Unit 6: Email Crimes and Mobile Forensics - Subjective Questions

Email is a store-and-forward method of exchanging digital messages over a network. The email system relies on several protocols and components:

Key Components:

• MUA (Mail User Agent): The client application (e.g., Outlook, Gmail) used to compose, send, and read email.
• MTA (Mail Transfer Agent): The server that routes and transfers email between mail servers (e.g., Sendmail, Postfix).
• MDA (Mail Delivery Agent): Delivers the email to the recipient's mailbox.

Key Protocols:

• SMTP (Simple Mail Transfer Protocol): Used to send email from client to server and between servers. Operates on port 25 (or 587/465 for secure).
• POP3 (Post Office Protocol v3): Used to download email from the server to a client, typically removing it from the server. Uses port 110 (995 for SSL).
• IMAP (Internet Message Access Protocol): Used to access and manage email directly on the server, keeping it synchronized across devices. Uses port 143 (993 for SSL).

Workflow:

1. Sender composes email in MUA and sends via SMTP.
2. Sender's MTA forwards it to the recipient's MTA using DNS MX records.
3. MDA delivers it to the recipient's mailbox.
4. Recipient retrieves it using POP3 or IMAP.

An email header is the metadata section of an email that contains information about the message's origin, route, and delivery path. It is crucial in forensic investigations because it helps trace the true source of an email and detect spoofing or forgery.

Importance in Forensics:

• Reveals the actual sender's IP address and mail servers traversed.
• Helps identify email spoofing, phishing, and spam.
• Establishes a timeline of when the email was sent and received.
• Aids in tracing the geographic origin of the message.

Key Header Fields:

• From: Displayed sender address (can be spoofed).
• To / Cc / Bcc: Recipients of the message.
• Subject: Topic of the email.
• Date: Timestamp of sending.
• Received: A chain of entries (read bottom-to-top) showing every server that handled the email — most important for tracing.
• Message-ID: Unique identifier assigned to the email.
• Return-Path: Address for bounce/error messages.
• X-Originating-IP: The sender's actual IP address (if present).
• MIME-Version / Content-Type: Format details of the message.

Investigators read the Received headers from bottom to top to reconstruct the true path of the email.

Email crimes are illegal activities carried out using email as a medium. They are broadly classified into two categories:

1. Crimes committed by sending emails:

• Spamming: Sending unsolicited bulk emails, often for advertising.
• Phishing: Fraudulent emails impersonating legitimate entities to steal credentials or financial information.
• Email Spoofing: Forging the sender's address to disguise the origin.
• Email Bombing: Sending massive volumes of emails to overwhelm a target's inbox or server (a form of DoS).
• Mail Storms / Chain letters: Emails that spread rapidly, causing congestion.
• Malware/Ransomware distribution: Spreading malicious attachments or links.
• Cyberstalking / Harassment: Threatening or abusive messages.

2. Crimes supported by emails:

• Identity theft: Using stolen information gathered via email.
• Child pornography, drug trafficking, fraud where email is used as a communication channel.
• Defamation and blackmail.

Example: A phishing email pretending to be from a bank, asking the recipient to "verify" their account by entering login details on a fake website.

Email crime investigation follows a structured process to identify the perpetrator and gather admissible evidence:

Steps:

1. Examining the Email Message: Analyze the content, attachments, and displayed sender information to understand the nature of the crime.

2. Copying and Printing the Email: Preserve the email in its original form. Copy the message along with its full headers and attachments.

3. Viewing the Email Headers: Extract and analyze the full header to trace the routing information and identify originating IP addresses.

4. Analyzing the Email Headers: Read the Received fields from bottom to top to trace the path. Identify the sender's IP, mail servers, and timestamps.

5. Tracing the Email Origin: Use tools (e.g., WHOIS, nslookup, IP tracing tools) to determine the geographic location and ISP of the sender.

6. Investigating the Sender's IP / Domain: Query the ISP or domain registrar to identify the account holder (may require legal authorization).

7. Tracing the Email Server: Obtain logs from the mail server (SMTP logs) to confirm message transmission.

8. Acquiring Email Evidence from Server & Client: Collect evidence from both server logs and client machines/mailboxes.

9. Documenting and Reporting: Maintain the chain of custody, document all findings, and prepare an investigation report suitable for legal proceedings.

Several U.S. laws address email-based crimes and unauthorized computer access:

1. CAN-SPAM Act (2003):

• Controlling the Assault of Non-Solicited Pornography And Marketing Act.
• Regulates commercial email; requires accurate headers/subject lines, opt-out mechanisms, and identification of messages as advertisements.
• Prohibits false or misleading header information.

2. 18 U.S.C. § 2252A & § 2252B:

• Address the distribution of child pornography and misleading domain names, including via email.

3. 18 U.S.C. § 1037 (Fraud in Connection with Electronic Mail):

• Criminalizes accessing a computer without authorization to send multiple commercial emails, falsifying header information, and email spoofing.

4. Computer Fraud and Abuse Act (CFAA) — 18 U.S.C. § 1030:

• Addresses unauthorized access to computers, often applied to email hacking.

5. Electronic Communications Privacy Act (ECPA) — 18 U.S.C. § 2701:

• Protects electronic communications (including stored email) from unauthorized interception and access.

6. 18 U.S.C. § 1343 (Wire Fraud):

• Applies to fraud schemes carried out via electronic communications such as email (e.g., phishing scams).

These laws provide the legal framework for prosecuting spammers, phishers, and email fraudsters.

Mobile device forensics is the science of recovering digital evidence from mobile devices under forensically sound conditions. Its importance has grown significantly due to the ubiquity of smartphones.

Importance:

• Rich Source of Evidence: Mobile devices store call logs, SMS/MMS, emails, contacts, photos, videos, GPS location, browsing history, and app data — offering a comprehensive picture of a user's activity.

• Personal and Always-Connected: Devices are almost always with the user, capturing near-continuous data including location and communications.

• Ties to Cybercrimes: Increasingly, crimes involve mobile devices — fraud, harassment, drug trafficking, terrorism coordination, etc.

• Location Tracking: GPS data and cell tower logs help establish a suspect's or victim's movements and place them at a crime scene.

• Social Media & Messaging: Apps like WhatsApp, Facebook, and Signal contain critical communication evidence.

• Corporate Investigations: Used in cases of intellectual property theft, insider threats, and policy violations.

• Cloud Integration: Devices link to cloud accounts, expanding the evidence footprint.

Challenges addressed: Establishes credible, court-admissible evidence while preserving data integrity. Given the volume and sensitivity of data on mobile devices, forensic examination is often decisive in modern investigations.

The Android OS follows a layered software stack architecture. From bottom to top:

1. Linux Kernel (Bottom Layer):

• Foundation of the platform, providing core system services: process management, memory management, device drivers (display, camera, Wi-Fi, audio), power management, and security.

2. Hardware Abstraction Layer (HAL):

• Provides standard interfaces that expose device hardware capabilities to the higher-level Java API framework.

3. Native C/C++ Libraries & Android Runtime (ART):

• Native Libraries: e.g., SQLite (database), WebKit (browser engine), OpenGL (graphics), SSL, libc.
• Android Runtime (ART): Executes application code; each app runs in its own process with its own instance of ART. Uses Dalvik Executable (DEX) format. (Older versions used the Dalvik VM.)

4. Java API Framework (Application Framework):

• Provides high-level services to apps: Activity Manager, Content Providers, Resource Manager, Notification Manager, View System, Telephony Manager, Location Manager.

5. System Applications (Top Layer):

• Core apps such as Phone, Contacts, Email, Calendar, Browser, and third-party apps.

Diagram (conceptual):

+-------------------------------+
| System Applications |
+-------------------------------+
| Java API Framework |
+-------------------------------+
| Native Libraries | Android RT |
+-------------------------------+
| Hardware Abstraction Layer |
+-------------------------------+
| Linux Kernel |
+-------------------------------+

For forensics, understanding these layers helps in knowing where data is stored (SQLite databases, file system) and how to access it.

The iOS architecture is a layered stack that acts as an intermediary between hardware and applications. From bottom to top:

1. Core OS Layer:

• The lowest layer, sitting directly on hardware.
• Provides fundamental services: kernel (based on Darwin/XNU), file system, security (keychain, certificates), power management, and low-level networking (BSD sockets).
• Frameworks: Core Bluetooth, External Accessory, Security, Accelerate.

2. Core Services Layer:

• Provides fundamental system services for apps.
• Frameworks: Foundation, Core Data, Core Foundation, SQLite, CloudKit, Core Location.
• Handles data storage, iCloud, networking, and location services.

3. Media Layer:

• Provides graphics, audio, and video capabilities.
• Frameworks: Core Graphics, Core Animation, AVFoundation, OpenGL ES/Metal, Core Audio.

4. Cocoa Touch Layer (Top Layer):

• The topmost layer with which apps directly interact.
• Provides key frameworks: UIKit (UI elements), MapKit, Push Notifications, Multitasking, EventKit.
• Handles gestures, user interface, and app lifecycle.

Diagram (conceptual):

+-------------------------+
| Cocoa Touch |
+-------------------------+
| Media |
+-------------------------+
| Core Services |
+-------------------------+
| Core OS |
+-------------------------+

Forensic relevance: Data of interest (SQLite databases, plists) is largely managed through Core Services, and file system security features complicate acquisition.

The Android boot process is a sequence of steps that loads the operating system when the device is powered on:

1. Boot ROM / Primary Bootloader:

• When the power button is pressed, code in the Boot ROM (embedded in the device) executes first.
• It detects the location of the bootloader and loads it into RAM.

2. Bootloader:

• A low-level program (e.g., aboot) that initializes hardware, sets up memory, and locates/loads the kernel.
• Runs in two stages: initial memory detection, then loading the OS.
• Bootloader may be locked/unlocked (important for forensics/rooting).

3. Kernel:

• The Linux Kernel loads, sets up memory management, process scheduling, and hardware drivers.
• Mounts the root file system and starts the init process.

4. init Process:

• The first user-space process (PID 1). It reads init.rc scripts.
• Sets up file systems, environment, and starts core daemons and services.

5. Zygote and Dalvik/ART:

• Zygote is a daemon that initializes the Android Runtime. It preloads classes and resources, then forks to create app processes efficiently.

6. System Server:

• Started by Zygote; launches core system services (Activity Manager, Package Manager, Telephony, Window Manager, etc.).

7. Boot Completed:

• The Home screen/launcher is displayed, and the system broadcasts BOOT_COMPLETED.

Forensic note: The boot modes (Recovery, Fastboot, Download) are exploited during acquisition and rooting.

The iOS boot process follows a secure boot chain where each step is cryptographically verified by the previous one:

1. Boot ROM (Hardware Root of Trust):

• When the device is powered on, the Boot ROM code executes. It is read-only and contains Apple's Root CA public key.
• It verifies and loads the Low-Level Bootloader (LLB).

2. Low-Level Bootloader (LLB):

• Verified by the Boot ROM. It performs initialization and then locates and verifies the next stage bootloader, iBoot.

3. iBoot:

• The second-stage bootloader. It verifies and loads the iOS kernel (XNU).
• If verification of any stage fails, the device enters Recovery Mode or DFU (Device Firmware Upgrade) Mode.

4. Kernel (XNU):

• Once verified, the kernel initializes and mounts the file system, then starts system processes.

5. Springboard:

• The user interface (home screen) loads, completing the boot.

Secure Boot Chain: Each component is signed and verified, ensuring only Apple-trusted code runs. This is the Chain of Trust.

Forensic Relevance:

• DFU Mode and Recovery Mode can be used to attempt low-level acquisition.
• The secure boot chain makes physical acquisition extremely difficult; investigators may rely on exploits (e.g., checkm8) affecting the Boot ROM of older devices.
• Encryption tied to hardware (Secure Enclave) protects data even during boot.

The mobile forensics process follows systematic phases to ensure evidence integrity and admissibility:

1. Preservation / Seizure:

• Secure and isolate the device from networks (using Faraday bags, airplane mode) to prevent remote wiping or data alteration.
• Document the device state (on/off, battery, connections).
• Maintain chain of custody.

2. Acquisition:

• Create a forensic copy of the device data.
• Types: Manual, Logical, File System, and Physical acquisition.
• Use write-blockers/forensic tools (Cellebrite UFED, Oxygen Forensics, XRY).

3. Examination and Analysis:

• Analyze acquired data: call logs, messages, contacts, media, app data, deleted data, and location information.
• Use forensic tools to parse databases (SQLite), plists, and carve deleted files.
• Correlate evidence to establish facts/timelines.

4. Reporting / Documentation:

• Prepare a detailed, clear investigation report documenting tools used, methodology, findings, and conclusions.
• Ensure findings are reproducible and defensible in court.

Key Principles:

• Preserve data integrity (hashing before/after with MD5/SHA).
• Follow standardized procedures (e.g., NIST guidelines).
• Handle volatile data carefully.

This structured approach ensures evidence remains legally admissible.

Both are methods to extract data from mobile devices but differ in depth and technique:

Summary:

• Logical acquisition is quicker and safer but retrieves only accessible data.
• Physical acquisition is more thorough, recovering deleted data, but is technically demanding and may be hindered by encryption.

Investigators often begin with logical acquisition, then attempt physical acquisition if deeper analysis is needed.

Cellular network data is a valuable source of evidence maintained by mobile service providers, useful for tracing communications and locations.

Types of Cellular Network Data:

1. Call Detail Records (CDRs):

   • Logs maintained by carriers containing: caller and callee numbers, date/time, call duration, cell tower (Cell ID) used, and IMEI/IMSI.
   • Do NOT contain call content but reveal communication patterns.

2. Cell Tower / Location Data:

   • Records of which cell towers a device connected to, allowing approximate location tracking (triangulation).

3. SMS/MMS Records:

   • Metadata (and sometimes content) of text messages.

4. Subscriber Information:

   • Account holder details, billing information, and device (IMEI) associations.

5. Data Session Records:

   • Internet usage details, IP addresses assigned, and data volumes.

Investigation Steps:

• Obtain legal authorization (subpoena/warrant) to request records from the carrier.
• Analyze CDRs to establish communication links between suspects.
• Use cell tower data to map movement and place a device at a location/time.
• Correlate IMEI/IMSI with SIM and handset to confirm device identity.
• Cross-reference with on-device evidence.

Key Identifiers:

• IMEI: Unique hardware identifier of the phone.
• IMSI: Unique subscriber identifier stored on the SIM.
• MSISDN: The phone number.

Cellular data is critical for corroborating timelines and establishing suspect locations.

A SIM (Subscriber Identity Module) card is a smart card that stores subscriber and network data. It has a hierarchical file system.

SIM File System Structure:
The SIM uses a tree-like hierarchical structure of files:

1. MF (Master File): The root directory of the file system.
2. DF (Dedicated Files): Directories that group related files (e.g., DF-GSM, DF-Telecom).
3. EF (Elementary Files): Actual data files that store information.

Important Elementary Files (Forensic Value):

• ICCID (Integrated Circuit Card ID): Unique SIM serial number.
• IMSI (International Mobile Subscriber Identity): Subscriber ID.
• ADN (Abbreviated Dialing Numbers): Contacts/phonebook stored on SIM.
• LND (Last Numbers Dialed): Recently dialed numbers.
• SMS: Text messages stored on the SIM.
• LOCI (Location Information): Last location area code registered.
• FDN (Fixed Dialing Numbers).

Data Acquisition Method:

1. Isolation: Prevent network connectivity to avoid data changes.
2. SIM Card Reader: Use a forensic SIM card reader connected to a workstation.
3. Forensic Software: Tools (e.g., Cellebrite, .XRY, SIMcon) read the file system.
4. PIN/PUK handling: If SIM is PIN-locked, the PUK may be needed (from carrier).
5. Extraction: Acquire ICCID, IMSI, contacts, SMS, and location info.
6. Hashing & Documentation: Compute hash values to preserve integrity and document all findings.

SIM analysis complements handset analysis, providing subscriber identity and network-related evidence.

Phone locks are security mechanisms that restrict unauthorized access to a device. They pose significant challenges to forensic examiners.

Types of Phone Locks:

1. PIN Lock: A numeric code (usually 4-6 digits) required to unlock the device.

2. Password Lock: An alphanumeric password, more complex and secure than a PIN.

3. Pattern Lock: A gesture-based lock (Android) where the user connects dots in a specific sequence on a grid.

4. Biometric Locks:

   • Fingerprint: Uses the user's fingerprint.
   • Face Recognition: Uses facial features (e.g., Apple Face ID).
   • Iris Scan: Uses eye patterns.

5. SIM Lock (PIN): Protects the SIM card itself, requiring a PIN at boot.

Implications for Forensics:

• Locks prevent direct access, hindering logical/physical acquisition.
• Encryption tied to lock: Modern devices encrypt data using a key derived from the passcode, so bypassing the lock is often necessary to decrypt data.
• Bypass techniques: Include exploiting vulnerabilities, using specialized tools (e.g., Cellebrite, GrayKey), brute-forcing (limited by wipe policies), or obtaining the passcode legally.
• Anti-forensic features: Some devices wipe data after multiple failed attempts.
• Biometrics: May be legally compelled in some jurisdictions, unlike passcodes.

Overcoming phone locks while preserving data integrity is one of the biggest challenges in mobile forensics.

Both rooting and jailbreaking are techniques to gain elevated (privileged) access to a mobile device's operating system, bypassing manufacturer restrictions.

Rooting (Android):

• The process of gaining root (superuser) access on an Android device.
• Allows full control over the system, including access to protected system files and partitions.
• Achieved via exploits, custom recovery (e.g., TWRP), or tools (e.g., Magisk, SuperSU).

Jailbreaking (iOS):

• The process of removing software restrictions imposed by Apple on iOS.
• Grants root access to the file system, allowing installation of unauthorized apps and access to protected data.
• Achieved via exploits (e.g., checkra1n, unc0ver).

Role in Mobile Forensics:

• Deeper Access: Root/jailbreak access enables physical acquisition and access to app databases, deleted data, and system files not otherwise reachable.
• Allows bypassing certain security restrictions to extract more complete evidence.

Risks and Concerns:

• Data Alteration: Rooting/jailbreaking modifies the device, potentially altering evidence and compromising integrity and admissibility.
• Instability/Bricking: May damage or render the device unusable.
• Security Voids: Disables built-in protections, exposing device to malware.
• Legal Issues: Modifying a device may violate evidentiary rules if not properly documented and justified.

Best Practice: Investigators must document any rooting/jailbreaking, justify its necessity, and prefer non-invasive methods first to preserve evidentiary value.

Logical acquisition retrieves accessible data (files, databases) using device APIs and backup mechanisms. It does not recover deleted data but is safer and faster.

Logical Acquisition on Android:

1. Enable USB Debugging: Turn on Developer Options and enable USB Debugging (ADB).
2. Connect Device: Use a USB cable and authorize the connection on the device.
3. Use ADB (Android Debug Bridge):
   • adb backup command or forensic tools to pull data.
   • Extract app data, contacts, SMS, call logs, media, and system files (accessible without root).
4. Forensic Tools: Use tools like Cellebrite UFED, MOBILedit, or Oxygen Forensics to automate logical extraction.
5. Content Providers: Access data via Android's content provider interfaces.
6. Hash & Document: Compute hashes and record all steps.

Logical Acquisition on iOS:

1. Establish Trust: Connect device and tap Trust on the device (may require passcode).
2. iTunes/Finder Backup: Create a backup (preferably encrypted, which includes more data such as health and keychain).
3. Forensic Tools: Use tools (e.g., Cellebrite, Elcomsoft iOS Forensic Toolkit) to parse the backup.
4. Extract Data: Retrieve contacts, messages, call history, photos, app data, and browsing history.
5. Lockdown Files: Use pairing/lockdown records if available to access a locked device.
6. Hash & Document.

Key Points:

• Both methods leverage OS-provided interfaces.
• Data integrity must be preserved with hashing.
• Best used as the first step before more invasive physical acquisition.

Physical acquisition creates a bit-by-bit image of a device's flash memory, capturing all data including deleted files and unallocated space. It is more thorough but technically challenging.

Physical Acquisition on Android:

1. Rooted Access: Root the device (if permitted) to gain low-level access, then use dd command to image partitions.
2. Custom Recovery: Boot into a custom recovery (e.g., TWRP) to image the device without altering the main system.
3. JTAG (Joint Test Action Group): Connect to the device's JTAG test access ports (TAPs) on the circuit board to read raw memory directly.
4. Chip-Off: Physically remove the NAND flash memory chip and read it using a specialized reader. Destructive but recovers all data.
5. Bootloader Exploits: Use exploits/download modes (e.g., Qualcomm EDL, Samsung Download mode) to dump memory.
6. Forensic Tools: Cellebrite UFED, etc.

Physical Acquisition on iOS:

1. Highly Restricted: iOS's hardware encryption (Secure Enclave) and secure boot chain make physical acquisition very difficult on modern devices.
2. Exploits: Use bootrom exploits like checkm8 (affecting older devices A5–A11) with tools such as checkra1n to gain low-level access.
3. DFU Mode: Place the device in DFU mode and use exploit-based tools (e.g., Elcomsoft iOS Forensic Toolkit) to attempt a physical image.
4. Decryption Dependence: Even with a physical image, data is encrypted; the passcode-derived key is needed for decryption.

Considerations:

• JTAG and Chip-off are hardware-level techniques requiring expertise; chip-off is destructive.
• Encryption is the biggest obstacle for both platforms.
• Always hash images and document the destructive/invasive process for admissibility.

Mobile forensics faces numerous challenges due to the diversity and rapid evolution of mobile technology:

1. Hardware and OS Diversity:

• Numerous manufacturers, models, and OS versions make it difficult to have a universal tool or method.

2. Rapid Technological Change:

• Frequent updates to OS and hardware require tools to be constantly updated; new security features quickly outdate existing techniques.

3. Encryption:

• Full-disk and file-based encryption (e.g., iOS Secure Enclave, Android FBE) make data inaccessible without the passcode/key.

4. Security Locks:

• PINs, passwords, patterns, and biometrics block access. Anti-brute-force and auto-wipe features complicate bypass.

5. Data Volatility & Alteration:

• Data can change constantly (background sync, notifications). Remote wipe capabilities threaten evidence.

6. Cloud Storage:

• Data may reside in the cloud rather than the device, raising jurisdictional and access issues.

7. Proprietary Formats:

• App data stored in proprietary or obfuscated formats is hard to parse.

8. Anti-Forensic Techniques:

• Apps that encrypt, hide, or auto-delete data (e.g., secure messengers, vault apps).

9. Legal and Jurisdictional Issues:

• Privacy laws, cross-border data, and warrant requirements limit acquisition.

10. Tool Limitations & Cost:

• Forensic tools are expensive and may not support all devices; validation of tools is needed.

11. Preserving Integrity:

• Unlike static disks, mobile devices are 'live'; maintaining a forensically sound state is difficult.

These challenges require examiners to continually update skills, tools, and procedures.

A mobile forensics investigation report is a formal document that presents the methodology, findings, and conclusions of an examination. It must be clear, accurate, and defensible in court.

Importance:

• Serves as the primary deliverable and evidence in legal proceedings.
• Ensures the investigation is reproducible, transparent, and credible.
• Communicates technical findings to non-technical stakeholders (judges, juries, lawyers).
• Establishes the chain of custody and integrity of evidence.

Key Elements / Structure:

1. Title and Case Information: Case number, investigator name, date, and organization.

2. Executive Summary: Brief overview of the case, objectives, and key findings in plain language.

3. Introduction / Background: Purpose and scope of the investigation.

4. Device / Evidence Details: Description of the device — make, model, IMEI, serial number, condition, SIM details.

5. Chain of Custody: Documented handling of evidence from seizure to analysis, showing integrity was maintained.

6. Tools and Methodology: Forensic tools used (with versions), acquisition methods (logical/physical), and procedures followed.

7. Acquisition Details: How data was extracted, including hash values (MD5/SHA) before and after to prove integrity.

8. Findings / Analysis: Detailed results — recovered data (messages, calls, media, location), timelines, and relevance to the case, supported by screenshots/evidence.

9. Conclusion: Summary of what the evidence indicates, based on facts.

10. Appendices / Exhibits: Supporting data, logs, and technical details.

Best Practices:

• Use clear, objective, and unbiased language.
• Distinguish facts from opinions.
• Ensure completeness and accuracy so findings can withstand scrutiny.