<br /> Digital<br /> The Quarterly Magazine for Digital Forensics Practitioners Issue 27 · May 2016<br /> WIN! an iPod Nano<br /> ForensicS<br /> / magazine<br /> Digital Forensic<br /> Data Analysis<br /> USING<br /> MATHEMATICA<br /> Latest News, 360<br /> Book Reviews, IRQ<br /> & much more inside!<br /> PLUS!<br /> Metadata Analysis in Email<br /> DDoS Attacks & Mobile Devices<br /> Beyond Keywords<br /> JTag & Chip Off<br /> 26<br /> 9 772042 061004<br /> Issue 27 / £14.99 TR Media<br /> <br /> EDITORIAL<br /> H<br /> ello everyone, this editorial comes hot on the<br /> heels of attendance at the Forensics Europe Expo<br /> held at Olympia, London. The digital forensics<br /> <a title="DFM27 - Online page 1" href="http://viewer.zmags.com/publication/bce1b56f?page=1"> Digital The Quarterly Magazine for Digital Fore</a> <a title="DFM27 - Online page 2" href="http://viewer.zmags.com/publication/bce1b56f?page=2"> </a> <a title="DFM27 - Online page 3" href="http://viewer.zmags.com/publication/bce1b56f?page=3"> EDITORIAL H </a> <a title="DFM27 - Online page 4" href="http://viewer.zmags.com/publication/bce1b56f?page=4"> </a> <a title="DFM27 - Online page 5" href="http://viewer.zmags.com/publication/bce1b56f?page=5"> 34 FEATURES 08 / Digital Forensics using Mathema</a> <a title="DFM27 - Online page 6" href="http://viewer.zmags.com/publication/bce1b56f?page=6"> / NEWS NEWS NEWS / European Telco's Join Force</a> <a title="DFM27 - Online page 7" href="http://viewer.zmags.com/publication/bce1b56f?page=7"> remediate “out of compliance” browsers and includ</a> <a title="DFM27 - Online page 8" href="http://viewer.zmags.com/publication/bce1b56f?page=8"> / LEAD FEATURE DIGITAL FORENSIC DATA ANALYSIS </a> <a title="DFM27 - Online page 9" href="http://viewer.zmags.com/publication/bce1b56f?page=9"> In subsequent articles, we will be examining</a> <a title="DFM27 - Online page 10" href="http://viewer.zmags.com/publication/bce1b56f?page=10"> / LEAD FEATURE At the time of writing, th</a> <a title="DFM27 - Online page 11" href="http://viewer.zmags.com/publication/bce1b56f?page=11"> / Where Possible, Use Parallelization Some Mathem</a> <a title="DFM27 - Online page 12" href="http://viewer.zmags.com/publication/bce1b56f?page=12"> / LEAD FEATURE From this list, identify</a> <a title="DFM27 - Online page 13" href="http://viewer.zmags.com/publication/bce1b56f?page=13"> </a> <a title="DFM27 - Online page 14" href="http://viewer.zmags.com/publication/bce1b56f?page=14"> / LEAD FEATURE In C-like languages where </a> <a title="DFM27 - Online page 15" href="http://viewer.zmags.com/publication/bce1b56f?page=15"> / Running as a script Mathematica supports script</a> <a title="DFM27 - Online page 16" href="http://viewer.zmags.com/publication/bce1b56f?page=16"> / LEAD FEATURE (* List contents of output file </a> <a title="DFM27 - Online page 17" href="http://viewer.zmags.com/publication/bce1b56f?page=17"> </a> <a title="DFM27 - Online page 18" href="http://viewer.zmags.com/publication/bce1b56f?page=18"> </a> <a title="DFM27 - Online page 19" href="http://viewer.zmags.com/publication/bce1b56f?page=19"> / LEGAL EDITORIAL LEGAL EDITORIAL Proposed settle</a> <a title="DFM27 - Online page 20" href="http://viewer.zmags.com/publication/bce1b56f?page=20"> / LEGAL FEATURE FBI V APPLE – TO DECRYPT OR NO</a> <a title="DFM27 - Online page 21" href="http://viewer.zmags.com/publication/bce1b56f?page=21"> Consider the example of an unidentified or unf</a> <a title="DFM27 - Online page 22" href="http://viewer.zmags.com/publication/bce1b56f?page=22"> / LEGAL FEATURE Understandably a statem</a> <a title="DFM27 - Online page 23" href="http://viewer.zmags.com/publication/bce1b56f?page=23"> Apple to provide assistance. (The FBI had reporte</a> <a title="DFM27 - Online page 24" href="http://viewer.zmags.com/publication/bce1b56f?page=24"> / LEGAL EDITORIAL LEGAL NEWS A round-up of the la</a> <a title="DFM27 - Online page 25" href="http://viewer.zmags.com/publication/bce1b56f?page=25"> </a> <a title="DFM27 - Online page 26" href="http://viewer.zmags.com/publication/bce1b56f?page=26"> / FROM THE LAB WINDOWS PHONE 8 FORENSICS Matti</a> <a title="DFM27 - Online page 27" href="http://viewer.zmags.com/publication/bce1b56f?page=27"> Figure 3. Project My Screen Appre 824), Lumia 82</a> <a title="DFM27 - Online page 28" href="http://viewer.zmags.com/publication/bce1b56f?page=28"> / FROM THE LAB / Partitions and File System S</a> <a title="DFM27 - Online page 29" href="http://viewer.zmags.com/publication/bce1b56f?page=29"> The structure of each application folder is u</a> <a title="DFM27 - Online page 30" href="http://viewer.zmags.com/publication/bce1b56f?page=30"> / FROM THE LAB · Type: · 0 = Outgoing Cal</a> <a title="DFM27 - Online page 31" href="http://viewer.zmags.com/publication/bce1b56f?page=31"> The application data is stored in the user </a> <a title="DFM27 - Online page 32" href="http://viewer.zmags.com/publication/bce1b56f?page=32"> / FROM THE LAB Figure 10. Cracking th</a> <a title="DFM27 - Online page 33" href="http://viewer.zmags.com/publication/bce1b56f?page=33"> </a> <a title="DFM27 - Online page 34" href="http://viewer.zmags.com/publication/bce1b56f?page=34"> / FEATURE DIGITAL FORENSICS & E-SIGNATURE TECH</a> <a title="DFM27 - Online page 35" href="http://viewer.zmags.com/publication/bce1b56f?page=35"> Figure 1. Viewing the Signature Properties of a D</a> <a title="DFM27 - Online page 36" href="http://viewer.zmags.com/publication/bce1b56f?page=36"> / FEATURE Figure 2.</a> <a title="DFM27 - Online page 37" href="http://viewer.zmags.com/publication/bce1b56f?page=37"> / The Importance of Consistency in Document-Ba</a> <a title="DFM27 - Online page 38" href="http://viewer.zmags.com/publication/bce1b56f?page=38"> / FEATURE As with document-based audit </a> <a title="DFM27 - Online page 39" href="http://viewer.zmags.com/publication/bce1b56f?page=39"> </a> <a title="DFM27 - Online page 40" href="http://viewer.zmags.com/publication/bce1b56f?page=40"> </a> <a title="DFM27 - Online page 41" href="http://viewer.zmags.com/publication/bce1b56f?page=41"> </a> <a title="DFM27 - Online page 42" href="http://viewer.zmags.com/publication/bce1b56f?page=42"> / INTERVIEW THE PANAMA PAPERS The news has bee</a> <a title="DFM27 - Online page 43" href="http://viewer.zmags.com/publication/bce1b56f?page=43"> increase the chances of success. Issue motivated </a> <a title="DFM27 - Online page 44" href="http://viewer.zmags.com/publication/bce1b56f?page=44"> / FEATURE METADATA ANALYSIS IN EMAIL MS Outloo</a> <a title="DFM27 - Online page 45" href="http://viewer.zmags.com/publication/bce1b56f?page=45"> / Identifying and Converting Windows FILETIME </a> <a title="DFM27 - Online page 46" href="http://viewer.zmags.com/publication/bce1b56f?page=46"> / FEATURE In the case of our target email</a> <a title="DFM27 - Online page 47" href="http://viewer.zmags.com/publication/bce1b56f?page=47"> Received: from SERVER04. domain.net ([###.###.7</a> <a title="DFM27 - Online page 48" href="http://viewer.zmags.com/publication/bce1b56f?page=48"> / FEATURE this search reveals an additional s</a> <a title="DFM27 - Online page 49" href="http://viewer.zmags.com/publication/bce1b56f?page=49"> / MSG Storage Stream Identifiers The streams </a> <a title="DFM27 - Online page 50" href="http://viewer.zmags.com/publication/bce1b56f?page=50"> / ADVERTORIAL CYBER SECURITY, ACADEMIA AND INDUST</a> <a title="DFM27 - Online page 51" href="http://viewer.zmags.com/publication/bce1b56f?page=51"> 51</a> <a title="DFM27 - Online page 52" href="http://viewer.zmags.com/publication/bce1b56f?page=52"> / FEATURE ADVANCED MOBILE DEVICE ANALYSIS USIN</a> <a title="DFM27 - Online page 53" href="http://viewer.zmags.com/publication/bce1b56f?page=53"> Figure 3 A corresponding repair pack in DLL form</a> <a title="DFM27 - Online page 54" href="http://viewer.zmags.com/publication/bce1b56f?page=54"> / FEATURE Figure 7 As m</a> <a title="DFM27 - Online page 55" href="http://viewer.zmags.com/publication/bce1b56f?page=55"> when conducting an analysis of an image file. Some</a> <a title="DFM27 - Online page 56" href="http://viewer.zmags.com/publication/bce1b56f?page=56"> / FEATURE / Analysis In this lab, a BGA169e, Sam</a> <a title="DFM27 - Online page 57" href="http://viewer.zmags.com/publication/bce1b56f?page=57"> </a> <a title="DFM27 - Online page 58" href="http://viewer.zmags.com/publication/bce1b56f?page=58"> / FEATURE APPLYING ANCHORS IN RELATIVE TIME Ou</a> <a title="DFM27 - Online page 59" href="http://viewer.zmags.com/publication/bce1b56f?page=59"> RecordNumber Event Number Event D</a> <a title="DFM27 - Online page 60" href="http://viewer.zmags.com/publication/bce1b56f?page=60"> / FEATURE USN Number Filename </a> <a title="DFM27 - Online page 61" href="http://viewer.zmags.com/publication/bce1b56f?page=61"> Two of the $UsnJrnl transactions in Table </a> <a title="DFM27 - Online page 62" href="http://viewer.zmags.com/publication/bce1b56f?page=62"> / FEATURE Anchor # </a> <a title="DFM27 - Online page 63" href="http://viewer.zmags.com/publication/bce1b56f?page=63"> Critical documents created & deleted February 11,</a> <a title="DFM27 - Online page 64" href="http://viewer.zmags.com/publication/bce1b56f?page=64"> / FEATURE Date/Time (UTC) </a> <a title="DFM27 - Online page 65" href="http://viewer.zmags.com/publication/bce1b56f?page=65"> Event Event</a> <a title="DFM27 - Online page 66" href="http://viewer.zmags.com/publication/bce1b56f?page=66"> / FEATURE Critical documents c</a> <a title="DFM27 - Online page 67" href="http://viewer.zmags.com/publication/bce1b56f?page=67"> </a> <a title="DFM27 - Online page 68" href="http://viewer.zmags.com/publication/bce1b56f?page=68"> / ADVERTORIAL / Why the Challenge? Cyb</a> <a title="DFM27 - Online page 69" href="http://viewer.zmags.com/publication/bce1b56f?page=69"> 9 772042 061004 </a> <a title="DFM27 - Online page 70" href="http://viewer.zmags.com/publication/bce1b56f?page=70"> / FEATURE BEYOND KEYWORDS Is Keyword Search b</a> <a title="DFM27 - Online page 71" href="http://viewer.zmags.com/publication/bce1b56f?page=71"> / Common Keyword Problems Effective keyword searc</a> <a title="DFM27 - Online page 72" href="http://viewer.zmags.com/publication/bce1b56f?page=72"> / FEATURE · “window” A term such as this will</a> <a title="DFM27 - Online page 73" href="http://viewer.zmags.com/publication/bce1b56f?page=73"> Figure 6 investigation techniques beyond sifting</a> <a title="DFM27 - Online page 74" href="http://viewer.zmags.com/publication/bce1b56f?page=74"> / COMPETITION COMPETITION / This issue we have</a> <a title="DFM27 - Online page 75" href="http://viewer.zmags.com/publication/bce1b56f?page=75"> / COMING SOON COMING SOON… A round-up of featu</a> <a title="DFM27 - Online page 76" href="http://viewer.zmags.com/publication/bce1b56f?page=76"> / 360 36 Letters, emails, tweets, connections and</a> <a title="DFM27 - Online page 77" href="http://viewer.zmags.com/publication/bce1b56f?page=77"> / FACEBOOK At present we have a Facebook group, w</a> <a title="DFM27 - Online page 78" href="http://viewer.zmags.com/publication/bce1b56f?page=78"> / IRQ IRQ The day forensic science died. F </a> <a title="DFM27 - Online page 79" href="http://viewer.zmags.com/publication/bce1b56f?page=79"> </a> <a title="DFM27 - Online page 80" href="http://viewer.zmags.com/publication/bce1b56f?page=80"> </a>