Cyber Forensics: iPhone Under Investigation

Crimes and unauthorized acts committed in the workplace seem to increasingly leave evidence trails in the physical and cyber worlds. Physical offenses from office bullying and harassment to clear computer crimes such as data theft cause the lines to blur between physical and computer investigations.

As the landscape blurs newly emerging portable devices and social networking applications are expanding the places and changing the ways network and security teams within an organization approach these investigations. We’ll look at the impact of  devices like the iPhone followed by a look tomorrow at social networking.

Ultraportable and Powerful Devices
•    Smart phones (iPhone, Blackberry, etc.)
•    Key-chain drives

Smart Phone Problems
The wide availability and popularity of smart phones from the iPhone to the Instinct is fueling a discussion about how to best deal with these devices when it comes to forensic investigations. Any of these devices can be used for storage, but the expanding capabilities of smart phones make them attractive weapons to perpetuate an attack or simply steel data and designs. These phones often include large storage capacity, digital camera, web/network access, and can be easily hidden.

Forensic Considerations
Becuase of their surging popularity, it’s not a matter of “if” but rather “when” will you’ll have to perform forensic analysis of this type of device. It goes without saying that digital evidence can be easily modified, and the most difficult step is ensuring your team is taking appropriate steps in the handling of the device. Depending upon the mobile device, you might also find that more information is available by knowing how to dig deeper.

While significant efforts are underway by forensic tool vendors, currently this area appears to by lacking for solutions. Jonathan Zdziarski offers a great how-to video demonstrating how forensic investigators can appropriately get under the hood.

Human Resources
Appropriate human resource policies should also be in place to define acceptable use of portable devices like iPhones or keychain hard drives. The devices can obviously be both a workplace benefit and hindrance. HR Daily Advisor does a good job of covering the potential risks of smartphones, while new iniatives to incorporate business applications into the device arguably increase worker productivity.  Another article that will be of interest details what info can be kept on smart phones.

Tags: iphone, iphone forensics, smart phone, cyber forensics, ediscovery