Unit 6: Email Crimes and Mobile Forensics

Digital evidence increasingly lives in email accounts and mobile handsets, so investigators must master both the protocols that move messages and the layered architectures that store data on phones. This unit treats email and mobile devices as two evidence sources bound by one principle: acquire without altering, and document every step for court admissibility.

• Locard's exchange, digitally: Every communication and action leaves a trace — headers, logs, cache, SQLite tables — that can be recovered and correlated.
• Order of volatility: Prioritise data that disappears first (RAM, live network state) over static storage (flash, SIM).
• Chain of custody: Each transfer of evidence is logged with time, handler and hash so integrity is provable.
• Hashing for integrity: MD5/SHA-256 of an image is recorded at acquisition and re-verified before analysis.

II. Email Crimes

How messages travel, how they are abused, and the statutes that apply.

A. Understand email basics

Email is a store-and-forward system governed by defined protocols and message structure.

• Transport protocols: SMTP (port 25/587) sends mail between servers; POP3 (110) downloads and removes; IMAP (143/993) syncs mail kept on the server.
• Message anatomy: An envelope (routing), a header (metadata), and a body (content, MIME-encoded for attachments).
• Header fields: Received: lines stack chronologically bottom-to-top, tracing each hop; Message-ID uniquely identifies the mail; X-Originating-IP may reveal the sender host.
• Client vs. web mail: Client mail (Outlook) stores locally in .pst/.ost; web mail (Gmail) stores server-side, requiring provider cooperation or logged-in access.

B. Understand email crime investigation and its steps

Investigation reconstructs the true origin and intent of a suspect message.

• Examine the message: Open the original mail and preserve it as .eml, computing a hash.
• Read the full header: Parse Received: chains top-down to find the earliest originating server and real IP.
• Trace the sender: Resolve the IP with WHOIS and reverse DNS; correlate timestamps across hops.
• Obtain server logs: Request SMTP transaction logs from the ESP to confirm delivery path.
• Identify the suspect: Serve legal process on the ISP to map IP-to-subscriber at the relevant time.

C. U.S. laws against email crime

Several federal statutes criminalise fraudulent, unsolicited, or intrusive email.

• CAN-SPAM Act (2003): Bans deceptive headers and subject lines in commercial email and mandates an opt-out mechanism.
• 18 U.S.C. § 1030 (CFAA): Penalises unauthorised access to protected computers, covering account hijacking.
• 18 U.S.C. § 2701 (Stored Communications Act): Protects stored electronic communications from unlawful access.
• 18 U.S.C. § 2251 / § 2252: Address child exploitation material distributed via email.

III. Mobile Device Forensics Foundations

Why phones matter as evidence and how their software is built.

A. Understand the importance of mobile device forensics

Mobile devices are the richest single source of personal evidence in modern casework.

• Volume of data: Calls, SMS, chats, GPS locations, photos with EXIF, app databases and cloud tokens sit on one device.
• Ubiquity: Handsets accompany users continuously, tying activity to time and place.
• Correlation power: IMEI (device) and IMSI (subscriber) link a handset to a person and a network.

B. Illustrate architectural layers and boot processes of Android and iOS Devices

Both platforms stack hardware-backed layers, but their boot chains differ.

1. Android: Layers run Linux kernel → HAL → Android Runtime (ART) → framework → apps. Boot: Boot ROM → Bootloader → kernel → init → Zygote → System Server. Data lives in /data/data as SQLite.
2. iOS: Layers run Core OS → Core Services → Media → Cocoa Touch. A secure boot chain verifies each stage: Boot ROM → LLB → iBoot → kernel, each signed by Apple. Files reside under /private/var/mobile.

• Trust anchor: iOS enforces cryptographic signature checks at every boot stage; Android's verified boot (dm-verity) is comparable but more OEM-variable.

C. Explain the steps involved in mobile forensics process

A structured workflow keeps mobile evidence defensible.

• Seizure & isolation: Bag the device and block signals with a Faraday bag to prevent remote wipe.
• Preservation: Keep it charged; note battery and lock state.
• Acquisition: Extract data by the least intrusive viable method (logical before physical).
• Examination & analysis: Parse artefacts, carve deleted records, build a timeline.
• Reporting: Present findings with hashes and methodology.

IV. Network and Card-Level Evidence

Data held by the carrier and on the SIM.

A. Investigate cellular network data

Carrier records place a device on the network even when the handset is unavailable.

• CDRs: Call Detail Records log calling/called numbers, duration, and serving cell ID.
• Cell-site location: The tower and sector identify the handset's approximate area; multiple towers enable triangulation.
• Identifiers: Network logs tie IMEI and IMSI to activity for subpoena correlation.

B. Understand sim file system and its data acquisition method

The SIM is a small smart card with a hierarchical file system holding subscriber and message data.

• File hierarchy: A Master File (MF) root contains Dedicated Files (DF) directories and Elementary Files (EF) holding data.
• Key EFs: EF_IMSI (subscriber ID), EF_ADN (abbreviated dialling / contacts), EF_SMS (stored messages), EF_LOCI (last location area).
• Acquisition method: Read the card with a PC/SC smart-card reader using APDU commands; if PIN-locked, obtain the PUK from the carrier — three wrong PINs then ten wrong PUKs permanently blocks it.

V. Access Barriers and Privilege Escalation

Getting past the screen and gaining root-level reach.

A. Illustrate phone locks

Screen locks are the first obstacle to physical possession of the data.

• Knowledge factors: PIN, alphanumeric passcode, or pattern (a 3×3 grid gesture).
• Biometric factors: Fingerprint and face recognition, backed by a Secure Enclave (iOS) or TEE (Android).
• Encryption tie-in: On modern devices the passcode derives the disk-encryption key, so a locked device is also an encrypted one.

B. Discuss rooting of android and jailbreaking of iOS devices

Both remove vendor restrictions to expose otherwise protected storage.

1. Rooting (Android): Gains superuser (su) access, unlocking /data for full logical or physical reads; often needs an unlocked bootloader, which may trigger a data wipe.
2. Jailbreaking (iOS): Exploits a boot- or kernel-chain flaw to disable signature enforcement, permitting a shell and raw filesystem access.

• Forensic caution: Both modify the device and can void integrity; use only when documented, justified, and no non-invasive path exists.

VI. Data Acquisition Techniques

Two acquisition depths, each with distinct reach and risk.

A. Perform logical acquisition on Android and iOS devices

Logical acquisition copies live, accessible files and databases through the OS.

• Android: Use adb backup or adb pull (USB debugging enabled) to retrieve app SQLite DBs such as mmssms.db.
• iOS: Trigger an iTunes-style backup over a trusted pairing; parse the Manifest.db to map hashed backup files to app data.
• Scope: Fast and low-risk, but misses deleted and unallocated data.

B. Perform physical acquisition on Android and iOS devices

Physical acquisition images the raw flash bit-for-bit, recovering deleted and slack data.

• Android methods: dd over root/adb, custom recovery, JTAG (test-port access), or chip-off (desolder the eMMC and read directly).
• iOS methods: Requires a jailbreak or a hardware/BootROM exploit (e.g. checkm8-class) because the secure boot chain blocks raw access.
• Encryption limit: A physical image of an encrypted device is unreadable without the key, so passcode recovery often gates the analysis.

VII. Challenges and Reporting

Why mobile work is hard and how to conclude it.

A. Discuss mobile forensics challenges

The pace and diversity of mobile technology constantly erode standard techniques.

• Fragmentation: Thousands of Android OEMs, models and OS versions defeat one-size tools.
• Encryption: File-based encryption and secure enclaves block raw reads without keys.
• Anti-forensics: Remote wipe, app-level encryption and rapid updates destroy or hide data.
• Cloud dependence: Much data lives off-device, requiring separate legal process.

B. Prepare investigation report

The report converts extracted data into defensible, reproducible findings.

• Case identifiers: Examiner, device make/model, IMEI, dates and custody log.
• Methodology: Tools and versions used, acquisition type, and every action taken.
• Integrity: Acquisition and verification hashes for each image.
• Findings: Artefacts with source paths, timeline, and objective interpretation — conclusions kept within the evidence and free of speculation.