The Quarterly Magazine for Digital Forensics Practitioners<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
INSIDE<br />
/ Analysis of a<br />
Windows Mobile<br />
/ Mobile Phone<br />
Challenges<br />
/ The Exabyte<br />
Challenge<br />
/ Traceback<br />
<br />
<br />
CRACKING<br />
ANDROID PATTERNS,<br />
PINS & PASSWORDS<br />
How Android implements its lock screens, PLUS<br />
techniques for circumventing and cracking them<br />
<br />
Competition!<br />
WIN 3 Forensics & Security<br />
Books from Syngress<br />
<br />
<br />
<br />
ISSUE 10<br />
FEBRUARY 2012<br />
<br />
<br />
<br />
<br />
&<a title="DF10 - Online page 1" href="http://viewer.zmags.com/publication/4ef4da69?page=1">The Quarterly Magazine for Digital Forensics Pract</a> The Quarterly Magazine for Digital Forensics Pract<a title="DF10 - Online page 2" href="http://viewer.zmags.com/publication/4ef4da69?page=2">Shape your futureForensic Computing MSc Fo</a> Shape your futureForensic Computing MSc Fo<a title="DF10 - Online page 3" href="http://viewer.zmags.com/publication/4ef4da69?page=3">EDITORIAL A </a> EDITORIAL A <a title="DF10 - Online page 4" href="http://viewer.zmags.com/publication/4ef4da69?page=4"></a> <a title="DF10 - Online page 5" href="http://viewer.zmags.com/publication/4ef4da69?page=5">CONTENTS/ DIGITAL FORENSICS MAGAZINE </a> CONTENTS/ DIGITAL FORENSICS MAGAZINE <a title="DF10 - Online page 6" href="http://viewer.zmags.com/publication/4ef4da69?page=6">/ NEWSNEWSFears of Cyber War may be unne</a> / NEWSNEWSFears of Cyber War may be unne<a title="DF10 - Online page 7" href="http://viewer.zmags.com/publication/4ef4da69?page=7">of Arnold, Jasper Tucker of Annapolis and Carly W</a> of Arnold, Jasper Tucker of Annapolis and Carly W<a title="DF10 - Online page 8" href="http://viewer.zmags.com/publication/4ef4da69?page=8">Mobile Development from ApressThe lar</a> Mobile Development from ApressThe lar<a title="DF10 - Online page 9" href="http://viewer.zmags.com/publication/4ef4da69?page=9">/ FEATUREMOBILE PHONEFORENSIC CHALLENGES</a> / FEATUREMOBILE PHONEFORENSIC CHALLENGES<a title="DF10 - Online page 10" href="http://viewer.zmags.com/publication/4ef4da69?page=10">/ FEATUREand Windows Phone. These two operat</a> / FEATUREand Windows Phone. These two operat<a title="DF10 - Online page 11" href="http://viewer.zmags.com/publication/4ef4da69?page=11"> Along with searching for an appropriate driv</a> Along with searching for an appropriate driv<a title="DF10 - Online page 12" href="http://viewer.zmags.com/publication/4ef4da69?page=12">/ FEATURE Unfortunately, the analysis of </a> / FEATURE Unfortunately, the analysis of <a title="DF10 - Online page 13" href="http://viewer.zmags.com/publication/4ef4da69?page=13"></a> <a title="DF10 - Online page 14" href="http://viewer.zmags.com/publication/4ef4da69?page=14">/ LETTERS360°HYour chance to have your say… </a> / LETTERS360°HYour chance to have your say… <a title="DF10 - Online page 15" href="http://viewer.zmags.com/publication/4ef4da69?page=15">get this about right, however we are not arrogant</a> get this about right, however we are not arrogant<a title="DF10 - Online page 16" href="http://viewer.zmags.com/publication/4ef4da69?page=16">/ LEAD FEATURECRACKING ANDROIDPATTERNS, </a> / LEAD FEATURECRACKING ANDROIDPATTERNS, <a title="DF10 - Online page 17" href="http://viewer.zmags.com/publication/4ef4da69?page=17"> The second method is the PIN lock, which has </a> The second method is the PIN lock, which has <a title="DF10 - Online page 18" href="http://viewer.zmags.com/publication/4ef4da69?page=18">/ LEAD FEATURE The techniques are general</a> / LEAD FEATURE The techniques are general<a title="DF10 - Online page 19" href="http://viewer.zmags.com/publication/4ef4da69?page=19">· A suspect may use the same PIN or password for </a> · A suspect may use the same PIN or password for <a title="DF10 - Online page 20" href="http://viewer.zmags.com/publication/4ef4da69?page=20">/ LEAD FEATURE For those of you who dec</a> / LEAD FEATURE For those of you who dec<a title="DF10 - Online page 21" href="http://viewer.zmags.com/publication/4ef4da69?page=21">Figure 9, hashcat GUI – PINunmodified and locke</a> Figure 9, hashcat GUI – PINunmodified and locke<a title="DF10 - Online page 22" href="http://viewer.zmags.com/publication/4ef4da69?page=22">/ LEAD FEATURE0000000: c8c0 b24a 15dc 8bbf </a> / LEAD FEATURE0000000: c8c0 b24a 15dc 8bbf <a title="DF10 - Online page 23" href="http://viewer.zmags.com/publication/4ef4da69?page=23"></a> <a title="DF10 - Online page 24" href="http://viewer.zmags.com/publication/4ef4da69?page=24">/ ROBSERVATIONSROBSERVATIONSMaking a dif</a> / ROBSERVATIONSROBSERVATIONSMaking a dif<a title="DF10 - Online page 25" href="http://viewer.zmags.com/publication/4ef4da69?page=25"> I think that this is a great idea… Iʼve already</a> I think that this is a great idea… Iʼve already<a title="DF10 - Online page 26" href="http://viewer.zmags.com/publication/4ef4da69?page=26">CellsiteanalysisComputerforensicsAudiovi</a> CellsiteanalysisComputerforensicsAudiovi<a title="DF10 - Online page 27" href="http://viewer.zmags.com/publication/4ef4da69?page=27">/ LEGAL EDITORIALLEGAL EDITORIAL Why I d</a> / LEGAL EDITORIALLEGAL EDITORIAL Why I d<a title="DF10 - Online page 28" href="http://viewer.zmags.com/publication/4ef4da69?page=28">/ LEGAL FEATUREPOTENTIAL LEGALHURDLES IN</a> / LEGAL FEATUREPOTENTIAL LEGALHURDLES IN<a title="DF10 - Online page 29" href="http://viewer.zmags.com/publication/4ef4da69?page=29">· If the alleged infraction is a violation of the</a> · If the alleged infraction is a violation of the<a title="DF10 - Online page 30" href="http://viewer.zmags.com/publication/4ef4da69?page=30">/ LEGAL FEATURE What this means in a prac</a> / LEGAL FEATURE What this means in a prac<a title="DF10 - Online page 31" href="http://viewer.zmags.com/publication/4ef4da69?page=31"></a> <a title="DF10 - Online page 32" href="http://viewer.zmags.com/publication/4ef4da69?page=32">/ LEGAL NEWS ALERTLEGAL NEWS ALERTManufa</a> / LEGAL NEWS ALERTLEGAL NEWS ALERTManufa<a title="DF10 - Online page 33" href="http://viewer.zmags.com/publication/4ef4da69?page=33">ASSESSMENTVENDOR INDEPENDENCE t</a> ASSESSMENTVENDOR INDEPENDENCE t<a title="DF10 - Online page 34" href="http://viewer.zmags.com/publication/4ef4da69?page=34">/ MEET THE PROFESSIONALSMEET THE DFPROFE</a> / MEET THE PROFESSIONALSMEET THE DFPROFE<a title="DF10 - Online page 35" href="http://viewer.zmags.com/publication/4ef4da69?page=35">Coming from a University how important is it to m</a> Coming from a University how important is it to m<a title="DF10 - Online page 36" href="http://viewer.zmags.com/publication/4ef4da69?page=36"></a> <a title="DF10 - Online page 37" href="http://viewer.zmags.com/publication/4ef4da69?page=37"></a> <a title="DF10 - Online page 38" href="http://viewer.zmags.com/publication/4ef4da69?page=38">/ FEATUREUSING TRACE BACKMETHODS TO ASSI</a> / FEATUREUSING TRACE BACKMETHODS TO ASSI<a title="DF10 - Online page 39" href="http://viewer.zmags.com/publication/4ef4da69?page=39">reconstruct the packet path. For example the Prob</a> reconstruct the packet path. For example the Prob<a title="DF10 - Online page 40" href="http://viewer.zmags.com/publication/4ef4da69?page=40">/ FEATUREin a real event and hence it may be</a> / FEATUREin a real event and hence it may be<a title="DF10 - Online page 41" href="http://viewer.zmags.com/publication/4ef4da69?page=41">measured in the boundary areas and that benchmark</a> measured in the boundary areas and that benchmark<a title="DF10 - Online page 42" href="http://viewer.zmags.com/publication/4ef4da69?page=42">/ FEATUREthree cities, country areas, a popu</a> / FEATUREthree cities, country areas, a popu<a title="DF10 - Online page 43" href="http://viewer.zmags.com/publication/4ef4da69?page=43">/ COMPETITIONCOMPETITION/ This issue we </a> / COMPETITIONCOMPETITION/ This issue we <a title="DF10 - Online page 44" href="http://viewer.zmags.com/publication/4ef4da69?page=44"></a> <a title="DF10 - Online page 45" href="http://viewer.zmags.com/publication/4ef4da69?page=45">/ APPLE AUTOPSYAPPLE AUTOPSYInnovation that </a> / APPLE AUTOPSYAPPLE AUTOPSYInnovation that <a title="DF10 - Online page 46" href="http://viewer.zmags.com/publication/4ef4da69?page=46">/ FEATURETHE IPHONE 4SAND THE NEW IOS 5</a> / FEATURETHE IPHONE 4SAND THE NEW IOS 5<a title="DF10 - Online page 47" href="http://viewer.zmags.com/publication/4ef4da69?page=47">Figure 1.· Murata SWSS1919013 – Wireless Module</a> Figure 1.· Murata SWSS1919013 – Wireless Module<a title="DF10 - Online page 48" href="http://viewer.zmags.com/publication/4ef4da69?page=48">/ FEATUREFigure 3. .mboxCach</a> / FEATUREFigure 3. .mboxCach<a title="DF10 - Online page 49" href="http://viewer.zmags.com/publication/4ef4da69?page=49">Mail: The once thought Holy Grail of iOS forensic</a> Mail: The once thought Holy Grail of iOS forensic<a title="DF10 - Online page 50" href="http://viewer.zmags.com/publication/4ef4da69?page=50">/ FEATURE· Images and videos created by the </a> / FEATURE· Images and videos created by the <a title="DF10 - Online page 51" href="http://viewer.zmags.com/publication/4ef4da69?page=51"></a> <a title="DF10 - Online page 52" href="http://viewer.zmags.com/publication/4ef4da69?page=52">/ FEATURECHIP-OFF FORENSICSExtracting a </a> / FEATURECHIP-OFF FORENSICSExtracting a <a title="DF10 - Online page 53" href="http://viewer.zmags.com/publication/4ef4da69?page=53">Figure 1. Various chip programmers and adapters</a> Figure 1. Various chip programmers and adapters<a title="DF10 - Online page 54" href="http://viewer.zmags.com/publication/4ef4da69?page=54">/ FEATUREFigur</a> / FEATUREFigur<a title="DF10 - Online page 55" href="http://viewer.zmags.com/publication/4ef4da69?page=55">is accomplished by using desoldering braid and li</a> is accomplished by using desoldering braid and li<a title="DF10 - Online page 56" href="http://viewer.zmags.com/publication/4ef4da69?page=56">/ FEATURE Depending on the situation, it </a> / FEATURE Depending on the situation, it <a title="DF10 - Online page 57" href="http://viewer.zmags.com/publication/4ef4da69?page=57">MaximisePrioritiseVisualiseCall IntaForen</a> MaximisePrioritiseVisualiseCall IntaForen<a title="DF10 - Online page 58" href="http://viewer.zmags.com/publication/4ef4da69?page=58">/ FEATUREADVANCED FORENSICANALYSIS ON WI</a> / FEATUREADVANCED FORENSICANALYSIS ON WI<a title="DF10 - Online page 59" href="http://viewer.zmags.com/publication/4ef4da69?page=59">· the GSM Processor and other Processor, dedicate</a> · the GSM Processor and other Processor, dedicate<a title="DF10 - Online page 60" href="http://viewer.zmags.com/publication/4ef4da69?page=60">/ FEATURE/ Why we use RAPI ToolsMost commercia</a> / FEATURE/ Why we use RAPI ToolsMost commercia<a title="DF10 - Online page 61" href="http://viewer.zmags.com/publication/4ef4da69?page=61">Figure 5. Analysis of the Samsung SGH-i600 file sy</a> Figure 5. Analysis of the Samsung SGH-i600 file sy<a title="DF10 - Online page 62" href="http://viewer.zmags.com/publication/4ef4da69?page=62">/ FEATURE The analysis of the registry ca</a> / FEATURE The analysis of the registry ca<a title="DF10 - Online page 63" href="http://viewer.zmags.com/publication/4ef4da69?page=63"> The installation of the Windows Mobile emula</a> The installation of the Windows Mobile emula<a title="DF10 - Online page 64" href="http://viewer.zmags.com/publication/4ef4da69?page=64">Reviewing the latest sports highlights</a> Reviewing the latest sports highlights<a title="DF10 - Online page 65" href="http://viewer.zmags.com/publication/4ef4da69?page=65">/ FEATURETHE EXABYTE CHALLENGEPREPARIN</a> / FEATURETHE EXABYTE CHALLENGEPREPARIN<a title="DF10 - Online page 66" href="http://viewer.zmags.com/publication/4ef4da69?page=66">/ FEATUREFigure </a> / FEATUREFigure <a title="DF10 - Online page 67" href="http://viewer.zmags.com/publication/4ef4da69?page=67">footage is selectable by camera to discern active</a> footage is selectable by camera to discern active<a title="DF10 - Online page 68" href="http://viewer.zmags.com/publication/4ef4da69?page=68">/ FEATUREFigure </a> / FEATUREFigure <a title="DF10 - Online page 69" href="http://viewer.zmags.com/publication/4ef4da69?page=69">/ NEXT ISSUECOMING SOON… A Roundup o</a> / NEXT ISSUECOMING SOON… A Roundup o<a title="DF10 - Online page 70" href="http://viewer.zmags.com/publication/4ef4da69?page=70">/ ORGANISATIONSPROFESSIONALORGANISATIONSFOR</a> / ORGANISATIONSPROFESSIONALORGANISATIONSFOR<a title="DF10 - Online page 71" href="http://viewer.zmags.com/publication/4ef4da69?page=71">The Consortium of DigitalForensic Specialists</a> The Consortium of DigitalForensic Specialists<a title="DF10 - Online page 72" href="http://viewer.zmags.com/publication/4ef4da69?page=72">/ ORGANISATIONS CDFS benefits digital for</a> / ORGANISATIONS CDFS benefits digital for<a title="DF10 - Online page 73" href="http://viewer.zmags.com/publication/4ef4da69?page=73">Practice Guidelines for digital investigations. E</a> Practice Guidelines for digital investigations. E<a title="DF10 - Online page 74" href="http://viewer.zmags.com/publication/4ef4da69?page=74"></a> <a title="DF10 - Online page 75" href="http://viewer.zmags.com/publication/4ef4da69?page=75">British Computer SocietyCybercrime & ForensicsS</a> British Computer SocietyCybercrime & ForensicsS<a title="DF10 - Online page 76" href="http://viewer.zmags.com/publication/4ef4da69?page=76">/ ORGANISATIONS “We have around 140,000 p</a> / ORGANISATIONS “We have around 140,000 p<a title="DF10 - Online page 77" href="http://viewer.zmags.com/publication/4ef4da69?page=77">High Technology CrimeInvestigation Association(</a> High Technology CrimeInvestigation Association(<a title="DF10 - Online page 78" href="http://viewer.zmags.com/publication/4ef4da69?page=78">/ ORGANISATIONS· Members can also volunteer </a> / ORGANISATIONS· Members can also volunteer <a title="DF10 - Online page 79" href="http://viewer.zmags.com/publication/4ef4da69?page=79">DigitalForensicS/ magazineBACK ISSUESDigital</a> DigitalForensicS/ magazineBACK ISSUESDigital<a title="DF10 - Online page 80" href="http://viewer.zmags.com/publication/4ef4da69?page=80">/ BOOK REVIEWSBOOK REVIEWSThor's Microso</a> / BOOK REVIEWSBOOK REVIEWSThor's Microso<a title="DF10 - Online page 81" href="http://viewer.zmags.com/publication/4ef4da69?page=81">seems to be nothing more than an extended glossar</a> seems to be nothing more than an extended glossar<a title="DF10 - Online page 82" href="http://viewer.zmags.com/publication/4ef4da69?page=82">/ COLUMNIRQCStandards & Frustrations </a> / COLUMNIRQCStandards & Frustrations <a title="DF10 - Online page 83" href="http://viewer.zmags.com/publication/4ef4da69?page=83"></a> <a title="DF10 - Online page 84" href="http://viewer.zmags.com/publication/4ef4da69?page=84"></a>