Back to basics - Signed integers

In this post, I wanted to visit the concept of signed vs. unsigned integers from a forensic point-of-view.  Many investigators are trained to use tools to view cases from the software vendor point-of-view without understanding basic computer science concepts.  

I wanted to look at symbolic links, look at the MFT record for the created hard link, and examine what happens when a long filename link with a hard link created that also have a long filename.  These steps were repeated at least three times using Microsoft Windows [Version 6.1.7601], NTFS version 3.1.

1. Created test file with a long file name since hard links do not work on folders.  

2. Created a hard link to the test file and named the link also a long file name.

C:\temp>copy con testingLongFilename.txt

hello again

^Z

        1 file(s) copied.

C:\temp>mklink /h hardlinktolongfile.txt testingLongFilename.txt

Hardlink created for hardlinktolongfile.txt <<===>> testingLongFilename.txt

C:\temp>dir

02/09/2014  07:51 PM                13 hardlinktolongfile.txt

02/09/2014  06:24 PM    <SYMLINK>      hello [c:\temp]

02/09/2014  06:25 PM    <SYMLINKD>     hello2 [c:\temp]

02/09/2014  06:26 PM    <JUNCTION>     hello3 [c:\temp]

02/09/2014  06:44 PM                 7 testfile.txt

02/09/2014  07:51 PM                13 testingLongFilename.txt

3. The resulting MFT record was examined and noticed the MFT record reflects the long and short file names noted by the first two $30 FileName attributes, but the hard link only had a single $30 attribute.  The file names of the source and target resides in the same resident MFT record where the length of the NTFS name record shows 0x88.

           Note: Microsoft documentation lists flags 0x01 for NTFS and 0x02 for DOS file name flags,

but did not list the 0x00 for hard link filename flag ( red circles ) .

So, in interpreting 0x88, it can be read as 136 or -120 depending on the data type. 

Recipe - Two's complement to find the signed decimal value of a Base-16 ( Hex ) value

1.       Convert to binary

2.       Add -1

a.       If the result starts with a one, the result is negative

3.       Flip the result bits
     128    64     32     16      8       4       2       1

1	0	0	0	1	0	0	0	0x88
1	1	1	1	1	1	1	1	+(-1)
1	0	0	0	0	1	1	1	result
0	1	1	1	1	0	0	0	flip bits
								-120

Thus, the hex value 0x88 can be interpreted 136 as unsigned integer and -120 as signed integer.  Signed integers are used in the MFT table entries for the cluster runs, so be careful with interpretation.  In this case, the attribute length is 136 bytes.

http://msdn.microsoft.com/en-us/library/bb470206%28v=vs.85%29.aspx

http://msdn.microsoft.com/en-us/library/dn365494.aspx

http://msdn.microsoft.com/en-us/library/x68bebe2.aspx

Easy Documentation

Is your documentation look like this?
Step 1: (‎1/‎10/‎2014 12:49:40 PM) User left click on "Start (list item)" in "Start"

It is important to document problems precisely and record error messages exactly how they appear for technical support to help troubleshoot system errors.  Recording the precise steps that a user took in order to reproduce the exact error is even more useful in troubleshooting technical issues when the client is not technical at all.  This is especially important if we need to troubleshoot technical problems remotely.

The word I’ve mentioned above was “reproduce”.   It is very important in forensics to reproduce the exact steps an investigator performs on a live system in order to create repeatable and verifiable steps for volatile or sparse data acquisition.  We can provide hand written documentation or record steps on the system itself.  We can use third party tools for this purpose, but Windows includes a very useful utility that not many people talks about even though it’s been available since Windows 7. 

It is nice to know that we have this utility available that we will not have to take with us or install on the suspect drive.  It is less than 600KB in size and does a great job recording precise steps using official Microsoft terminology and includes time tamps as well.  It creates screenshots with auto highlight of focus area.  It creates the report as a flat report in MHTML format that can be viewed as a slide show as well.  It also allows the saving of the report and it does it automatically as a compressed ZIP archive to save space. 

One of the drawbacks I can see is that it does not record actual characters typed in Command Line Interface ( CLI ).  I guess, it was not meant to be a keylogger, just a Graphical User Interface ( GUI ) action recorder.  For any typed keywords or commands, the user can add comments to the specific step to make it clear if the user finds it necessary.  This can be a useful feature as well since no password will be recorded by mistake and shared with unintended parties.

You can start the Steps Recorder from the Run dialogue or directly from C:\Windows \System32. The executable is called psr.exe.   Give it a try and see if you can utilize its capabilities in your environment.  I would be curious if anyone is using this tool already or if you can see its benefits in some cases.

Galaxy backup - Convert TEC files to JPEG

A Samsung cell phone backup can be made with Kies that is stored by default in the following directory:

C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130417091016

The pattern of the backup directory is very easy to identify. 
The backup history is stored under C:\Users\<UID>\AppData\Roaming\Samsung\Kies\BatchImportExport in file BackupHistory.xml

Many basic configuration settings can be located in the registry under

HKEY_CURRENT_USER\Software\Samsung\Kies

 

If you find out that our evidence contains backup of devices, even if the images were not backed up, we can look at other locations for cached items.  Some of the items will be located in SQLite database, but some of them in individual files;  these files are stored under a BR folder and have a file extension of BK. The BK files can be renamed to ZIP files and extract the database from each.  The location below will have the image thumbnails of pictures and videos.

C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130417091016\Others\DCIM\Camera\cache

I have mentioned in the previous post that TEC files are just modified JPEG files with 6 Bytes extra at the beginning of each file and one additional Byte at its end. 

In this post, I wanted to explore a simple way to extract the images so Windows Explorer's thumbnail view could be used to quickly browse through the images for relevancy.  Dcfldd was an easy and obvious tool to use for this purpose.  The TEC files were copied into input folder under the dcfldd folder and an output folder was created to store the extracted files.

C:\dcfldd>for /f %i in ( 'dir /b .\input' ) do dcfldd if=input\%i of=output\%i.jpg bs=1 skip=6

Where
'dir /b .\input' means to display the basic output of file listings in the input directory 
output\%i.jpg means to save the modified files in the output directory with appended JPG file extensions
bs=1 block size of one Byte
skip=6 skip 6 block or 6x1Bytes at the beginning of the file

iPhone Repair

I just got a broken iPhone that I wanted to examine in its native environment, but the digitizer was broken, so I used my other, working, iPhone to temporarily repair the broken iPhone to extract some information.  This might be valuable process for some of you, but you should not do this without practicing before hand.

http://youtu.be/qudGgNNwGRM

Let me know if you find this useful.

Samsung Galaxy S II Wipe

Android phones can be easily wiped of personal data, but does it really wipe all data?  I have played with an SPH-D710 this time.

I have tried the basic hard reset:
- turn off phone
- press the volume up + power button until then open chested android icon shows up
- wipe data/factory reset ( navigate with volume control, select with power button )
    Note: did not select the "wipe cache partition"
- select yes to delete all user data
- press power to reboot

I also tried the interface option to wipe the device:
Settings->Privacy->Factory data reset

The results were the same in either case.  Downloaded files, videos, Picasa cache, and Google account email address was still accessible easily by backing up the "wiped" device in Kies and reading the resulting files.  The backup is stored in a folder structure without any proprietary structure or protection.  Some files like the CallLog.bk is a simple ZIP file with SQLite 3 database.

 

 The backup is located, by default, in the following directory C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730 where the backup folder is made unique by including the date and time of the backup.  

Some cache folder can contain files with TEC file extension that contains a single JPG image that can be viewed by removing a few bytes before and after the jpeg signatures.  picasa-cache.0 can also be carved for JPG images.  

The list below shows the backup structure of the Galaxy S II after wiping the phone 3 times.  Image caches, audio downloaded files, videos, and the email address of the user was not removed.  The ... shows the removal the same type of files to shorten the output. 

C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\CALL

C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\CONFIGURATION
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\EMAIL
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\MESSAGE
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\CALL\BR
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\CALL\BR\CallLog.bk
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\CONFIGURATION\BR
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\CONFIGURATION\BR\Configuration.bk
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\EMAIL\BR
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\EMAIL\BR\Email.bk
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\MESSAGE\BR
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\MESSAGE\BR\Message.bk
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\media
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\MP3Download
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\Music_Audio
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\Notifications
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\Ringtones
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\media\audio
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\media\audio\notifications
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\media\audio\notifications\facebook_ringtone_pop.m4a
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\MP3Download\AUDIO_FILES.mp3
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\Music_Audio\AUDIO_FILES.mp3
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\Notifications\hangout_dingtone.m4a
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\Notifications\hangout_ringtone.m4a
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Music\Ringtones\hangout_ringtone.ogg
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\USER1
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\astrid
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\c360_debug.txt
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\download
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jp.co.johospace.jorte
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\MP3Download
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Pictures
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\preview.vpl
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\USER1\IMG_VIDEO_FILES.qt
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\astrid\auto.121024-0021.xml
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM\Camera
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM\NAME2
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM\Camera\cache
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM\Camera\cache\2047040784001.tec
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM\Camera\cache\8484480800.arc
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM\NAME2\cache
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM\NAME2\cache\2047040784001.tec
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\DCIM\NAME2\cache\8484480800.arc
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\download\119091.pdf
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\download\20120417154424.ics
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\download\49052662.pdf
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\download\abscissa-1.apk
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\capture
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\fonts
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\capture\.nomedia
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\fonts\cmunst.otf
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\fonts\cmuntb.otf
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\fonts\Dancing_Script
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\fonts\lists.csv
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\fonts\Dancing_Script\DancingScript-Bold.ttf
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jorte\fonts\Dancing_Script\readme.txt
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\jp.co.johospace.jorte\jorte.db
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\MP3Download\lyric
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\MP3Download\lyric\AUDIO_FILE.txt
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio\db
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio\downloadingMedia_0.dat
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio\downloadingMedia_3.dat
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio\downloadingMedia_6.dat
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio\playingMedia11.dat
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio\playingMedia5.dat
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio\db\mdd.db
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Music_Audio\db\mdd.db-journal
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Pictures\cache
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Pictures\cache\com.google.android.googlephotos
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Pictures\cache\com.google.android.googlephotos\.nomedia
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Pictures\cache\com.google.android.googlephotos\cache_versions.info

//Can be carved for JPG images
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Pictures\cache\com.google.android.googlephotos\picasa-cache.0

C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Pictures\cache\com.google.android.googlephotos\picasa-cache.1
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Others\Pictures\cache\com.google.android.googlephotos\picasa-cache.idx
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Camera360
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.box.android
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.google.android.apps.books
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.box.android\cache
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.box.android\cache\filecache
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.box.android\cache\working
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.box.android\cache\filecache\1580054785.jpg
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.box.android\cache\working\2901071601_1345350763
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.box.android\cache\working\2901071601_1345350763\frontface.jpg
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache\thumbs
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache\thumbs\20120516_151344.mp4
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache\thumbs\Camera Uploads
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache\thumbs\Photos
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache\thumbs\20120516_151344.mp4\large.jpg
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache\thumbs\Camera Uploads\2011-05-15 22.32.24.jpg
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache\thumbs\Photos\Sample Album
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.dropbox.android\cache\thumbs\Photos\Sample Album\Boston City Flow.jpg
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.google.android.apps.books\files
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.google.android.apps.books\files\accounts
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Android\data\com.google.android.apps.books\files\accounts\USER_EMAIL@gmail.com
...
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Camera360\Data
C:\Users\<UID>\Documents\samsung\Kies\Backup\SPH-D710\SPH-D710_20130320092730\Photo\Camera360\Data\test_old.png

Conclusion

If you don't have specialized forensic tools to analyze a phone and the phone appears to contain no relevant data navigating the interface, a simple device backup can reveal many valuable leads and relevant data.  If a device can not be examined, think about examining the device backup on the computer the user had access to.  Locating and examining mobile device backups can be an easier alternative and easier to validate than acquiring the actual mobile device. 

Crop in Word 2010

 

It was an interesting concept and a welcomed addition to Office 2007 that we were able to edit images right in the Word document itself.  So, what happens to the original image that we cropped?  We know that older version of Office was keeping tracked changes even after tracking was turned off, so leaving something intact is not a new concept to Microsoft.

So, what happens when you add an image add crop it.  Let me show you.

Here, I added an image to a Word document.  Nothing special here.

So, now I cropped a portion of the image where the CNSS logo is not showing anymore.  So, if I open this document, I will only see CSEC from now on.  So, what happens behind the scene?

Looking at the Word document in Hex viewer, we can see that a Word document .docx is just a ZIP file with standard signature PK.

Therefore, we can just simply change the file extension to .zip and extract its contents.  It seems the media additions to a word document is stored in word\media folder.  It is also interesting to see the time stamp associated with this image.  IT is even more interesting that some tools like FTK Imager shows this time stamp as 1/1/1980 instead of 12/29/1899.

Never the less, if we open the image, we can see that it is the original full sized image.

Just to show what it looks like in the $MFT record, the time stamp ( Green ) is the actual time stamp when the zip file was extracted, but the ( Yellow ) time stamp is the seemingly a default time since I have not seen other time stamp, but this value in all documents.

Conclusion

It might be important to filter for DOCX files and extract the media from them to see if anyone manipulated and cropped portions of the images.  On the other hand, since word documents are zip archives, some forensic tools report them as wrong file types while there is nothing wrong with them.  In any case, if an investigator mounts the file structure of these files, the full image will show up in the Gallery view and the investigator might believe the user actually must have seen the full image while it is possible that only a portion of the image was visible to the user.  So, keep this in mind in your investigations.