A flexible framework for mobile device forensics based on cold boot attacks

Abstract

Mobile devices, like tablets and smartphones, are common place in everyday life. Thus, the degree of security these devices can provide against digital forensics is of particular interest. A common method to access arbitrary data in main memory is the cold boot attack. The cold boot attack exploits the remanence effect that causes data in DRAM modules not to lose the content immediately in case of a power cut-off. This makes it possible to restart a device and extract the data in main memory. In this paper, we present a novel framework for cold boot-based data acquisition with a minimal bare metal application on a mobile device. In contrast to other cold boot approaches, our forensics tool overwrites only a minimal amount of data in main memory. This tool requires no more than three kilobytes of constant data in the kernel code section. We hence sustain all of the data relevant for the analysis of the previously running system. This makes it possible to analyze the memory with data acquisition tools. For this purpose, we extend the memory forensics tool Volatility in order to request parts of the main memory dynamically from our bare metal application. We show the feasibility of our approach on the Samsung Galaxy S4 and Nexus 5 mobile devices along with an extensive evaluation. First, we compare our framework to a traditional memory dump-based analysis. In the next step, we show the potential of our framework by acquiring sensitive user data.

Multi-platform Process Flow Models and Algorithms for Extraction and Documentation of Digital Forensic Evidence from Mobile Devices

“…We can therefore conclude that the items chosen to measure ND were appropriate for the measurement. [38] and then other factors such as policies [32], [39], [40], nature of data [41] and type of data [15], [42] have a small contribution to inconsistencies in the evidence extraction process. From this Table 16, two factors emerged in a very significant way, namely the factor of the extraction method which is at B = 1.030 and the device factor at B = 0.078; these positive values indicate that as independent variables increase the consistency metric, even a dependent variable increases it, this is supported by the literature [28].…”

Carving and Clustering Files in Ram for Memory Forensics

“…Others have addressed the general forensic challenges and proposed solutions based on the cloud computing environments [4,29]. Additionally, the emerging spread of mobile devices and their applications put more pressure on researchers to investigate the potential forensic artifacts that can be found in their RAM [30] and the cache of their applications [31].…”