Galaxy backup - Convert TEC files to JPEG

A Samsung cell phone backup can be made with Kies that is stored by default in the following directory:

C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130417091016

The pattern of the backup directory is very easy to identify. 
The backup history is stored under C:\Users\<UID>\AppData\Roaming\Samsung\Kies\BatchImportExport in file BackupHistory.xml

Many basic configuration settings can be located in the registry under

HKEY_CURRENT_USER\Software\Samsung\Kies

 

If you find out that our evidence contains backup of devices, even if the images were not backed up, we can look at other locations for cached items.  Some of the items will be located in SQLite database, but some of them in individual files;  these files are stored under a BR folder and have a file extension of BK. The BK files can be renamed to ZIP files and extract the database from each.  The location below will have the image thumbnails of pictures and videos.

C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130417091016\Others\DCIM\Camera\cache

I have mentioned in the previous post that TEC files are just modified JPEG files with 6 Bytes extra at the beginning of each file and one additional Byte at its end. 

In this post, I wanted to explore a simple way to extract the images so Windows Explorer's thumbnail view could be used to quickly browse through the images for relevancy.  Dcfldd was an easy and obvious tool to use for this purpose.  The TEC files were copied into input folder under the dcfldd folder and an output folder was created to store the extracted files.

C:\dcfldd>for /f %i in ( 'dir /b .\input' ) do dcfldd if=input\%i of=output\%i.jpg bs=1 skip=6

Where
'dir /b .\input' means to display the basic output of file listings in the input directory 
output\%i.jpg means to save the modified files in the output directory with appended JPG file extensions
bs=1 block size of one Byte
skip=6 skip 6 block or 6x1Bytes at the beginning of the file

iPhone Repair

I just got a broken iPhone that I wanted to examine in its native environment, but the digitizer was broken, so I used my other, working, iPhone to temporarily repair the broken iPhone to extract some information.  This might be valuable process for some of you, but you should not do this without practicing before hand.

http://youtu.be/qudGgNNwGRM

Let me know if you find this useful.

Samsung Galaxy S II Wipe

Android phones can be easily wiped of personal data, but does it really wipe all data?  I have played with an SPH-D710 this time.

I have tried the basic hard reset:
- turn off phone
- press the volume up + power button until then open chested android icon shows up
- wipe data/factory reset ( navigate with volume control, select with power button )
    Note: did not select the "wipe cache partition"
- select yes to delete all user data
- press power to reboot

I also tried the interface option to wipe the device:
Settings->Privacy->Factory data reset

The results were the same in either case.  Downloaded files, videos, Picasa cache, and Google account email address was still accessible easily by backing up the "wiped" device in Kies and reading the resulting files.  The backup is stored in a folder structure without any proprietary structure or protection.  Some files like the CallLog.bk is a simple ZIP file with SQLite 3 database.

 

 The backup is located, by default, in the following directory C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730 where the backup folder is made unique by including the date and time of the backup.  

Some cache folder can contain files with TEC file extension that contains a single JPG image that can be viewed by removing a few bytes before and after the jpeg signatures.  picasa-cache.0 can also be carved for JPG images.  

The list below shows the backup structure of the Galaxy S II after wiping the phone 3 times.  Image caches, audio downloaded files, videos, and the email address of the user was not removed.  The ... shows the removal the same type of files to shorten the output. 

C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\CALL

C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\CONFIGURATION
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\EMAIL
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\MESSAGE
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\CALL\BR
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\CALL\BR\CallLog.bk
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\CONFIGURATION\BR
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\CONFIGURATION\BR\Configuration.bk
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\EMAIL\BR
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\EMAIL\BR\Email.bk
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\MESSAGE\BR
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\MESSAGE\BR\Message.bk
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\media
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\MP3Download
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\Music_Audio
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\Notifications
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\Ringtones
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\media\audio
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\media\audio\notifications
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\media\audio\notifications\facebook_ringtone_pop.m4a
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\MP3Download\AUDIO_FILES.mp3
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\Music_Audio\AUDIO_FILES.mp3
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\Notifications\hangout_dingtone.m4a
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\Notifications\hangout_ringtone.m4a
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\Ringtones\hangout_ringtone.ogg
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\USER1
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\astrid
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\c360_debug.txt
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\download
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jp.co.johospace.jorte
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\MP3Download
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Pictures
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\preview.vpl
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\USER1\IMG_VIDEO_FILES.qt
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\astrid\auto.121024-0021.xml
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM\Camera
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM\NAME2
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM\Camera\cache
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM\Camera\cache\2047040784001.tec
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM\Camera\cache\8484480800.arc
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM\NAME2\cache
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM\NAME2\cache\2047040784001.tec
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM\NAME2\cache\8484480800.arc
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\download\119091.pdf
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\download\20120417154424.ics
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\download\49052662.pdf
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\download\abscissa-1.apk
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\capture
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\fonts
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\capture\.nomedia
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\fonts\cmunst.otf
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\fonts\cmuntb.otf
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\fonts\Dancing_Script
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\fonts\lists.csv
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\fonts\Dancing_Script\DancingScript-Bold.ttf
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\fonts\Dancing_Script\readme.txt
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jp.co.johospace.jorte\jorte.db
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\MP3Download\lyric
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\MP3Download\lyric\AUDIO_FILE.txt
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio\db
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio\downloadingMedia_0.dat
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio\downloadingMedia_3.dat
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio\downloadingMedia_6.dat
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio\playingMedia11.dat
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio\playingMedia5.dat
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio\db\mdd.db
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio\db\mdd.db-journal
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Pictures\cache
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Pictures\cache\com.google.android.googlephotos
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Pictures\cache\com.google.android.googlephotos\.nomedia
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Pictures\cache\com.google.android.googlephotos\cache_versions.info

//Can be carved for JPG images
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Pictures\cache\com.google.android.googlephotos\picasa-cache.0

C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Pictures\cache\com.google.android.googlephotos\picasa-cache.1
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Pictures\cache\com.google.android.googlephotos\picasa-cache.idx
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Camera360
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.box.android
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.google.android.apps.books
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.box.android\cache
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.box.android\cache\filecache
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.box.android\cache\working
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.box.android\cache\filecache\1580054785.jpg
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.box.android\cache\working\2901071601_1345350763
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.box.android\cache\working\2901071601_1345350763\frontface.jpg
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache\thumbs
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache\thumbs\20120516_151344.mp4
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache\thumbs\Camera Uploads
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache\thumbs\Photos
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache\thumbs\20120516_151344.mp4\large.jpg
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache\thumbs\Camera Uploads\2011-05-15 22.32.24.jpg
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache\thumbs\Photos\Sample Album
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache\thumbs\Photos\Sample Album\Boston City Flow.jpg
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.google.android.apps.books\files
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.google.android.apps.books\files\accounts
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.google.android.apps.books\files\accounts\USER_EMAIL@gmail.com
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Camera360\Data
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Camera360\Data\test_old.png

Conclusion

If you don't have specialized forensic tools to analyze a phone and the phone appears to contain no relevant data navigating the interface, a simple device backup can reveal many valuable leads and relevant data.  If a device can not be examined, think about examining the device backup on the computer the user had access to.  Locating and examining mobile device backups can be an easier alternative and easier to validate than acquiring the actual mobile device. 

Crop in Word 2010

 

It was an interesting concept and a welcomed addition to Office 2007 that we were able to edit images right in the Word document itself.  So, what happens to the original image that we cropped?  We know that older version of Office was keeping tracked changes even after tracking was turned off, so leaving something intact is not a new concept to Microsoft.

So, what happens when you add an image add crop it.  Let me show you.

Here, I added an image to a Word document.  Nothing special here.

So, now I cropped a portion of the image where the CNSS logo is not showing anymore.  So, if I open this document, I will only see CSEC from now on.  So, what happens behind the scene?

Looking at the Word document in Hex viewer, we can see that a Word document .docx is just a ZIP file with standard signature PK.

Therefore, we can just simply change the file extension to .zip and extract its contents.  It seems the media additions to a word document is stored in word\media folder.  It is also interesting to see the time stamp associated with this image.  IT is even more interesting that some tools like FTK Imager shows this time stamp as 1/1/1980 instead of 12/29/1899.

Never the less, if we open the image, we can see that it is the original full sized image.

Just to show what it looks like in the $MFT record, the time stamp ( Green ) is the actual time stamp when the zip file was extracted, but the ( Yellow ) time stamp is the seemingly a default time since I have not seen other time stamp, but this value in all documents.

Conclusion

It might be important to filter for DOCX files and extract the media from them to see if anyone manipulated and cropped portions of the images.  On the other hand, since word documents are zip archives, some forensic tools report them as wrong file types while there is nothing wrong with them.  In any case, if an investigator mounts the file structure of these files, the full image will show up in the Gallery view and the investigator might believe the user actually must have seen the full image while it is possible that only a portion of the image was visible to the user.  So, keep this in mind in your investigations.

Turn it off or not?

It has been a "gray" area in forensic acquisitions if we should turn a system off or not.  If we look at certification exam requirements, we have to pull the plug on client OS and turn the system off with OS commands if it is a server. 

In today's computers, we have 4GB or more memory that was the size of a hard drive not too long ago.  In a few years back, if someone said, "I've thrown an 8GB hard drive into the trash since I thought it was not important" would have landed investigators in jail.  We can not make those kind of decisions anymore just because we did it in the past. 

The memory is a wealth of information in malware investigations and dealing with encryption.  This also shown in the new tool "Elcomsoft Forensic Disk Decryptor". http://www.elcomsoft.com/efdd.htm


The documentation mentions how it recovers the master key from live memory or from the hibernation file.

"By analyzing the hibernation file (if the PC being analyzed is turned off);
 By analyzing a memory dump fie
 By performing a FireWire attack (PC being analyzed must be running with encrypted volumes mounted)."

Now, if that is the case, then turning the system off will lose this information and you can wait for weeks, if you're lucky, to crack the password for BitLocker, PGP or TrueCrypt. 

Why not just include into the methodology and certification exam requirements to at least consider the option of capturing the memory before turning the system off.  I like the option of forcing the hibernation file to update and then pull the plug if necessary. 

powercfg.exe -h off
powercfg.exe -h on

This way, you can turn your system off and still have the memory to analyze.

"Drawbacks?"  You might ask.
I believe digital forensics is just like any other science discipline is based on pattern recognition, risk management, and process control.  Therefore, we have to look at any drawbacks in this method.  Since the Hiberfil.sys file will be as large as the physical memory in the system, you will overwrite, 8GB in this case, unallocated space.  Thus, if you plan to data carve for previously deleted files, this might destroy evidence that can be just as much devastating to your case.  So, a light weight memory dump utility ( fau's dd, mdd, or winen ) might be the answer to this dilemma.  The main idea is to consider this option when encryption is suspected or as a standard collection methodology.

Cell Phone in Faraday Bag! Why?

As we test tools and technology in our ITDF 2320 course, we never know what information we can discover.  This week, we've tested the cell phone protection by placing them in Faraday bag and multilayer of antistatic bags. 

To our surprise, even though the Faraday bag work fairly well in some cases and not at all in others, in all cases the mesh on the Faraday bag interacted with the smart phone screen.  In one case, the movement of the bag over the screen caused the email client to open and to check one of the emails to be checked.  In most cases, just random movement was noticeable as the phone moved around in the bag. 

It might be strange to call a Faraday bag a protection mechanism when it causes more changes than just placing the phone in airplane mode and carrying it in a paper bag.

Android phone Thumbdata - Part 3

In this blog, I wanted to look further into the data storage on Android phone and look at the files in the DCIM\.thumbnails folder. 

 

 The first files I wanted to look at was the .thumbdata3-.... files.  The first one had a modification time of the time I took the last picture with the phone and the other the modification time of the time I recorded the last video.

Further examination showed that the first file contains 9 thumbnail images starting with the first image I took and each record is 10000 bytes long, so just by looking at the file size, we can see how many image thumbnails each one of these files contain.  Thus, the second thumbdata file is used to keep track of the thumbnails related to the videos in DCIM\Camera folder.  Each thumbnail is stored as a JPEG image that can be manually carved out by selecting the range between the signatures FFD8FF - FFD9.  

The other files that were interesting for further analysis were the image_last_thumb and video_last_thumb files.  What was most interesting to see the modification time that showed the time when the last image was taken and not the last image that was viewed.  Same was the case with the video_last_thumb, it showed the modification time of the last video recording.  

11/30/2012

12:48am formatted using on the phone utility

12:58-12:59am took pictures 1-9

1:00 am pencil video was created

1:01am CD video was created

Thus, I wanted to see what these files contained since the file mane and modification times were not reflecting what they suggested.

The last events that actually happened on the phone was that I viewed one image and the first video.

1:19am image 6 viewed

1:20am  pencil video viewed

These two files begun with the following text:

                 image_last_thumb

                          'content://media/external/images/media/9‰PNG

                 video_last_thumb

                           .&content://media/external/video/media/2‰PNG

Thus, these files are keeping the last image and last video that was added to the storage media and not the files that were last viewed.  These are the imaged that show up when a user enters the Gallery application.  

The signature of the PNG chunk is clearly visible in these files, so simply cutting the leading text and splicing the correct files header for a PNG file will allow us to see the actual images.  So, I have created a PNG file and copied its 12 byte header into each one of these files.

The resulting files could be viewed in any image viewer and confirmed the content was matching the path and file name stored in these files and these files contained the last multimedia file added to the storage device and not the last image viewed.  It is interesting why Google chose to save the thumbnail images in JPEG format and the last thumb images as PNG. 

Conclusion

Always verify your hypothesis with manual methods instead of relying third party tools.  The ability to verify findings in this manner gives you more confidence and develops your analytical skills.