The Quarterly Magazine for Digital Forensics Practitioners<br /> INSIDE<br /> / Analysis of a<br /> Windows Mobile<br /> / Mobile Phone<br /> Challenges<br /> / The Exabyte<br /> Challenge<br /> / Traceback<br /> CRACKING<br /> ANDROID PATTERNS,<br /> PINS & PASSWORDS<br /> How Android implements its lock screens, PLUS<br /> techniques for circumventing and cracking them<br /> Competition!<br /> WIN 3 Forensics & Security<br /> Books from Syngress<br /> ISSUE 10<br /> FEBRUARY 2012<br /> 01<br /> 9 772042 061127<br /> Issue 10 / £11.99 TR Media<br /> / REGULARS / FROM THE LAB / INTRODUCING / Book Reviews<br /> robservations, 360, Jim Swuager Explains Digital Forensic Thors Microsoft<br /> news, irq & more… Chip Off Forensics Organisations Security Bible<br /> Shape your future<br /> Forensic Computing MSc Forensic Computing BSc Honours<a title="DF10 - Online page 1" href="http://viewer.zmags.com/publication/4ef4da69?page=1">The Quarterly Magazine for Digital Forensics Pract</a> <a title="DF10 - Online page 2" href="http://viewer.zmags.com/publication/4ef4da69?page=2"> Shape your future Forensic Computing MSc Fo</a> <a title="DF10 - Online page 3" href="http://viewer.zmags.com/publication/4ef4da69?page=3">EDITORIAL A </a> <a title="DF10 - Online page 4" href="http://viewer.zmags.com/publication/4ef4da69?page=4"> </a> <a title="DF10 - Online page 5" href="http://viewer.zmags.com/publication/4ef4da69?page=5">CONTENTS / DIGITAL FORENSICS MAGAZINE </a> <a title="DF10 - Online page 6" href="http://viewer.zmags.com/publication/4ef4da69?page=6">/ NEWS NEWS Fears of Cyber War may be unne</a> <a title="DF10 - Online page 7" href="http://viewer.zmags.com/publication/4ef4da69?page=7"> of Arnold, Jasper Tucker of Annapolis and Carly W</a> <a title="DF10 - Online page 8" href="http://viewer.zmags.com/publication/4ef4da69?page=8"> Mobile Development from Apress The lar</a> <a title="DF10 - Online page 9" href="http://viewer.zmags.com/publication/4ef4da69?page=9">/ FEATURE MOBILE PHONE FORENSIC CHALLENGES</a> <a title="DF10 - Online page 10" href="http://viewer.zmags.com/publication/4ef4da69?page=10"> / FEATURE and Windows Phone. These two operat</a> <a title="DF10 - Online page 11" href="http://viewer.zmags.com/publication/4ef4da69?page=11"> Along with searching for an appropriate driv</a> <a title="DF10 - Online page 12" href="http://viewer.zmags.com/publication/4ef4da69?page=12"> / FEATURE Unfortunately, the analysis of </a> <a title="DF10 - Online page 13" href="http://viewer.zmags.com/publication/4ef4da69?page=13"> </a> <a title="DF10 - Online page 14" href="http://viewer.zmags.com/publication/4ef4da69?page=14">/ LETTERS 360° HYour chance to have your say… </a> <a title="DF10 - Online page 15" href="http://viewer.zmags.com/publication/4ef4da69?page=15"> get this about right, however we are not arrogant</a> <a title="DF10 - Online page 16" href="http://viewer.zmags.com/publication/4ef4da69?page=16">/ LEAD FEATURE CRACKING ANDROID PATTERNS, </a> <a title="DF10 - Online page 17" href="http://viewer.zmags.com/publication/4ef4da69?page=17"> The second method is the PIN lock, which has </a> <a title="DF10 - Online page 18" href="http://viewer.zmags.com/publication/4ef4da69?page=18"> / LEAD FEATURE The techniques are general</a> <a title="DF10 - Online page 19" href="http://viewer.zmags.com/publication/4ef4da69?page=19"> · A suspect may use the same PIN or password for </a> <a title="DF10 - Online page 20" href="http://viewer.zmags.com/publication/4ef4da69?page=20"> / LEAD FEATURE For those of you who dec</a> <a title="DF10 - Online page 21" href="http://viewer.zmags.com/publication/4ef4da69?page=21"> Figure 9, hashcat GUI – PIN unmodified and locke</a> <a title="DF10 - Online page 22" href="http://viewer.zmags.com/publication/4ef4da69?page=22"> / LEAD FEATURE 0000000: c8c0 b24a 15dc 8bbf </a> <a title="DF10 - Online page 23" href="http://viewer.zmags.com/publication/4ef4da69?page=23"> </a> <a title="DF10 - Online page 24" href="http://viewer.zmags.com/publication/4ef4da69?page=24">/ ROBSERVATIONS ROBSERVATIONS Making a dif</a> <a title="DF10 - Online page 25" href="http://viewer.zmags.com/publication/4ef4da69?page=25"> I think that this is a great idea… Iʼve already </a> <a title="DF10 - Online page 26" href="http://viewer.zmags.com/publication/4ef4da69?page=26"> Cell site analysis Computer forensics Audio vi</a> <a title="DF10 - Online page 27" href="http://viewer.zmags.com/publication/4ef4da69?page=27">/ LEGAL EDITORIAL LEGAL EDITORIAL Why I d</a> <a title="DF10 - Online page 28" href="http://viewer.zmags.com/publication/4ef4da69?page=28">/ LEGAL FEATURE POTENTIAL LEGAL HURDLES IN</a> <a title="DF10 - Online page 29" href="http://viewer.zmags.com/publication/4ef4da69?page=29"> · If the alleged infraction is a violation of the</a> <a title="DF10 - Online page 30" href="http://viewer.zmags.com/publication/4ef4da69?page=30"> / LEGAL FEATURE What this means in a prac</a> <a title="DF10 - Online page 31" href="http://viewer.zmags.com/publication/4ef4da69?page=31"> </a> <a title="DF10 - Online page 32" href="http://viewer.zmags.com/publication/4ef4da69?page=32">/ LEGAL NEWS ALERT LEGAL NEWS ALERT Manufa</a> <a title="DF10 - Online page 33" href="http://viewer.zmags.com/publication/4ef4da69?page=33"> ASSESSMENT VENDOR INDEPENDENCE t</a> <a title="DF10 - Online page 34" href="http://viewer.zmags.com/publication/4ef4da69?page=34">/ MEET THE PROFESSIONALS MEET THE DF PROFE</a> <a title="DF10 - Online page 35" href="http://viewer.zmags.com/publication/4ef4da69?page=35"> Coming from a University how important is it to m</a> <a title="DF10 - Online page 36" href="http://viewer.zmags.com/publication/4ef4da69?page=36"> </a> <a title="DF10 - Online page 37" href="http://viewer.zmags.com/publication/4ef4da69?page=37"> </a> <a title="DF10 - Online page 38" href="http://viewer.zmags.com/publication/4ef4da69?page=38">/ FEATURE USING TRACE BACK METHODS TO ASSI</a> <a title="DF10 - Online page 39" href="http://viewer.zmags.com/publication/4ef4da69?page=39"> reconstruct the packet path. For example the Prob</a> <a title="DF10 - Online page 40" href="http://viewer.zmags.com/publication/4ef4da69?page=40"> / FEATURE in a real event and hence it may be</a> <a title="DF10 - Online page 41" href="http://viewer.zmags.com/publication/4ef4da69?page=41"> measured in the boundary areas and that benchmark</a> <a title="DF10 - Online page 42" href="http://viewer.zmags.com/publication/4ef4da69?page=42"> / FEATURE three cities, country areas, a popu</a> <a title="DF10 - Online page 43" href="http://viewer.zmags.com/publication/4ef4da69?page=43">/ COMPETITION COMPETITION / This issue we </a> <a title="DF10 - Online page 44" href="http://viewer.zmags.com/publication/4ef4da69?page=44"> </a> <a title="DF10 - Online page 45" href="http://viewer.zmags.com/publication/4ef4da69?page=45">/ APPLE AUTOPSY APPLE AUTOPSY Innovation that </a> <a title="DF10 - Online page 46" href="http://viewer.zmags.com/publication/4ef4da69?page=46">/ FEATURE THE IPHONE 4S AND THE NEW IOS 5 </a> <a title="DF10 - Online page 47" href="http://viewer.zmags.com/publication/4ef4da69?page=47"> Figure 1. · Murata SWSS1919013 – Wireless Module</a> <a title="DF10 - Online page 48" href="http://viewer.zmags.com/publication/4ef4da69?page=48"> / FEATURE Figure 3. .mboxCach</a> <a title="DF10 - Online page 49" href="http://viewer.zmags.com/publication/4ef4da69?page=49"> Mail: The once thought Holy Grail of iOS forensic</a> <a title="DF10 - Online page 50" href="http://viewer.zmags.com/publication/4ef4da69?page=50"> / FEATURE · Images and videos created by the </a> <a title="DF10 - Online page 51" href="http://viewer.zmags.com/publication/4ef4da69?page=51"> </a> <a title="DF10 - Online page 52" href="http://viewer.zmags.com/publication/4ef4da69?page=52">/ FEATURE CHIP-OFF FORENSICS Extracting a </a> <a title="DF10 - Online page 53" href="http://viewer.zmags.com/publication/4ef4da69?page=53"> Figure 1. Various chip programmers and adapters </a> <a title="DF10 - Online page 54" href="http://viewer.zmags.com/publication/4ef4da69?page=54"> / FEATURE Figur</a> <a title="DF10 - Online page 55" href="http://viewer.zmags.com/publication/4ef4da69?page=55"> is accomplished by using desoldering braid and li</a> <a title="DF10 - Online page 56" href="http://viewer.zmags.com/publication/4ef4da69?page=56"> / FEATURE Depending on the situation, it </a> <a title="DF10 - Online page 57" href="http://viewer.zmags.com/publication/4ef4da69?page=57"> Maximise Prioritise Visualise Call IntaForen</a> <a title="DF10 - Online page 58" href="http://viewer.zmags.com/publication/4ef4da69?page=58">/ FEATURE ADVANCED FORENSIC ANALYSIS ON WI</a> <a title="DF10 - Online page 59" href="http://viewer.zmags.com/publication/4ef4da69?page=59"> · the GSM Processor and other Processor, dedicate</a> <a title="DF10 - Online page 60" href="http://viewer.zmags.com/publication/4ef4da69?page=60"> / FEATURE / Why we use RAPI Tools Most commercia</a> <a title="DF10 - Online page 61" href="http://viewer.zmags.com/publication/4ef4da69?page=61"> Figure 5. Analysis of the Samsung SGH-i600 file sy</a> <a title="DF10 - Online page 62" href="http://viewer.zmags.com/publication/4ef4da69?page=62"> / FEATURE The analysis of the registry ca</a> <a title="DF10 - Online page 63" href="http://viewer.zmags.com/publication/4ef4da69?page=63"> The installation of the Windows Mobile emula</a> <a title="DF10 - Online page 64" href="http://viewer.zmags.com/publication/4ef4da69?page=64"> Reviewing the latest sports highlights </a> <a title="DF10 - Online page 65" href="http://viewer.zmags.com/publication/4ef4da69?page=65">/ FEATURE THE EXABYTE CHALLENGE PREPARIN</a> <a title="DF10 - Online page 66" href="http://viewer.zmags.com/publication/4ef4da69?page=66"> / FEATURE Figure </a> <a title="DF10 - Online page 67" href="http://viewer.zmags.com/publication/4ef4da69?page=67"> footage is selectable by camera to discern active</a> <a title="DF10 - Online page 68" href="http://viewer.zmags.com/publication/4ef4da69?page=68"> / FEATURE Figure </a> <a title="DF10 - Online page 69" href="http://viewer.zmags.com/publication/4ef4da69?page=69">/ NEXT ISSUE COMING SOON… A Roundup o</a> <a title="DF10 - Online page 70" href="http://viewer.zmags.com/publication/4ef4da69?page=70"> / ORGANISATIONS PROFESSIONAL ORGANISATIONS FOR</a> <a title="DF10 - Online page 71" href="http://viewer.zmags.com/publication/4ef4da69?page=71"> The Consortium of Digital Forensic Specialists </a> <a title="DF10 - Online page 72" href="http://viewer.zmags.com/publication/4ef4da69?page=72"> / ORGANISATIONS CDFS benefits digital for</a> <a title="DF10 - Online page 73" href="http://viewer.zmags.com/publication/4ef4da69?page=73"> Practice Guidelines for digital investigations. E</a> <a title="DF10 - Online page 74" href="http://viewer.zmags.com/publication/4ef4da69?page=74"> </a> <a title="DF10 - Online page 75" href="http://viewer.zmags.com/publication/4ef4da69?page=75"> British Computer Society Cybercrime & Forensics S</a> <a title="DF10 - Online page 76" href="http://viewer.zmags.com/publication/4ef4da69?page=76"> / ORGANISATIONS “We have around 140,000 p</a> <a title="DF10 - Online page 77" href="http://viewer.zmags.com/publication/4ef4da69?page=77"> High Technology Crime Investigation Association (</a> <a title="DF10 - Online page 78" href="http://viewer.zmags.com/publication/4ef4da69?page=78"> / ORGANISATIONS · Members can also volunteer </a> <a title="DF10 - Online page 79" href="http://viewer.zmags.com/publication/4ef4da69?page=79"> Digital ForensicS / magazine BACK ISSUES Digital</a> <a title="DF10 - Online page 80" href="http://viewer.zmags.com/publication/4ef4da69?page=80">/ BOOK REVIEWS BOOK REVIEWS Thor's Microso</a> <a title="DF10 - Online page 81" href="http://viewer.zmags.com/publication/4ef4da69?page=81"> seems to be nothing more than an extended glossar</a> <a title="DF10 - Online page 82" href="http://viewer.zmags.com/publication/4ef4da69?page=82">/ COLUMN IRQ CStandards & Frustrations </a> <a title="DF10 - Online page 83" href="http://viewer.zmags.com/publication/4ef4da69?page=83"> </a> <a title="DF10 - Online page 84" href="http://viewer.zmags.com/publication/4ef4da69?page=84"> </a>