Tool

Now this is some cool technology. I could see how this would be very helpful to law enforcement for investigations. But of course, the ACLU has shown some concern about such devices being used and how they could infringe on privacy rights. That is a legal issue, and I am more concerned about the utility of such a device.

This is what I was thinking as soon as saw the thing. The US military/contractors should have these devices at every major FOB where local nationals are working at, and every cellphone that comes through the gates or is held at the gate, should be scanned.  I would even do it without the individuals knowing that it was done.  All is fair in love and war, and if folks are using their cellphones to make communications with the enemy, I think it is within our best interest to find that out.

You could also set up check points throughout a city of interest in a war zone, to randomly collect cellphone data. Because cellphones are being used everywhere in the war zones and developing world, it is dumb not to tap into that resource and use it for some kind of tactical advantage.

Of course this technology is nothing new or radical, and I am sure the FBI and others have been using it for awhile. What is interesting though is the ease of how to collect and organize this information. Next step will be scanners that folks walk through, and the phones are automatically scanned without having to hook them up to anything.  These scanners could be hidden and placed in key places within cities, and anyone with a cellphone/smart phone, will be scanned without knowing it. Then with data mining software, all that information could be scanned for patterns or for red flag numbers, etc. This could even be added to a census program–which we have learned in places like in Iraq that this kind of data is vital for understanding the terrain in which you fight. Lots of interesting uses for this stuff. –Matt


UFED Physical Pro
Recover hidden and deleted data from mobile phones and GPS devices
The Cellebrite UFED Physical Pro is a high-end, all-in-one solution for logical and physical extraction. The UFED Physical Pro expands your current device capabilities to extract deleted mobile device data, user passwords, file system dumps, and physical extraction from GPS devices.
With expanded coverage that now includes more than 3000 phones and a growing list of GPS devices, UFED Physical Pro provides the most complete mobile forensics solution available on the market.
Utilizing UFED’s simple and field-proven user interface, a complete high-speed hex dump of the phone memory is delivered without the need of cumbersome PC drivers. Critical data such as user lock codes, and deleted information such as text messages, call history, pictures, and video are sorted and retrieved by Cellebrite’s Physical Pro engine. The UFED Physical Pro also includes robust search tools for manual hex dump analysis, as well as an expert mode, which allows advanced capabilities for researchers.
UNPARALELLED ACCESS TO PHONE MEMORY
UFED Physical Pro provides access to data inaccessible by logical methods:
•    Phone user lock code
•    Deleted data including: deleted call history, text messages, images, phonebook entries and videos
•    Access to internal application data
•    Phone internal data including: IMSI history, past SIM cards used, past user lock code history
INTELLIGENT SOFTWARE FOR DEEPER INVESTIGATIONS
The memory dump from each phone is a complex data structure. But the UFED Physical Pro software tool makes navigating this data easy. Leveraging Cellebrite’s comprehensive knowledge base of each phone’s unique memory structure, the UFED PA application focuses the user’s attention on the most critical portions of phone memory first.
Features include:
•    Built-in knowledge-base of each phone’s memory structure for automated retrieval of relevant data
•    Hierarchical “tree” view for efficient navigation
•    Advanced search capabilities both to novice and expert users
•    Customizable parsing, and search functions
*****
UFED Ruggedized
Portable, self contained field forensics kit for mobile phones and devices
Portable, fast, and easy to operate, the UFED Ruggedized System is self-powered by an internal rechargeable battery, facilitating truly untethered operation in even the most remote locations.
The Cellebrite UFED Ruggedized kit is a complete end-to-end solution contained in a hard case for safe transport which includes: a UFED Ruggedized device, a universal rapid phone charger, 85+ data cables, a USB flash drive, and other mission critical accessories.
Data is extracted onto a USB flash drive or SD card which is organized into clear and concise reports. The data can easily be exported to the leading data mining and link analysis tools, providing the fastest, most effective data acquisition and analysis system available.
UFED Ruggedized highlights and enhancements
•    Battery operated handheld device doesn’t require a computer for data extraction – The UFED Ruggedized device is completely self-contained and self-powered via internal rechargeable battery for field portability. The battery provides approximately 4 hours of continuous usage between charging and 8 hours of stand-by with an integrated LED battery state-of-charge indicator. Recharging is made easy using the standard 15V AC power source or the 12V DC rapid charging in-vehicle car adaptor.
•    Protective UFED rubberized casing – The UFED is protected by rubberized, thermoplastic housing designed to provide additional shock protection and improve grip in harsh environments, and specially-designed hinged plastic covers to protect exposed data ports from dirt, sand and other possible contaminants.
•    Superior handset support – Over 3,000 handset models supported, with monthly software updates for newly released devices prior to carrier launch. The system includes more than 85 data cables for connecting 95% of all handset models worldwide. Cellebrite has exclusive carrier agreements and works directly with cellular phone manufacturers to receive pre-production handsets prior to retail launch.
•    Complete extraction of mobile phone data – Contacts, SMS Messages, pictures, videos, call logs (dialed, received, missed), ESN/IMEI, audio files, and deleted SMS/Call History from the SIM/USIM.
•    SIM ID cloning via built in SIM reader – Extract phone data when the SIM Card is PIN locked or when the SIM is not available. Network connection is neutralized while handset is extracted, meanwhile making the phone is invisible to the network.
•    Memory Dump – Complete dump of phone file system for select handsets, providing the ability to extract otherwise inaccessible files, and user passwords.
•    Hard case for portable transport – All components included in a protective hard case with carrying strap designed to stand up to the harshest military field conditions.
Universal phone charger – For rapid charging of handsets/PDAs in the field which are found with no battery life remaining. Includes more than 40 charging tips with phone booster for the majority of handsets available worldwide.
Language support –  Unicode supported content extraction from devices using European, Asian, and Middle-Eastern alphabet systems.
Multilingual user interface – Native support for 22 languages
Link to Cellebrite website here.
—————————————————————
Should Cops Be Allowed to Scan Your Phone During a Traffic Stop?
April 19, 2011
By Glenn Derene
Are cops allowed to snoop through your cellphone during an ordinary traffic stop? According to an American Civil Liberties Union (ACLU) letter to the director of the Michigan State Police on April 13, that department has several forensic cellphone analyzers deployed in the field. Forensic analyzers are routinely used in police investigations to recover data from computers and other digital devices. Lately, cellphones have become valuable sources of evidence for police, since one phone can include almost all of an individual’s private communications (SMS, recently dialed numbers, email, Facebook and Twitter posts) as well as location data from the device’s GPS unit. The device used by the Michigan State Police is a portable forensic system called the Cellebrite UFED that can suck data from a variety of devices, including multiple Android phones and Apple iOS devices such as the iPhone and iPad. The company did not immediately return phone calls, but according to Cellebrite’s product description, the UFED can grab email, Web bookmarks, Web history, SIM data, cookies, notes, MMS, instant messages, Bluetooth devices, locations, journeys, GPS fixes, call logs, text messages, contacts and more.
This type of forensic device is nothing new, but the ACLU’s concern is that the UFED mobile units might have been used in routine traffic stops—which, the ACLU contends, would violate the Fourth Amendment’s protections against unreasonable search and seizure. According to the ACLU’s letter, the organization requested usage logs from the Michigan troopers’ devices, but the state police requested more than half a million dollars to pay for retrieval of the documents and records, which the ACLU claims is unreasonably high. In a statement to PM, Tiffany Brown of the Michigan State Police said: “The Michigan State Police will provide information in accordance with the Freedom of Information Act (FOIA). As with any FOIA request under statute, there may be a processing fee to search for, retrieve, review, examine and separate exempt materials, if any.”
We wanted to know exactly how the Fourth Amendment applies when it came to traffic stops and phones, so we spoke with Fourth Amendment expert Wayne Logan, at the Florida State University. “One way to conceive of the Fourth Amendment is as an off-and-on switch,” he says. “It’s not on if it’s not a search or a seizure, and it’s not on if the citizen consents to the search or seizure.” Logan told us that there is currently disagreement in the courts about whether cellphones, and smartphones in particular, can be searched after a person is arrested. “One way of looking at it is that phones are just like any other container. Let’s say I’m stopped for speeding and the police find cocaine, and then I’m arrested for cocaine possession; the police could search my car. They could also search any duffel bags that were in my car, and let’s say that I had a box of notecards—they could search that. If [an officer] can search that container of notecards, the question becomes: Can he also search my iPhone, which also contains note cards of a sort? But the other argument is that it differs completely in kind, since the type of information on the phone is so different.” Logan agrees that, if not under arrest, a citizen is under no legal obligation to surrender a phone. But it is unclear whether people have been volunteering their phones to the Michigan State Police or police seized those phones during arrests.
The law gets even more complicated when it comes to moving violations that involve the phone itself—such as if you were charged with talking on your phone while driving. Logan says the phone could contain evidence about the violation and therefore might be subject to seizure. However, Michigan has no law prohibiting the use of cellphones in automobiles, so that couldn’t apply there.
What happens next is unclear. If the ACLU presses the matter, it may well end up in the courts, but without a specific incident to pursue, there probably isn’t yet a case. But if this has happened to any readers, let us know in the comments box. The ACLU would probably like to hear from you as well.
Story here.

3 Comments

  1. Inside of a combat zone, absolutely.

    Outside of a combat zone, absolutely not.

    "Logan agrees that, if not under arrest, a citizen is under no legal obligation to surrender a phone. But it is unclear whether people have been volunteering their phones to the Michigan State Police or police seized those phones during arrests."

    Sure one can refuse to surrender a phone to law enforcement, but said refusal will likely constitute grounds for suspicion/probable cause and an arrest will likely follow. So either give up your phone willingly, or go to jail and give up your phone unwillingly.

    Obviously, if the phone owner is already under arrest for something else then none of this is relevant. But what if there is no probable cause? Now your GF's sexting pix on your phone are the property of the local PD, and will undoubtedly appear on the internet within days, if not sooner.

    ===

    The best defense is to store nothing on ones phone, not even numbers. And to use a cheap throwaway pay-as-you-go phone.

    DOWNLOAD
    THIS,
    R

    Comment by Render — Thursday, April 21, 2011 @ 5:45 AM

  2. This is the bottom line (see below). "Reader" your stated viewpoint: "Obviously, if the phone owner is already under arrest for something else then none of this is relevant" is dangerous. This states boundaries of the issue quite clearly:

    "No person shall be held to answer for a capital, or otherwise infamous crime, unless on a presentment or indictment of a Grand Jury, except in cases arising in the land or naval forces, or in the Militia, when in actual service in time of War or public danger; nor shall any person be subject for the same offence to be twice put in jeopardy of life or limb; nor shall be compelled in any criminal case to be a witness against himself, nor be deprived of life, liberty, or property, without due process of law; nor shall private property be taken for public use, without just compensation. "

    Government should be bound by the very document that it is sworn to uphold (not to mention that created it -government that is…). It is sad that even with all of the power given to FISA Courts and other abominations created in the "Patriot Act(s)" that government police power is still flagrantly abused. It is grave time for Liberty.

    Comment by jack — Thursday, April 21, 2011 @ 2:31 PM

  3. umm Jack…

    It's "Render", not "Reader," although I am very much a reader…

    You'll have to take up your argument regarding "probable cause" with the Supreme Court, whose decisions regarding such far pre-date the Patriot Act, 9/11, or most living US citizens.

    You can take up your argument regarding the Constitution (correct though it may be), with Presidents, Roosevelt (both), Truman, and Lincoln.

    NO
    APOLOGIES,
    R

    Comment by Render — Saturday, April 23, 2011 @ 2:46 PM

RSS feed for comments on this post.

Sorry, the comment form is closed at this time.

Powered by WordPress