Search for: All records

The constant and rapid evolution of technology has led to some amazing achievements. Normal people can communicate with others across the globe, relatively cheap Internet of Things (IoT) devices can be used to secure homes, track fitness and health, control appliances, etc., many people have access to a seemingly endless wealth of information in small devices in their pockets, organizations can provide high availability for important services by spinning up/down servers in minutes to scale with demand through cloud services, etc. However, not everyone who uses these technologies does so with a pure heart and good intentions, many people use them to commit or help commit crimes. A nefarious individual may use cloud services to host a highly available Command and Control (C2) server, a messaging app to form and communicate with a gang or hacking group, or IoT devices as part of a botnet designed to perform Distributed Denial of Service (DDoS) attacks. When these technologies are used in the commission of a crime, they hold valuable information that needs to be recovered forensically to use as evidence to convict the perpetrators. Unfortunately, that ever-evolving technology poses many challenges for digital forensics. This paper identifies and presents many of the challenges faced in digital forensics involving mobile devices, IoT devices, and cloud services in addition to proposing a framework for solving the IoT Forensic Data Analysis problem. 

The Spectacles wearable smart glasses device from Snapchat records snaps and videos for the Snapchat service. A Spectacles device can sync data with a paired smartphone and upload recorded content to a user’s online account. However, extracting and analyzing data from a Snapchat app is challenging due to the disappearing nature of the media. Very few commercial tools are available to obtain data from Snapchat apps. This chapter focuses on the extraction and analysis of artifacts from Snapchat and, specifically, Spectacles devices paired with Apple iPhones. A methodology is presented for forensically imaging Apple iPhones before and after critical points in the Spectacles and Snapchat pairing and syncing processes. The forensic images are examined to reveal the effects of each step of the pairing process. Several photos, videos, thumbnails and metadata files originating from Spectacles devices were obtained and tied to specific times, devices and locations. The research provides interesting insights into evidence collection from Spectacles devices paired with Apple iPhones.