Mobile forensics is an increasingly complex environment for investigators because of the rapid rate of innovation and adoption of new technologies, applications, and hardware. Smartphones are being used in so many different ways that they have become a central focus in digital forensic investigations. The mobile platform is a forensic challenge because of the number of third-party applications found on many devices, the rapidly evolving security measures employed by the device manufacturers and application developers, and the explosive growth in the use of mobile devices and options.
Mobile devices include cell phones, tablets, and wearables, with literally several thousand different devices, equipped with countless types of interfaces, operating systems, and connectivity options. This type of environment has many implications for the incident responder. The number of devices makes it impossible to be well-versed in each one, complicating analysis. The sheer number of devices also makes it very expensive to stay abreast of the major players in the market. Users tend to choose mobile devices based on their portability, number of communication interfaces and sensors (e.g., GPS), and easy wireless Internet connectivity. The features that make these devices popular are the same features that make them a critical piece of a digital forensics investigation.
In the steps that comprise this project, you will examine mobile investigative challenges, as well as the techniques and technologies available to perform mobile forensic examinations. First, familiarize yourself with the details of the case and the basics provided by the sheriff. Then, you will need to develop an investigation plan that describes the current state of mobile incident response and investigation. As you proceed through Project 4, you will get hands-on practice using the forensic tool MPE+ by AccessData and complete a forensic report. The next component will be a comparative analysis, in which you will describe the features of companion mobile phone forensic tools and recommend tools and techniques to use in the current investigation. The final component is a comprehensive forensic investigation report that will synthesize the investigation plan, forensic report, and comparative analysis.
Now that you know what’s ahead of you, move on to the first step of the project.
When you submit your project, your work will be evaluated using the competencies listed below. You can use the list below to self-check your work before submission.
With a forensic investigation focused on an iPhone, you plan to undertake a series of steps to develop the report for Sheriff Jamison. You’ll start with an investigation plan that describes the current state of mobile incident response and investigation. In this plan you will discuss the types of mobile phone technologies, challenges presented, and investigative techniques. The goal of this plan is to summarize the current landscape with mobile phone forensics, the guidelines for how examiners approach mobile phone evidence, the challenges posed by iPhones, limitations and constraints, and the expectations for forensic analysis of this device.
Next, you’ll focus on analyzing a mobile phone image using AccessData’s Mobile Phone Examiner Plus (MPE+). MPE+ is a forensics tool used to detect, collect and uncover data from iOS and Android mobile phones. As part of the AccessData suite, MPE+ integrates seamlessly with FTK, a leading tool used in digital forensic investigations. You’ll use what you learned about MPE+ to complete a forensic report.
Then, you’ll conduct a comparison analysis that scans the environment to evaluate, compare, and contrast three mobile phone forensic tools—companion tools to MPE—that could be used to address the concerns Sheriff Jamison identified in the case. This comparative analysis will culminate in your recommendation of a mobile phone forensic tool that best fits the needs of this investigation.
The final step is a comprehensive forensic investigation report to Sheriff Jamison that includes the investigation plan, as well as reports from the MPE+ investigation with your findings, the comparative tool analysis, and case overviews and conclusions.
2 days ago
As a preliminary step in the process, Sheriff Jamison asks you to write an investigation plan identifying how you, as the digital forensics investigator, can assist with the case by examining the missing girl’s iPhone for footprints, and by providing a description of the considerations and mobile investigative challenges associated with mobile forensics and mobile platforms, including third party applications, security measures, communication interfaces, and sensors. As a reporting technique, this plan should include the following:
Based on your experience and expertise, you know to include deep diving to locate deleted and locked data and timelines, as well as geographic information systems and Bring Your Own Device. As you prepare to scan for tools to use in this investigation, you outline the need to look at the phone (SIM/USIM), and any additional memory (SD/memory cards), for Call Logs, Text and SMS Messages, Call Logs, Text and Sms Messages, Contacts, Graphics, Web History, Location Information, Wi-Fi Connections call logs, text and SMS messages, contacts, graphics, web history, location information, Wi-Fi connections and application data. The goal of this plan is to summarize the current landscape with mobile phone forensics and mobile incident response and investigation, the guidelines for how examiners approach mobile phone evidence, the challenges posed by iPhones, limitations and constraints, and the expectations for forensic analysis of this device.
Construct an investigation plan that addresses the concerns listed above. An investigation plan would typically be four to six pages, not including images and references. Use APA format and submit your plan to Sheriff Jamison (your instructor) for review and feedback. You will include the investigation plan in your forensic investigation report. Now you are ready to begin your investigation!
2 days ago
Warning: This step will take you about three hours to complete. If you leave the lab without finishing it, you will have to start over again at the beginning; the lab environment does not save your information. Please access the associated resources before beginning the lab.
Now that you have an investigation plan, you are prepared to begin the analysis of the iPhone. You’ll need to review some investigation instructions, then access the virtual lab to obtain the Mobile Phone Image; it is a subset of a full iPhone image. The mobile phone forensics tool that you will be using is MPE+ by AccessData. Features of MPE+ include data carving, deleted data recovery, application data extraction and analysis, SQLite database browsing, and filtering options. MPE+ is designed to run on PCs and provide examiners with analysis reports.
You open the case that contains the processed Mobile Phone Image, conduct the laboratory investigation, and prepare a forensic report. The forensic report should include screenshots and information on mobile phone data, including the following:
Here are some resources that will help you complete the lab:
Provide any information related to the issue that you are experiencing and attach any screenshot that you may be able to produce related to the issue.
Additional Lab Support Information:
More lab-related self-help information is available if you register for CLAB 699, our free online graduate Cyber Computing Lab Assistance hub.
Registering for Cyber Computing Lab Assistance
Prepare a forensic report based on the MPE+ template. Consult with your supervisor (instructor) if you have any questions. Otherwise, review it carefully for accuracy and completeness. You will include it in your forensic investigation report.
In the next step, you will describe and compare MPE+ to three other Mobile Phone Forensic tools.
2 days ago
So far you constructed an investigation plan and analyzed the Mobile Phone Image from the missing girl’s iPhone. In this step, you will complete a comparative analysis report, focused on the evaluation of three companion tools to MPE+ that could be used in the digital forensics investigation and analysis of a mobile phone.
In this report you will identify and explain three alternative mobile phone forensic tools for the analysis of mobile phones:
The outcome will be a comprehensive identification and review of four (including MPE+) Mobile Phone forensic tools that Sheriff Jamison can use to select a tool for future investigations involving mobile phones. The structure of your analysis report should include the following:
A comparative analysis would typically be four to six pages, not including appendices and references. Use APA format and submit your plan to your supervisor (instructor) for review and feedback. You will include the comparative analysis in your forensic investigation report.
Consult with your supervisor (instructor) if you have any questions. In any case, review the results of your analysis carefully for accuracy and completeness.
2 days ago
You have conducted an exhaustive analysis of the missing teen’s iPhone. Sheriff Jamison is looking forward to seeing your forensic investigation report. It is time to synthesize the investigation plan, lab analysis with MPE+, and comparative analysis elements into a single, cohesive document that includes
The report summary/abstract should include an overview and a paragraph explaining your experience working through the case. Be sure to describe mobile investigative challenges and the techniques and technologies available to perform mobile forensic examinations. The report should flow easily from an introduction, which explains the reason for the report and investigation, to a conclusion, which summarizes the previous steps and supports recommendations for future investigations. Sign and date the final report, and initial and date each page. Make sure the report has your name, course number and section, and date. Submit your final report to Sheriff Jamison (your instructor) for evaluation.
Before you submit your assignment, review the competencies below, which your instructor will use to evaluate your work. A good practice would be to use each competency as a self-check to confirm you have incorporated all of them in your work.
2 days ago
Posted Nov 17, 2019 9:36 AM
Here are some papers you will find useful for your Project 4- investigation plan:
2 days ago
Posted Nov 17, 2019 9:36 AM
Attached is the wpa_sufficiant.conf file. You are supposed to use the one in Android Image.
In Step 7/ Pg 7, there is no Number of visits column so you can skip this part of the task.
In Step 4/ Pg 11, you will not be able to run a query on wigle.net, as SSID name failed to recognize. You can only open a new account and test some known SSID names. You may skip this step.
Also, view the attached file for unzipping your project four device files.
Extracting Zip files
I am also attaching my step-by-step directions on logging into project four lab.
2 days ago
Please use google chrome
Pass: [email protected]
Please don’t forget the report will need a table of contant
Attachments areaPreview YouTube video Mobile InvestigationsMobile Investigations