Mobile devices usually provide a "factory-reset" tool to erase user-specific data from the main secondary storage. 9 Apple iPhones, 10 Android devices, and 2 BlackBerry devices were tested in the first systematic evaluation of the effectiveness of factory resets. Tests used the Cellebrite UME-36 Pro with the UFED Physical Analyzer, the Bulk Extractor open-source tool, and our own programs for extracting metadata, classifying file paths, and comparing them between images. Two phones were subjected to more detailed analysis. Results showed that many kinds of data were removed by the resets, but much user-specific configuration data was left. Android devices did poorly at removing user documents and media, and occasional surprising user data was left on all devices including photo images, audio, documents, phone numbers, email addresses, geolocation data, configuration data, and keys. A conclusion is that reset devices can still provide some useful information to a forensic investigation.

Forensic examiners are frequently confronted with content in languages that they do not understand, and they could benefit from machine translation into their native language. But automated translation of file paths is a difficult problem because of the minimal context for translation and the frequent mixing of multiple languages within a path. This work developed a prototype implementation of a file-path translator that first identifies the language for each directory segment of a path, and then translates to English those that are not already English nor artificial words. Brown's LA-Strings utility for language identification was tried, but its performance was found inadequate on short strings and it was supplemented with clues from dictionary lookup, Unicode character distributions for languages, country of origin, and language-related keywords. To provide better data for language inference, words used in each directory over a large corpus were aggregated for analysis. The resulting directory-language probabilities were combined with those for each path segment from dictionary lookup and character-type distributions to infer the segment's most likely language. Tests were done on a corpus of 50.1 million file paths looking for 35 different languages. Tests showed 90.4% accuracy on identifying languages of directories and 93.7% accuracy on identifying languages of directory/file segments of file paths, even after excluding 44.4% of the paths as obviously English or untranslatable. Two of seven proposed language clues were shown to impair directory-language identification. Experiments also compared three translation methods: the Systran translation tool, Google Translate, and word-for-word substitution using dictionaries. Google Translate usually performed the best, but all still made errors with European languages and a significant number of errors with Arabic and Chinese.

Detection of improvised explosive devices is difficult and requires a wide spectrum of strategies. Detection during emplacement is the best hope. Nonimaging sensors provide several advantages over cameras in expense, robustness, and processing simplicity for this task. We describe experiments with inexpensive commercial sensors, and show how data can be combined to provide monitoring for suspicious pedestrian behavior at a 1-10 meter scale. Our approach preanalyzes terrain to rate likelihood of emplacement. We install sensors and monitor the terrain, seeking direct clues to suspicious behavior such as loitering and odd sounds such as excavation. We also use sensor data to track people by inferring their probability distributions, and use this to detect significant accelerations and atypical velocity vectors, both of which can indicate suspicious behavior. We describe experiments we have conducted with a prototype sensor network of eight kinds of sensors, from which it appears that motion and sonar sensors are the most helpful for this task.

A key challenge of sentry and monitoring duties is detection of approaching people in areas of little human traffic. We are exploring smartphones as easily available, easily portable, and less expensive alternatives to traditional military sensors for this task, where the sensors are already integrated into the package. We developed an application program for the Android smartphone that uses its sensors to detect people passing nearby; it takes their pictures for subsequent transmission to a central monitoring station. We experimented with the microphone, light sensor, vibration sensor, proximity sensor, orientation sensor, and magnetic sensor of the Android. We got best results with the microphone (looking for footsteps) and light sensor (looking for abrupt changes in light), and sometimes good results with the vibration sensor. We ran a variety of tests with subjects walking at various distances from the phone under different environmental conditions to measure limits on acceptable detection. We got best results by combining average loudness over a 200 millisecond period with a brightness threshold adjusted to the background brightness, and we set our phones to trigger pictures no more than twice a second. Subjects needed to be within ten feet of the phone for reliable triggering, and some surfaces gave poorer results. We primarily tested using the Motorola Atrix 4G (Android 2.3.4) and HTC Evo 4G (Android 2.3.3) and found only a few differences in performance running the same program, which we attribute to differences in the hardware. We also tested two older Android phones that had problems with crashing when running our program. Our results provide good guidance for when and where to use this approach to inexpensive sensing.

No abstract