Blackberry Forensics

NIST Mobile Forensics Workshop June 2014

June-19-14

Copyright © QuByte Logic Ltd 1

Shafik G. Punja

Cindy Murphy
SPEAKER BACKGROUND

- Shafik G. Punja

- Active duty LE, performing digital forensics since Nov 2003

- Instructor for Teel Technologies US and Canada

- Senior Technical Officer – QuByte Logic Ltd

- Private sector work involves R n D partnerships with 

various LE colleagues, digital forensics training, data 

analytics and consulting services.

- Shameless plug: Course developer and primary instructor 

for Advanced BlackBerry Forensics Class: 

http://www.teeltech.com/tt3/blackberry4.asp?cid=16

- Contact: shafghp@gmail.com or qubytelogic@gmail.com

June-19-14

Copyright © QuByte Logic Ltd 2
SPEAKER BACKGROUND

- Cindy Murphy

- Detective, City of Madison, WI Police Department since 

1985.

- Involved in DFIR since 1999

- MSc Forensic Computing and CyberCrime Investigation 

from Dublin in 2011

- Part time DFIR Instructor at Madison College

- Shameless plug: SANS 585 Advanced Smartphone 

Forensics Instructor 

- http://www.sans.org/event/for585-advanced-smartphonemobile-device-forensics

- Contact: CMurphy@cityofmadison.com

June-19-14

Copyright © QuByte Logic Ltd 3
Coverage

• Locked BlackBerry’s: access options

• BES and BlackBerry

• Unlocked BlackBerry’s: Physical versus Logical

• Backup IPD, BBB v1, BBB v2 formats

• BlackBerry Messenger (BBM)

• BlackBerry Artifacts

• Malware/Spyware on BlackBerry devices

• BlackBerry 10

June-19-14

Copyright © QuByte Logic Ltd 4
BlackBerry 7 (and lower)

- Developed by Research In Motion (now called BlackBerry) based out 

of Waterloo, ONT Canada.

- Device software design evolved from C++ to Java.

- Uses proprietary OS designed through JVM (Java Virtual Machine).

- The operating system is a collection of .cod files. You will not see a 

true file system in any analysis tool.

- Security of device rests with its relationship with the hardware.

- In Java based BB devices, BootROM is trust anchor.

- BlackBerry applications come packaged either as .COD files or JAD 

files which is associated to either OTW or OTA application installation.

June-19-14

Copyright © QuByte Logic Ltd 5
Locked BlackBerry

- Option 1: If BES attached unlock via BES.

- Option 2:Attack info.mkf file on memory card 

if this is present. 

(http://blog.crackpassword.com/2011/09/recovering-blackberry-devicepasswords/)

- Option 3: Chipoff (maybe JTAG which might 

work on older model devices).

June-19-14

Copyright © QuByte Logic Ltd 6
Locked BlackBerry

- Password is

- NOT stored on computer used by device owner 

for backup of 

- NOT present in the backup IPD file or any other 

version of the backup

- According to BlackBerry there is no backdoor into 

the device

- BlackBerry, may or may not help you in accessing 

the data on a locked BlackBerry device.

June-19-14

Copyright © QuByte Logic Ltd 7
Locked BlackBerry

- Large Padlock lower right on handset screen = password 

locked

- Large Padlock lower right AND smaller padlock upper 

left = password locked and encrypted

- Less secure passwords are rejected by the smartphone, 

such as those composed of identical characters, or 

characters that consist of natural sequences (i.e. 1234).

- If the device is locked AND you see the device 

prompting you to type the word “blackberry”, this means 

that half the password attempts have already been used.

- If a password is entered incorrectly ten consecutive 

times, this will automatically wipe all of the data on the 

BlackBerry. 

June-19-14

Copyright © QuByte Logic Ltd 8
Locked BlackBerry - BES

- BES (BlackBerry Enterprise Server): runs in server 

environment.

- A single BES can host as many as 500 BB devices.

- If a device is BES attached a password reset can be 

pushed from the BES Management Console.

- Password Reset does not affect the user data on 

the device.

June-19-14

Copyright © QuByte Logic Ltd 9
Locked BlackBerry – BES 2

1. Open the BlackBerry Enterprise Server Management console.

2. Right-click the user account that requires a password change.

3. Click IT Admin > Set Password and Lock.

4. In the Set Handheld Password and Lock window, type the 

new password into the New Password and New Password Again 

fields.

5. Click OK.

Note: It takes approximately 30 minutes for the new IT Policy to 

be sent to the device.

6. When the device receives the IT Policy, the following 

message is displayed:

New IT Policy Changed Over The Air. Would you like to accept?

7. Click OK. The user can now use the new password on the 

device.

Source: http://www.blackberrycool.com/2005/10/23/changing-handheld-password-from-blackberry-enterprise-server/

June-19-14

Copyright © QuByte Logic Ltd

10
Locked BlackBerry – BES 2

- You remembered to ask the friendly BES admin for the BES daily 

log files right?

- BES stores daily logs in folders under default path C:\Program 

Files\Research in Motion\BlackBerry Enterprise Server\Logs\ - grab them all and don’t forget the email container which is stored 

separately.

- Depending upon BES version there may be over 15 or so different 

types of logs: SMS logs, PhoneCall logs, PINLog and BBM logs

- By default only PhoneCall logs are enabled on BES 5 and lower. In 

BES 10 and higher, it is believed that SMS, PhoneCall, PIN and BBM 

data is logged.

- SMS, PIN, PhoneCall and BBM are stored in CSV format contain both 

content and sender, receiver information

June-19-14

Copyright © QuByte Logic Ltd

11
Locked BlackBerry – info.mkf file

- Non BES device, commonly referred to as BlackBerry Internet 

Service (BIS) device.

- If BlackBerry is locked AND if memory card is encrypted with 

either option 2: Security Password or option 3: Security 

Password and Device (default encryption is off)

- Then a hidden file info.mkf on the memory card at 

/BlackBerry/system/ will be found.

- EPPB attacks/exploits this file to obtain the password to the 

BlackBerry device

- *Source: http://blog.crackpassword.com/2011/09/recovering-blackberry-device-passwords/

June-19-14

Copyright © QuByte Logic Ltd

12
Locked BlackBerry – info.mkf file

- /

June-19-14

Copyright © QuByte Logic Ltd

13
Locked BlackBerry – info.mkf file

- When an upper case character is 

introduced, the english dictionary word list 

attack will always fail as it only examines 

lower case.

- So it might be worth while obtaining a 

keyword list from other related electronic 

exhibits which can be imported into EPPB 

or attempting a mutation attack.

June-19-14

Copyright © QuByte Logic Ltd

14
Locked BlackBerry – Chipoff

- Option 1 and 2 are not available then only 

recourse is a chipoff.

- Consists of device disassembly, chip removal, 

chip cleaning, and chip reading with a chip 

programmer.

- This is destructive process to the device: you 

cannot power on the device to validate the 

parsing of the binary NAND/NOR dump.

June-19-14

Copyright © QuByte Logic Ltd

15
Locked BlackBerry – Chipoff

- Best and currently the only tool that will decode a BlackBerry chipoff

NAND dump obtained through a chip programmer is UFED Physical 

Analyzer (UFED PA)!

- If BlackBerry device is attached to a BES, and you don’t have access to 

the BES, chip off is pointless as the data cannot be decrypted by any 

commercial tool at this time. Real world scenario: hostile BES, 

BlackBerry seized and is usually PGP encrypted then you are at a dead 

end, even with chipoff.

- Want to decode the device password from the chipoff NAND dump? 

Remember this password may also unlock other devices!

- Look at Trace Log and find SHA1 hash value; hash can be decrypted 

using these two links:

http://www.stringfunction.com/sha1-decrypter.html

http://www.md5decrypter.co.uk/sha1-decrypt.aspx

June-19-14

Copyright © QuByte Logic Ltd

16
Locked BlackBerry – SHA1 Password

• The hash value is 40 characters in length, which is typically 

indicative of SHA1 value.

June-19-14

Copyright © QuByte Logic Ltd

17
Encrypted AND Locked BlackBerry

• This applies to non-BES devices, that just use the provided 

encryption (also called Content Protection options) for the device 

memory.

• Take the SHA1 value and decode the hash with links presented 

previously, enter the password into the field and UFED PA will 

decrypt the data. 

June-19-14

Copyright © QuByte Logic Ltd

18
Unlocked BlackBerry Devices - Physical

- Only tool that will obtain a physical read of the NAND 

over USB is UFED Classic or UFED Touch.

- This is done using a bootloader injection, into the 

RAM of the device. 

- This is the only way to obtain deleted artifacts and 

non saved BBM chat.

- Resulting BIN file is opened in UFED PA for analysis.

June-19-14

Copyright © QuByte Logic Ltd

19
Unlocked BlackBerry Devices - Physical

- Process that I recommend typically is 

UFED physical extraction, followed by 

UFED file system (creation of IPD/backup) 

and UFED Logical parsed.

- Reason: to limit wear leveling functions on 

the NAND do physical first if UFED 

supports it then proceed to other extraction 

methods 

June-19-14

Copyright © QuByte Logic Ltd

20
Unlocked BlackBerry Devices – Physical – OOOPS!

BUT......This could happen to you if you go after 

the physical first and not logical:

So what happened to our unfortunate DFIR colleague?

June-19-14

Copyright © QuByte Logic Ltd

21
Unlocked BlackBerry Devices – Physical – OOOPS!

Possible Scenarios:

1. The BlackBerry device must be turned and unlocked for the UFED boot 

loader injection process to occur. 

• Was it radio isolated, or did it briefly initiate a wireless connection?

2. If the device is attached to a BES, there is a BES IT policy that will initiate 

a device wipe if the BlackBerry device cannot receive an IT policy update or 

IT administration commands, after a specified period of time between 2 and 

720 hours.

• If the device is radio isolated then it cannot connect to the BES 

which could invoke the wipe IF this policy is enforced/enabled.

3. Could the bootloader injection have inadvertently triggered a device 

wipe?

• In the non-volatile (NV) memory store the device sets the Device 

Under Attack flag. Once this bit is set, nothing will clear this flag 

except completion of the wipe. 

June-19-14

Copyright © QuByte Logic Ltd

22
Unlocked BlackBerry Devices – Physical – OOOPS!

What actually happened (cited from the listserve email):

- No “factory reset.” What happened, I would call it “wipeout”, and 

Cellebrite prefers calling it “cache memory reset”.

- Blackberry 9630, on Enterprise network, not used for more than 

half a year, and arrived in with the battery totally discharged.

- Connected to a charger, and as soon as it came to life, disabled 

Wireless and Bluetooth (both were seen as enabled first).

- Close to the end of the process Cellbrite displayed a message, 

something along the following lines “Cellebrite is completing the 

physical extraction by rebooting/resetting (?) the phone”. 

June-19-14

Copyright © QuByte Logic Ltd

23
Unlocked BlackBerry Devices – Physical – OOOPS!

What actually happened (cited from the listserve email):

- Post physical extraction: device checked, almost all the data was 

gone. Also, in the settings window “Connections” “Verizon 

Wireless” was replaced with “Mobile Network”.

- ...good news is that all the data was collected by Cellebrite, 

before it was lost.

- Cellebrite’s explanation: Cellebrite installs a client on the phone 

for the extraction, and needs to remove it when the extraction is 

completed. On Blackberry 9.x and earlier versions the phone has 

to be rebooted and this is what triggers “cache memory reset” and 

loss of data.

June-19-14

Copyright © QuByte Logic Ltd

24
Unlocked BlackBerry Devices - Logical

- For BlackBerry devices logical data extraction 

and parsing:

- UFED Classic or Touch.

- Oxygen Forensic Suite Analyst USB 

version.

- XRY (Microsystemation)

- Don’t forget about using BlackBerry Desktop 

Software for Window or Mac in making a 

logical backup IPD file

June-19-14

Copyright © QuByte Logic Ltd

25
Unlocked BlackBerry Devices – Other Tools

- These tools connect to BlackBerry over 

USB and extract the logical data structure:

- EnCase 7

- FTK MPE+

- Secure View 3

- Final Mobile (Final Data)

- May be other tools, that are not listed here.

June-19-14

Copyright © QuByte Logic Ltd

26
Unlocked BlackBerry Devices – Parsing Tools

- These tools parse BlackBerry backup formats IPD and BBBv1:

- UFED PA

- Oxygen Forensic Suite Analyst

- XRY

- FTK 3.x and higher with FTK MPE

- Elcomsoft BlackBerry Explorer (EBBE)

- EnCase 7

- EnCase 6 – with script from Yogesh Khatri: www.swiftforensics.com

- Secure View 3

- Final Mobile (Final Data)

- BlackBerry Backup Explorer (Reincubate) – this will do IPD, BBBv1 

and BBBv2

- phoneMiner

- Rubus (CCL Forensics, this is FREE): this allows deconstruction of 

backup file into its raw structure; does not parse into clean 

reporting format

- MagicBerry (FREE): does NOT support decoding of all database 

structures

June-19-14

Copyright © QuByte Logic Ltd

27
BlackBerry Backup Formats

- IPD File(Inter@ctive Pager Backup): This is a 

collection of the data structures called databases all 

coagulated into one unique backup file.

- BBB File: v1 created by Mac version of BlackBerry 

Desktop Software, IPD file contained within .bbb file 

which has a PK header signature (zip file)

- BBB File: v2 created by Windows version of 

BlackBerry Desktop Software v7.1.x and higher; the 

backup is contained within the .bbb file but each 

data structure is stored as individual .DAT file

June-19-14

Copyright © QuByte Logic Ltd

28
BlackBerry Backup Formats

- The IPD structure is not how the data exists on the BlackBerry device at 

a physical level: Logical versus physical of same record

June-19-14

Copyright © QuByte Logic Ltd

29
BlackBerry Backup Formats

- BBB v2 backup format

- The number of DAT files present in the Databases folder should 

match the number of databases listed in the Manifest.xml; this 

file is found within the root of the BBB compressed archive.

June-19-14

Copyright © QuByte Logic Ltd

30
BlackBerry Date Formats

- 3 different date formats identified, and documented by Yogesh Khatri; 

http://www.swiftforensics.com/2012/03/blackberry-date-formats.htm

1. Phone Call Log, SMS, Phone History

• 8-byte length Java date value, which represents the timestamp in milliseconds, 

and is similar to Unix time values (which are 4 bytes).

• Also applies to BBM and PIN messages; dates in BE order (when data is viewed 

in BBM.db file or BBM Conversations file)

• The Win Hex/X-Ways Forensics Manual (1995-2006 Stefan Fleischmann), page 

8, describes Java date as “a 64-bit integer value that specifies the number of 

milliseconds since January 1, 1970. Principally stored in big endian, which is the 

typical byte order in Java.”

• Unix timestamp (4 bytes, converted into their decimal equivalent) * 1000 = Java 

Date.

• Java Date/1000 = Unix Timestamp

• This is also referred to as the BlackBerry® Date

June-19-14

Copyright © QuByte Logic Ltd

31
BlackBerry Date Formats

- 3 different date formats identified, and documented by 

Yogesh Khatri; 

http://www.swiftforensics.com/2012/03/blackberry-date- formats.htm

2. Calendar

• Calendar date values use number of minutes since 1 Jan 

1900 0:0:0. 

• Precision to only the number of minutes.

• Yogesh Khatri cites this formula to obtain the unix time 

value:

• UnixTimestamp = (CalendarDate – 36816480) * 60

June-19-14

Copyright © QuByte Logic Ltd

32
BlackBerry Date Formats

- 3 different date formats identified, and documented 

by Yogesh Khatri; 

http://www.swiftforensics.com/2012/03/blackberrydate-formats.htm

3. Email

• Sent and Received dates are stored as a 2 byte date 

and 2 byte time value.

June-19-14

Copyright © QuByte Logic Ltd

33
BlackBerry Endian Order

- There is no real clear direction from BlackBerry in any 

official technical specifications on how to read the byte 

order of the data and also whether the byte order is 

signed or unsigned. 

- In the IPD structure both BE and LE ordering are used.

- The only fields that are identified by BlackBerry 

documentation, for the IPD/DAT file backup is the 

following as LE byte order:

- record length 

- database version 

- database handle 

- record type 

June-19-14

Copyright © QuByte Logic Ltd

34
BlackBerry – BBM

- BlackBerry devices that cannot use BlackBerry Messenger 

5.0 or higher = take pictures; there is no backup 

mechanism

- BBM Chat History: If save chat history option is enabled 

chat is saved in CSV format and stored in one of 2 

locations: memory card or content store data structure 

on the device:

- Paths: 

- /store/home/im/BlackBerry Messenger/<pinnumber>

- /SDCard/BlackBerry/im/BlackBerry 

Messenger/<pinnumber>

- These locations will store CSV, .CON and .BAK files; CON 

and BAK files is the device user’s BBM contact list and the 

BAK is the backup of the contact (CON) file.

June-19-14

Copyright © QuByte Logic Ltd

35
BlackBerry – BBM Chat CSV

- BBM Chat CSV File: Date/Time is 21 digit numeric value 

which, YYYYMMDD (first 8 digits reading from the left) 

followed by remainder 13 decimal values are actually the 

unix DATE AND TIME stamp numeric values in millisecond 

- Example: 201001291264804385552 

- Parsing CSV files: bbmessenger.py (Python 3 required) 

https://sites.google.com/site/slosleuth/ (John Lehr)

- Parsing CON/BAK files: ConParse (Java based) 

https://github.com/sheran/bb-tools (Sheran 

Gunasekera)

June-19-14

Copyright © QuByte Logic Ltd

36
BlackBerry – Artifacts BBM

- Using BBM 5.0 but no chat history save enabled; 

- Must do a physical extraction with UFED 

Touch/Classic in order to obtain BBM chat data.

- Enabling the save chat history feature will not work on 

chat conversations currently on the device; only 

affects new chat from the date the option was 

enabled.

June-19-14

Copyright © QuByte Logic Ltd

37
BlackBerry – BBM.db

- Found in BBM 6 and higher running BB OS 6.

- BBM database file: bbm.db.

- Proprietary database that contains BBM chat 

even if option of saving chat history was NOT 

enabled.

- Also contains data similarly found in the CON 

and BAK files. 

June-19-14

Copyright © QuByte Logic Ltd

38
BlackBerry – BBM.db

• A bbm.db file that is not encrypted can, generally, 

be divided into several areas: 

• Device owner information

• BBM contacts

• Device owner time zone

• BBM chat content

• Only one tool currently parses this right now – UFED 

PA; OFS may also do this, but not tested.

• bbm.db is only observed to retain chat based on BBM 

app or OS upgrade/downgrade; meaning that there 

may be chat present on device that is not stored in 

the bbm.db file.

June-19-14

Copyright © QuByte Logic Ltd

39
BlackBerry – BBM Conversations

• This was discovered by a colleague on examination of a BlackBerry 9900 

running OS 7.x. 

June-19-14

Copyright © QuByte Logic Ltd

40
BlackBerry – BBM Conversations

• This file appears not much different than BBM.db and follows similar 

structure (grouped by PINs/Chats etc.) like the bbm.db file.

• It has only been observed on devices running OS 7.x.

• It contains the BBM contacts, and chat history, believed to be saved 

regardless of whether BBM save chat history option is enabled.

• The BBM Conversations folder can be obtained with a logical file system 

extraction.

• Tools that do parse the BBM Conversations structure:

• BlackBerry Backup Explorer (Reincubate) 

• Tools that might or will likely parse the BBM Conversations structure:

• UFED PA?

• Oxygen Forensic Suite?

• XRY?

June-19-14

Copyright © QuByte Logic Ltd

41
iOS and Android BBM 

• BBM for iOS is only supported for iOS 6 and 7.

• BBM for Android is only supported for Android OS (AOS) 4.0 and later.

• A BlackBerry Messenger ID is required.

• The Android or iOS device will be assigned a unique PIN, 8 characters 

long, randomly generated. 

• Observed by both Sheran Gunasekera (aka Gunny), and Jose Garcia, 

the iOS and Android BBM app uses SQLite database to store its data.

• BBM 10 for also offers voice and video, which connects over Wi-Fi.

June-19-14

Copyright © QuByte Logic Ltd

42
iOS and Android BBM 

Icons related to BBM 10 for Android, and iPhone cited from: 

http://helpblog.blackberry.com/2013/10/getting-started-with-bbm-onandroid-and-iphone/

June-19-14

Copyright © QuByte Logic Ltd

43
iOS and Android BBM 

June-19-14

Copyright © QuByte Logic Ltd

44
BlackBerry – Artifacts BBThumbs.dat

- BBThumbs.dat: Thumbnail cache of pictures currently or previously stored on 

the BlackBerry device or its associated memory card; typically observed in OS 

5.x and older (pre OS 6.x)

- Magic String/File Header: /x24/x05/x20/x03/

- Paths:

• SDCard/BlackBerry/foldername/BBThumbs.dat

• store/home/user/foldername/BBThumbs.dat

- The “foldername” referred to in the path can be videos, pictures, voicenotes, and 

likely also audiobooks, documents, music, podcasts and ringtones.

- Records the file names of all files stored within that specific directory even if that 

file has been deleted.

- BBThumbs.dat file related to the pictures directory only stores pictures (PNG, 

JPG, GIF) inside it; for video BBThumbs.dat only filename is present, no image.

June-19-14

Copyright © QuByte Logic Ltd

45
BlackBerry – Artifacts BBThumbs.dat

Parsing BBThumbs.dat

1. bbt.py (Python 2): https://github.com/sheran/bb-tools (Sheran 

Gunasekera) can be used to parse the key/dat pair files and the older 

BBThumbs.dat files.

• bbt.py will extract all the records in the BBThumbs.dat file.

• If the record is a picture, then it extracts the thumbnail that is stored 

inside the BBThumbs.dat file and saves it.

• Script output will show the filename, time stamp local to the device time 

and the SHA1 hash value for the record.

• If the record inside BBThumbs.dat is not a picture file, then bbt.py will 

extract the metadata from the file. In this case the BBThumbs.dat file is 

from another folder such as video or voicenotes. The SHA1 will be for 

this record.

June-19-14

Copyright © QuByte Logic Ltd

46
BlackBerry – Artifacts key/dat

thumbsXXxXX.key/thumbsXXxXX.dat: 

- Instead of BBThumbs.dat, for OS 6.x, the files come in 

.key and .dat pairs named by the image size of the 

pictures that it is cataloguing – ONLY FOR PICTURES

- Paths: 

• SDCard/BlackBerry/system/media/thumbsXXxXX.dat

• store/appdata/rim/media/thumbsXXxXX.dat

June-19-14

Copyright © QuByte Logic Ltd

47
BlackBerry – Artifacts key/dat

- thumbsXXxXX.key/thumbsXXxXX.dat:

- It is believed based on examination of multimedia 

content that the dat/key files only store metadata 

related to images and picture images present on 

the BlackBerry® device.

- The KEY file is like an index table that contains 

byte values that provide indication of where the 

records exist with the DAT file:

- The record in the DAT file contains images and 

other meta-data.

June-19-14

Copyright © QuByte Logic Ltd

48
BlackBerry – Artifacts key/dat Parsing

- Parsing thumbsXXxXX.key/thumbsXXxXX.dat:

- 1. bbt.py (Python 2): 

https://github.com/sheran/bb-tools (Sheran 

Gunasekera) can be used to parse the key/dat

pair files and the older BBThumbs.dat files.

- 2. bbt.exe (Windows executable): Based on 

Sheran Gunasekera’s work, Detective John 

Thompson (Special Investigations Section -

Technical Services Unit, Lakeland Police 

Department) wrote a Windows based command 

line EXE that will work very similar to bbt.py.

June-19-14

Copyright © QuByte Logic Ltd

49
BlackBerry – Artifacts key/dat Parsing

-Parsing thumbsXXxXX.key/thumbsXXxXX.dat:

- 3. BBThumbs EnScript: For those that use EnCase 6.x, a 

fellow colleague and very good friend, Special Constable 

Jeremy Dupuis (Ontario Provincial Police) has developed an 

EnScript that will run against thumbsXX and thumbsXX files 

with a DAT extension. Using the script: Blue checkmark one 

to multiple thumbs??x??.dat files and run script.

- 4. Commerical Tools: UFED PA, Oxygen Forensic Suite 

Analyst, Final Mobile etc – don’t forget to check these tools, as 

they do handle either the BBThumbs.dat variant and/or the 

KEY/DAT files.

June-19-14

Copyright © QuByte Logic Ltd

50
BlackBerry – Artifacts art.dat files

- xxxxart.dat files (OS 6.x and higher):

- Other multi-media content such as video, 

podcasts, music are stored in files that end 

with DAT; 

- the file name is typically xxxxart.dat where 

xxxx represents the name of the type of 

multimedia content that it is referencing. 

- The xxxxxart.dat files are SQLite format 3 

database files

June-19-14

Copyright © QuByte Logic Ltd

51
BlackBerry – Artifacts Voicenotes

- Voicenotes metadata strangely is still stored in 

the BBThumbs.dat format.

- Parsing videoart.dat files (OS 6.x and higher):

- bbvideo.py: we can parse the videoart.dat file 

and extract the BLOB data in from the SQLite 

database file.

- http://linuxsleuthing.blogspot.com (John Lehr) 

June-19-14

Copyright © QuByte Logic Ltd

52
BlackBerry – Artifacts EXIF Pictures and Movies

• Exif Data:

• To understand how EXIF data is stored 

within multimedia content, refer to the 

JEITA CP-3451 Exchangeable image file 

format for digital still cameras: Exif Version 

2.2.

• pictures: can contain geotag data along 

with traditional date/time values, and 

make/model values.

June-19-14

Copyright © QuByte Logic Ltd

53
BlackBerry – Artifacts EXIF Pictures and Movies

- Exif Data:

- movies: no geo tagging or make/model 

embedded within movie files; usual time 

stamps values for media creation and 

embedded within the video file; and also the 

encoder value called “rimm” will be observed.

- voicenotes: none observed.

- BEST Exif Analysis Tool of Choice: ExifTool

by Phil Harvey, does a great job!!!

June-19-14

Copyright © QuByte Logic Ltd

54
EXIF Geo Data

- For Geo Data to be written to a device 

created picture/image the following conditions 

must be present:

- Device GPS Services must be enabled.

AND

- The Camera GPS function must be 

enabled, by default it is disabled.

AND

- Device must be capable of receiving GPS 

data.

June-19-14

Copyright © QuByte Logic Ltd

55
EXIF Geo Data: Which Picture/Image Contains Geo Data?

June-19-14

Copyright © QuByte Logic Ltd

56
EXIF DATA INCORRECT TIMESTAMPS IN 

BLACKBERRY DEVICES

One critical observation made by a fellow research colleague, Sam 

Brothers, Department of Homeland Security about EXIF values 

regarding BlackBerry® devices:

“Wrong EXIF data gets written for the 1st picture every time the phone 

goes to sleep or the screensaver goes on! So, EXIF in a BB cannot be 

relied upon. This has been validated on (2) devices thus far.”

It is unknown if the behavior described by Sam Brothers is consistent 

for every BlackBerry® device, across every OS iteration. 

But this has been observed on BlackBerry OS 4, 5, 6 and 7 devices.

Blog Post where Steve Zenone also observes the same behavior: 

http://blog.zenone.org/2009/01/forensics-blackberry-curve-8310-and.html 

June-19-14

Copyright © QuByte Logic Ltd

57
BlackBerry – Artifacts REMF

- REMF observed in file header? (Depending on your perspective 

REMF could also mean Rear Echelon..ahemmm.......well...I am 

sure you get the rest!). 

- The .rem extension denotes an encrypted file, which can only be 

decrypted by the device that encrypted the files. 

- Another method is to use the latest version of UFED PA, or 

Elcomsoft Phone Password Breaker and see if the .rem files can 

be decrypted.

- The metadata files (like .dat, .key or BBThumb.dat) do not 

appear to be affected by the encryption despite having a .rem at 

the end of these files.

June-19-14

Copyright © QuByte Logic Ltd

58
BlackBerry – Artifacts REMF

• Looking at the file header of a rem encrypted JPG 

image we can see the header in ASCII is "REMF", or 

52 45 4D 46h.

June-19-14

Copyright © QuByte Logic Ltd

59
BlackBerry – Artifacts Event Logs

- Event Logs: Similar to Windows Event Logs, the 

BlackBerry® handheld device keeps event logs 

where applications and the BlackBerry® operating 

system can log information such as recently run 

events and system processes. 

- To view the event log, press ALT and press key 

sequence LGLG from the main (home) screen, which 

should work on all BB devices with a QWERTY 

keyboard.

June-19-14

Copyright © QuByte Logic Ltd

60
BlackBerry – Artifacts Event Logs

- Event Logs:

- The main purpose of these logs is to assist developers 

with debugging applications or services on the 

BlackBerry® handheld device. 

- However, unintentionally, the Event Logs may also serve 

as a potential source of previously untapped digital 

evidence.

- There has been no official documentation released by 

BlackBerry® that the author can find, regarding how to 

interpret or read the event log data.

- This data is volatile in that logs can roll over within 24-48 

hours depending upon device usage and maximum log 

size limit.

June-19-14

Copyright © QuByte Logic Ltd

61
BlackBerry – Artifacts Event Logs

- Easiest way to get the event logs from a device is using 

BlackBerry Desktop Software: Then access Support tools from: 

Help (?) -> Support Resources -> Support Tools -> Generate 

Support Log

June-19-14

Copyright © QuByte Logic Ltd

62
BlackBerry – Artifacts Event Logs

June-19-14

Copyright © QuByte Logic Ltd

63
BlackBerry – Artifacts Event Logs

- In doing research with fellow colleague, Sheran

Gunasekera, we discovered that event logs retained 

call history data even after user deleted it from their 

device Phone Call app.

- http://chirashi.zenconsult.net/you-want-theblackberry-event-log-beg-damnit/

- Only forensic tool that allows event log extraction 

during its logical stage is Oxygen Forensic Suite

- UFED will obtain this only through a physical dump, 

which is later parsed by UFED PA; the BlackBerry 

Event Log plugin must be run in order to review this 

data.

June-19-14

Copyright © QuByte Logic Ltd

64
BlackBerry – Artifacts Event Logs

- The date/time values are local to the device user’s time zone, in this 

case, Mountain Time (-7) GMT

- The application that generated the event log will be preceded by the 

value “app:”, followed by the name of the application.

- GUID: 16 alphanumeric characters associated to an event or 

occurrence.

June-19-14

Copyright © QuByte Logic Ltd

65
BlackBerry – Artifacts Event Logs

- The first two lines have consistently been observed by the 

author in all event log extractions on a BlackBerry® Bold 9700 

(OS 5.0.0.862, Bundle 1446, Platform 5.1.0.175).

• guid:0x97C9F5F641D25E5F time: Wed Dec 31 17:00:00 

1969 severity:0 type:2 app:System

• data:JVM:INFOp=33759974,a='5.0.0.862',o='5.1.0.175',

h=4001507

- The PIN # of device in hexadecimal is identified as 

p=33759974

- OS version: a='5.0.0.862' 

- Platform: o='5.1.0.175'

- Hardware ID: h=4001507

June-19-14

Copyright © QuByte Logic Ltd

66
BlackBerry – Artifacts Event Logs

• Evidence of call history in BlackBerry 9700 device event log 

June-19-14

Copyright © QuByte Logic Ltd

67
BlackBerry – Artifacts Event Logs

guid:0xDDA0BC913B6AAEEC time: Thu Dec 02 20:53:56 2010 severity:0 

type:2 app:PhoneApp data:StartCall: Raw Num

guid:0xDDA0BC913B6AAEEC time: Thu Dec 02 20:53:56 2010 severity:0 

type:2 app:PhoneApp data:PHONE: connecting 4032068645

guid:0xE68C69BA0F2EBC4D time: Thu Dec 02 20:53:56 2010 severity:0 type:2 

app:CC data:StartCall,"4032068645",0

guid:0xE68C69BA0F2EBC4D time: Thu Dec 02 20:53:56 2010 severity:0 type:2 

app:CC data:Conf t+1

guid:0xE68C69BA0F2EBC4D time: Thu Dec 02 20:53:56 2010 severity:0 type:2 

app:CC data:Ret,1

guid:0xDDA0BC913B6AAEEC time: Thu Dec 02 20:53:56 2010 severity:0 

type:2 app:PhoneApp data:EV_CALL_INITIATED(1)

guid:0xE68C69BA0F2EBC4D time: Thu Dec 02 20:53:56 2010 severity:0 type:2 

app:CC data:CallName,1,"false",""

guid:0xDDA0BC913B6AAEEC time: Thu Dec 02 20:53:56 2010 severity:0 

type:2 app:PhoneApp data:sAct

guid:0xDDA0BC913B6AAEEC time: Thu Dec 02 20:53:56 2010 severity:0 

type:2 app:PhoneApp data:phone: audio source on

June-19-14

Copyright © QuByte Logic Ltd

68
BlackBerry – Artifacts Event Logs

guid:0xE68C69BA0F2EBC4D time: Thu Dec 02 20:54:00 2010 severity:0 type:2 app:CC

data:CallName,1,"false",""

guid:0xE68C69BA0F2EBC4D time: Thu Dec 02 20:54:00 2010 severity:0 type:2 app:CC

data:CallName,1,"false",""

guid:0xE68C69BA0F2EBC4D time: Thu Dec 02 20:54:02 2010 severity:0 type:2 app:CC

data:Delivered,1

guid:0xDDA0BC913B6AAEEC time: Thu Dec 02 20:54:03 2010 severity:0 type:2 

app:PhoneApp data:endcallbyuser 1

guid:0xE68C69BA0F2EBC4D time: Thu Dec 02 20:54:03 2010 severity:0 type:2 app:CC

data:StopCall,1

guid:0xDDA0BC913B6AAEEC time: Thu Dec 02 20:54:03 2010 severity:0 type:2 

app:PhoneApp data:dAct

guid:0xDDA0BC913B6AAEEC time: Thu Dec 02 20:54:03 2010 severity:0 type:2 

app:PhoneApp data:callsmpt; switchbg=false

guid:0xDDA0BC913B6AAEEC time: Thu Dec 02 20:54:03 2010 severity:0 type:2 

app:PhoneApp data:PHONE: callId 1 stops listening.

guid:0xDDA0BC913B6AAEEC time: Thu Dec 02 20:54:03 2010 severity:0 type:2 

app:PhoneApp data:uAct

guid:0xDDA0BC913B6AAEEC time: Thu Dec 02 20:54:03 2010 severity:0 type:2 

app:PhoneApp data:EV_CALL_DISCONNECTED(1)

June-19-14

Copyright © QuByte Logic Ltd

69
BlackBerry – Artifacts Event Logs

• BlackBerry Event log timestamps from a physical 

memory acquisition are stored as 4 byte length (32 

bytes total), LE order 

June-19-14

Copyright © QuByte Logic Ltd

70

01 E1 FF FF 56 05 00 00 3B 00 DD 9A 61 4D 00 4D BC 2E 

0F BA 69 8C E6 47 65 74 43 61 6C 6C 4E 75 6D 62 65 72 

2C 38 2C 22 66 61 6C 73 65 22 2C 22 34 30 33 38 37 35 

36 37 36 36 22 FF 2C 00 00 00 00 00 FF FF
BlackBerry – Artifacts Event Logs

June-19-14

Copyright © QuByte Logic Ltd

71

01 E1 FF FF 56 05 00 00 3B 00 DD 9A 61 4D 00 4D BC 2E 

0F BA 69 8C E6 47 65 74 43 61 6C 6C 4E 75 6D 62 65 72 

2C 38 2C 22 66 61 6C 73 65 22 2C 22 34 30 33 38 37 35 

36 37 36 36 22 FF 2C 00 00 00 00 00 FF FF
BlackBerry – Artifacts Event Logs

• Real world example: 

• A Bluetooth (BT) device has been paired with 

BlackBerry device. Question – ‘Are you aware 

of any timestamp information related to the TIME 

the device was in use recorded on a BB?’

• Answer: Check the event log – but I don’t know 

what event log strings identify BT activity, as I 

have not had an opportunity to test this. Run the 

UFED PA plugin for BlackBerry event log.

June-19-14

Copyright © QuByte Logic Ltd

72
BlackBerry – Artifacts Event Logs

• Real world example: 

• Results: LE entity had a UFED Physical memory 

acquisition of BlackBerry device and they 

found......

• Bluetooth pairing is always logged! And in this case, 

the BT pairing was not observed, hence BT was not 

used during vehicular operation

• Device in hand of driver while two calls were being 

manually placed 17 minutes before the 911 call.

• Event log recorded the device has been manually slid 

open by the user (only certain types of BlackBerry 7 

devices came in a slider form factor).

June-19-14

Copyright © QuByte Logic Ltd

73
BlackBerry Malware

2006:

• First known BlackBerry® malware (August 2006), developed by 

security researcher, Jesse D'Aguanno, called BBProxy, which 

exploits the link of a BES connected device via its email server.

• A BES connected BlackBerry® has a constant connection to its 

corporate Local Area Network (LAN) which was used in this exploit, 

also making it difficult to detect the compromise into the corporate 

network as the data traffic is going through RIM’s encrypted tunnel 

between the BlackBerry® and its BES network.

2009: “spyware” that was pushed to Etisalat users as update, in the 

UAE by its telecommunications provider.

2010: Zeus: malware Trojan targeting the BlackBerry® and Symbian 

series 60 devices designed to capture banking credential login data.

June-19-14

Copyright © QuByte Logic Ltd

74
BlackBerry Malware

Infection Vectors (IV):

• Can be grouped into two overall categories:

1. Wired: Memory Card, Synchronization 

between computer/laptop and device.

2. Wireless: BT, IR, SMS, MMS, IM, Email, 

PIN to PIN.

June-19-14

Copyright © QuByte Logic Ltd

75
BlackBerry Malware

Commercial Spy Ware:

• There are numerous commercial spy ware programs that 

promote themselves as monitoring software (parental 

control, employee monitoring, GPS tracking):

• MobiStealth

• FlexiSpy

• Mobile-Spy

• eBlaster Mobile

• Spy Bubble

• Neo-Call

• eStealth

• Spyera

June-19-14

Copyright © QuByte Logic Ltd

76
BlackBerry Malware: Installation/Infection 

Requirements

• As tested by the author on a BES and non BES device using 

eBlaster Mobile.

• BES connected BlackBerry installation was unsuccessful, 

due to the BES and device policies in effect = VERY 

SECURE!

• Need to have physical control of device.

• If device is password protected, need to know the 

password.

• BlackBerry OS 5, 6, 7 , there is a setting for having the 

device prompt the device user on application install; 

default is No. 

• Installation of spyware is either OTA or OTW.

• The spyware will likely use a keystroke combination to 

invoke the application settings and configuration.

June-19-14

Copyright © QuByte Logic Ltd

77
BlackBerry Malware: Detection Measures/Steps

Start simple and work your way through the continuum:

1. Device battery draining quicker than usual which cannot be 

attributed to battery or device malfunction. Device overheating 

may also be another symptom that presents along with battery 

exhaustion. This was experienced by Etilsalat compromised 

devices.

2. Review of device owner’s carrier billing records indicates a 

sudden data spike in data usage that is outside of the normal 

data usage over a given time period.

3. Does review of data traffic logs from carrier point to specific 

external IP address, email address or phone number?

4. Receipt of unusual emails from unknown recipients or presence 

of SMS and PIN messages not identifiable by the device owner; 

this data may represent control channel messages, which are 

control commands sent to the malware application.

June-19-14

Copyright © QuByte Logic Ltd

78
BlackBerry Malware: Detection Measures/Steps

Data Analytics:

1. BlackBerry Event Log: may or may not present signs 

that device is infected. Applications are not required to 

write to the device event log.

2. Device running, dormant and hidden processes: May 

need to place device into EScreen or Engineering 

Screen mode in order to obtain this information.

3. Extraction and Review of System COD Modules and 

Files: A malware application can cause itself to be 

hidden from view. The FLAG_HIDDEN bit must be set 

to false in order for an application to hide itself from view 

in the applications list. 

June-19-14

Copyright © QuByte Logic Ltd

79
BlackBerry Malware: Detection Measures/Steps

Data Analytics:

4. Extraction and analysis of device physical memory (if 

possible), IPD (backup file), as well as any associated 

memory and/or SIM card.

5. Review of each applications permission categories.

6. Device Malware Scan: may or may not be 

successful. Either through on device installation of a 

scanner or scan of acquired data.

June-19-14

Copyright © QuByte Logic Ltd

80
BlackBerry Malware Case Study: MobiStealth Infection

• MobiStealth infected device: Screenshot of data resident from 

an Blackberry 9550 IPD file:

June-19-14

Copyright © QuByte Logic Ltd

81
BlackBerry Malware Case Study: MobiStealth Infection

Observation 1:

• What we are observing within the orange rectangle 

is device downloads from the internet for 

BlackBerry® Messenger (BBM).

June-19-14

Copyright © QuByte Logic Ltd

82
BlackBerry Malware Case Study: MobiStealth Infection

Observation 2:

• What we are observing within the orange rectangle is 

device downloads from the internet for BlackBerry® 

Messenger (BBM).

• Due to the large size of the file (and restrictions upon 

maximum file size for COD files) we see at least 27 

COD files, based on RIM-COD-Size-27, related to 

BBM that vary in size from 65 KB to 72 KB.

June-19-14

Copyright © QuByte Logic Ltd

83
BlackBerry Malware Case Study: MobiStealth Infection

Observation 3:

We see access from the device to a number of 

resources from URL link: 

http://mobistealth.com/asset/new/

June-19-14

Copyright © QuByte Logic Ltd

84
BlackBerry Malware Case Study: MobiStealth Infection

Observation 4:

To verify if the resources still reside at the specific URL’s 

visit 

http://mobistealth.com/asset/new/EmailSystemClient.

cod; 

Result: total of three COD files that make up the entire 

MobiStealth application for this specific device:

• EmailSystemClient.cod

• EmailSystemClient-1.cod

• EmailSystemClient-2.cod

June-19-14

Copyright © QuByte Logic Ltd

85
BlackBerry Malware Case Study: MobiStealth Infection

Observation 5: Artifact Identification:

• Multiple COD filenames that identify the actual name of the rogue 

software that should also be observed on the infected host.

• Creation Times in Unix epoch time format

• SHA1 hash values of COD files

• IMEI value of host device (sanitized in the screenshot)

June-19-14

Copyright © QuByte Logic Ltd

86
BlackBerry Malware Case Study: MobiStealth Infection

Observation 5: Artifact Identification:

• Multiple COD filenames that identify the actual name of the rogue 

software that should also be observed on the infected host.

• Creation Times in Unix epoch time format

• SHA1 hash values of COD files

• IMEI value of host device (sanitized in the screenshot)

June-19-14

Copyright © QuByte Logic Ltd

87
BlackBerry Malware Case Study: MobiStealth Infection

Investigator also provided this snippet to me: 

• Keyword search in EnCase 6.x of hard drive image for “mobistealth” 

shows hits in unallocated space (of the suspect hard drive) that appear 

like the following:

··GET /bbchat_history.php?cmd=search 

HTTP/1.1 Host:www.mobistealth.com User-Agent: Mozilla/5.0 

(Windows ; U; Windows NT 6.1; en-US; rv:1.9.2.13) 

Gecko/20101203 Firefox/3.6.13 Accept: 

text/html,application/xhtml+ 

xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en- us,en;q=0.5 Accept-Encoding: gzip,deflate Accept- Charset: 

ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Connection: 

keep- alive Referer: http://www.mobistealth.com/sms_history.php?cmd=

search Cookie: PHPSESSID=1c1aq7t5pu8l9c450ta9duh4i6; 

MobistealthVisitor=32c06 ffa5972c8cc8e00b0b86a1257cc; 

SERVERID=web2; __utma=192346166.1897014666.1297088891.1297088891.1297088891.1; __utmb=192346166.4.10.1297088891; __utmc=192346166; __utmz=192346166.1297088891.1.1.utmcsr=(direct)|utmccn=( 

direct)|utmcmd=(none) ö£n;an·€··hn»t·ì·f–ØŠ ̧õ ̃ 

›óçKÉ:Î·ý|·,é>9·1DœXð|Q_‘×·œ5¶%•1⁄4û9?·P·ð3⁄4 ñ)·Sm ƒðÕZ3 ̧æã‡EÂè·ù 

>·zHÂéš¡1‡”æÊ L =ÎÃPÝz!›rÓo1a·TM ́·4 Ö? qÆÝ·· Ë

June-19-14

Copyright © QuByte Logic Ltd

88
BlackBerry Malware Case Study: MobiStealth Infection

• GET request using likely a Mozilla type browser; 

user has logged into mobistealth user account and 

is accessing sms history and bbm chat.

··GET /bbchat_history.php?cmd=search 

HTTP/1.1 Host:www.mobistealth.com User- Agent: Mozilla/5.0 (Windows ; U; Windows NT 

6.1; en-US; rv:1.9.2.13) Gecko/20101203 

Firefox/3.6.13 Accept: 

Referer: http://www.mobistealth.com/sms_his

tory.php?cmd=search Cookie: 

PHPSESSID=1c1aq7t5pu8l9c450ta9duh4i6; 

MobistealthVisitor=32c06 

ffa5972c8cc8e00b0b86a1257cc; SERVERID=web2; 

June-19-14

Copyright © QuByte Logic Ltd

89
BlackBerry Malware Case Study: MobiStealth Infection

• UTM = Urchin Tracking Module

• Google Cookie Data: 

• various types of utm values: utm[a|b|c|z]

• Anatomy of _umta:

• __utma=<domain hash>.<unique visitor 

id>.<timstamp of first visit>.<timestamp of previous 

(most recent) visit>.<timestamp of current 

visit>.<visit count>

June-19-14

Copyright © QuByte Logic Ltd

90
BlackBerry Malware Case Study: MobiStealth Infection

• __utma=<domain hash>.<unique visitor id>.<timstamp of first 

visit>.<timestamp of previous (most recent) visit>.<timestamp of 

current visit>.<visit count>

• __utma=192346166.1897014666.1297088891.1297088891.1297088891.1; __utmb=192346166.4.10.1297088891; __utmc=192346166; __utmz=192346166.1297088891.1.1.utmcsr=(direct)|utmccn=( 

direct)|utmcmd=(none)

<domain hash>.192346166

<unique visitor id>.1897014666

<timstamp of first visit>.1297088891 = Mon, 07 February 2011 14:28:11. 

UTC = date of visit to Mobistealth

<timestamp of previous (most recent) visit>.1297088891

<timestamp of current visit>. 1297088891

<visit count> 1

June-19-14

Copyright © QuByte Logic Ltd

91
BlackBerry Malware Case Study: MobiStealth Infection

Summary

1. Suspect’s computer hard drive contains a BlackBerry 

backup IPD file of the victim’s BlackBerry device, which 

shows her device accessing and downloading (OTA install) 

the mobistealth software as segmented files.

2.Suspect’s computer hard drive shows, that computer was 

used to login to a mobistealth user account where the BBM 

chat and SMS history web pages were accessed.

3. If the ‘infected’ device has been analyzed, it should show 

the presence of the EmailSystemClient.cod file.

June-19-14

Copyright © QuByte Logic Ltd

92
BlackBerry Safe Mode/JVM Error Codes

Safe mode:

• can be used to prevent third-party applications from running automatically.

• Safe mode is designed to allow troubleshooting or remove any unwanted 

applications.

• only works on OS 4.6 and higher.

Steps to enabling safe mode:

• Remove and reinsert the BlackBerry® smartphone battery. 

• When the red light-emitting diode (LED) light goes out, press and hold the 

Escape key as the BlackBerry® smartphone is loading. See KB05470 for the 

location of the Escape key. 

• When the dialog box appears, click OK. 

June-19-14

Copyright © QuByte Logic Ltd

93
BlackBerry Safe Mode/JVM Error Codes

JVM Error Codes

• It is possible for JVM Errors to occur when interacting with the 

underlying BlackBerry® smartphone hardware that is no longer 

operating as expected. 

• An example of such a failure would be the corruption of the 

physical flash memory.

• JVM errors may also occur as a result of software related issues.

• Reloading BlackBerry® Device Software is not option for a device 

that is considered to have evidence on it.

• Safe Mode may help you resolve Java Errors

• If Safe Mode does not work, then your only recourse is a chip off 

solution (no guarantee of success).

June-19-14

Copyright © QuByte Logic Ltd

94
BlackBerry: SIM Number Spoofing

Could one edit the phone number assigned to the SIM and spoof’s one 

number to appear as something different through the Edit Phone 

Number feature?

The author did perform some limited testing on a BlackBerry Bold 9700; OS 

6.0.0.448; Platform 6.6.0.124 in May 2012. 

• In OS 6 this is found under: Options -> Device -> Advanced System 

Settings -> SIM Card.

• Shows SIM ICCID and Phone Number assigned to SIM.

June-19-14

Copyright © QuByte Logic Ltd

95
BlackBerry: SIM Number Spoofing

Press Menu key to invoke the context options window: Access the 

Edit SIM Phone Number function: Options -> Device -> Advanced 

System Settings -> SIM Card -> Menu Key -> Edit SIM Phone 

Number

June-19-14

Copyright © QuByte Logic Ltd

96
BlackBerry: SIM Number Spoofing

Phone number is changed by 1 digit: from +14039096120 to 

+14039096121

June-19-14

Copyright © QuByte Logic Ltd

97
BlackBerry: SIM Number Spoofing

New message indicator also appears after edit of SIM phone 

number. 

June-19-14

Copyright © QuByte Logic Ltd

98
BlackBerry: SIM Number Spoofing

In the call history screen what appears on the author's private 

BlackBerry® device as My Number is: +1 403 909 6121 and not the 

carrier assigned number of +1 403 909 6120. 

June-19-14

Copyright © QuByte Logic Ltd

99
BlackBerry: SIM Number Spoofing

A screenshot from a SIM extraction performed only with Cellebrite

UFED shows the MISDN value as +1 403 909 6121. This shows 

that the Edit SIM Phone Number function, through the device, will 

cause a write to occur to the SIM.

Connecting the device (with SIM in the device) to BlackBerry Desktop 

Software, it shows the edited phone number of +1 403 909 6121.

June-19-14

Copyright © QuByte Logic Ltd

100
BlackBerry: SIM Number Spoofing

• Calls from this number spoofed device, show up as 

the original number!

• The device event log was extracted, and shows that a 

phone number change did take place.

June-19-14

Copyright © QuByte Logic Ltd

101
BlackBerry 10

• First released in January 2013 as a Z10; this 

was followed by Q10 (keyboard) and then 

Z30.

• The BB 10 device essentially comes with 

16GB internal flash memory, 2GB RAM and 

accepts up to a 32GB memory card and 

contains the same basic hardware 

infrastructure commonly observed in 

smartphones.

June-19-14

Copyright © QuByte Logic Ltd

102
BlackBerry 10 - Hardware

• The Z10 model is touch screen, and comes in several 

sub-variants for its baseband configurations.

• STL100-[1-4]

• The STL100-1, which is non-LTE, uses the STEricsson Thor chipset with TI OMAP; this uses a 

PowerVR SGX 544 GPU.

• The STL100-[2-4] variants, which are all LTE, use 

the Qualcomm MSM8960 (Qualcomm Snapdragon 

S4 Plus) chipset which are dual core 1.5GHz and 

contain an Adreno 225 GPU.

Source: Ralf-Philipp Weinmann., BlackBerry 10 OS from a security perspective, University of Luxembourg, black hat USA 2013 Presentation.

June-19-14

Copyright © QuByte Logic Ltd

103
BlackBerry 10 - OS

• Runs the QNX (Unix) based operating system and is 

considered a micro kernel architecture for embedded 

systems in comparison to the Monolithic Android 

Kernel.

• The function of the micro kernel

• handle execution of processes passed to it by the 

process manager; 

• it does not deal with the file system 

• and does not contain device drivers.

June-19-14

Copyright © QuByte Logic Ltd

104
BlackBerry 10 - OS

June-19-14

Copyright © QuByte Logic Ltd

105

*Image Source: http://upload.wikimedia.org/wikipedia/commons/thumb/6/67/OS-structure.svg/450px-OS-structure.svg.png from 

http://en.wikipedia.org/wiki/Microkernel
BlackBerry 10 - OS

• Within the logical file system, QNX is mounted at /pps.

• A number of different functions are running on top of kernel 

and user land [4]:

• PIM (Personal Information Manager) certain parts of the 

PIM are written in Python.

• Adobe Air and QT are used in some of the apps like 

Weather app.

• Android 2.3 Java runtime is present: but you need to 

convert APK files into BAR files in order to run Android app 

in BB OS 10.

*Sources: 

1. Antukh, A., BlackBerry Z10 Research Primer: Dissecting BlackBerry 10 – An initial analysis, SEC Consult Vulnerability Lab, Vienna, 05/2013, V 1.0 Whitepaper

2. Plasket, A., Is BlackBerry Dead? An Introduction to Blackberry 10 Security (BB10 - QNX), MWR InfoSecurity, PowerPoint Presentation

3. Lanier, Z., & Nell, B., Voight-Kampff'ing The BlackBerry PlayBook, Intrepidus Group Mobile Security, PowerPoint Presentation

Blog: http://blog.n0where.org/2012/04/voight-kampff-blackberry-playbook.html

4. Ralf-Philipp Weinmann., BlackBerry 10 OS from a security perspective, University of Luxembourg, black hat USA 2013 Presentation.

June-19-14

Copyright © QuByte Logic Ltd

106
BlackBerry 10 - OS

QNX firmware contains the following unique 

artifacts from analysis perspective [1,2]:

• File header: mfcq (ASCII), 6d 66 63 71h

•Partition header: qcfp (ASCII), 71 63 66 70h

• There are a number of partitions that follow the 

follow the file header; in the BlackBerry 

Playbook for example, 5 QCFP partitions are 

observed in the firmware.

Sources:

1. Antukh, A., BlackBerry Z10 Research Primer: Dissecting BlackBerry 10 – An initial analysis, SEC Consult Vulnerability Lab, Vienna, 05/2013, V 1.0 Whitepaper

2. Lanier, Z., & Nell, B., Voight-Kampff'ing The BlackBerry PlayBook, Intrepidus Group Mobile Security, PowerPoint Presentation

Blog: http://blog.n0where.org/2012/04/voight-kampff-blackberry-playbook.html

June-19-14

Copyright © QuByte Logic Ltd

107
BlackBerry 10 – OS Permissions

• Permissions in QNX in BB OS 10 are handled by 'authman' 

which is located at /etc/authman/sys.acl [2,3,4].

• Applications are installed to /apps and they cannot read 

another application's code or data; this is controlled by 

'authman' [2].

• Application permissions are handled by authman: 

permission categories allow, prompt and deny [2,3].

• Allow: identified apps can use the permission assigned to 

them.

• Prompt: the app must prompt the user first.

• Deny: the app cannot use a capability.

Sources:

2. Plasket, A., Is BlackBerry Dead? An Introduction to Blackberry 10 Security (BB10 - QNX), MWR InfoSecurity, PowerPoint Presentation

3. Lanier, Z., & Nell, B., Voight-Kampff'ing The BlackBerry PlayBook, Intrepidus Group Mobile Security, PowerPoint Presentation

Blog: http://blog.n0where.org/2012/04/voight-kampff-blackberry-playbook.html

4. Ralf-Philipp Weinmann., BlackBerry 10 OS from a security perspective, University of Luxembourg, black hat USA 2013 Presentation.

June-19-14

Copyright © QuByte Logic Ltd

108
BlackBerry 10 – Security

1. The BlackBerry device contains the same foundation of 

security feature as observed in BB OS 7: 

• Password Protection

• Encryption for device and/or memory card

• Device wipe for device and/or memory card

2. BlackBerry ID: The device user is asked to create or sign in 

with their BlackBerry ID before they can go any further into the 

device on first setup. 

3. BlackBerry Protect: This comes installed as part of the 

operating system and a BlackBerry ID is required for this 

feature to work. This allows device geo location, device 

wiping, and device backup/restore.

June-19-14

Copyright © QuByte Logic Ltd

109
BlackBerry 10 – Security

4. Application Permissions: This lets the user control 

what an application can access. Permissions settings for 

applications are located in: Settings -> Security and 

Privacy -> Application Permissions.

5. If the device is attached to a BES 10, the BlackBerry 

Balance feature can be applied to the BlackBerry 10 

device allowing separation of work and personal areas. 

This separation allows the BES administrator to easily 

remove the data from the workspace without affecting 

the personal space. 

June-19-14

Copyright © QuByte Logic Ltd

110
BlackBerry 10 – Security

6. From an operating system security perspective the 

BlackBerry 10 has the following exploit mitigation measures 

[4]:

• DEP/XN (Data Execution Prevention)

• ASRL (Address Space Randomization Layout), 

• PIE (Position Independent Execution), 

• full RELRO (RELocation Read Only): see this link for an 

explanation about RELRO http://tkblog.blogspot.ca/2009/02/relro-not-so-well-knownmemory.html

• But no heap hardening.

Source: 4. Ralf-Philipp Weinmann., BlackBerry 10 OS from a security perspective, University of Luxembourg, black hat USA 2013 Presentation.

June-19-14

Copyright © QuByte Logic Ltd

111
BlackBerry 10: Picture Password

Picture Password: 

• Introduced in in OS 10.2.1.

• Uses a number combination of 0-9 and a picture to lock 

and unlock the device.

• Requires a device password to be set in case you forget 

your Picture Password or if you need to access your 

device from a computer using BlackBerry Link. 

• After five failed attempts to unlock your device using 

Picture Password you’ll be prompted for your device 

password instead.

June-19-14

Copyright © QuByte Logic Ltd

112
BlackBerry 10: Picture Password

June-19-14

Copyright © QuByte Logic Ltd

113

Source: http://n4bb.com/wp-content/uploads/2013/11/Picture-Password.jpg
BlackBerry 10: Picture Password

• To unlock the device you drag 

the number you have chosen, 

to the specific point on the 

picture you have chosen. 

• You do not need to tap the 

number. The number is moved 

by sliding the number grid so 

the number you have chosen is 

in the correct place on the 

picture.

• Difficult to ascertain what your 

password is as the numbers 

and size of the grid varies each 

time. Image Source: https://encryptedtbn3.gstatic.com/images?q=tbn:ANd9GcTDqcTcNqszN1lNz

OEt4k3DiQ8SOd9winkCQfeDPHASWEZ4hSNe

June-19-14

Copyright © QuByte Logic Ltd

114
BlackBerry 10 – EScreen

• BlackBerry 10 also has an engineering screen, or 

EScreen which is invoked in a very similar manner to 

its predecessors.

• Several websites that show how to do this: one is 

http://crackberry.com/how-access-engineeringscreen-blackberry-10

June-19-14

Copyright © QuByte Logic Ltd

115
BlackBerry 10 – EScreen

June-19-14

Copyright © QuByte Logic Ltd

116
BlackBerry 10 – EScreen

• One interesting aspect of the engineering screen is 

Remote Log Collection. 

• On the device user first has to manually enable 

diagnostic and usage data collection under Settings-

>Privacy & Security -> Diagnostics. 

• The feature ‘Send diagnostics and usage data’ is set 

to ‘Off’ by default. The data collected by this function 

is tied to the settings that are enabled in the QUIP 

Remote Log Collection.

June-19-14

Copyright © QuByte Logic Ltd

117
BlackBerry 10 – EScreen

• A screenshot shows the QUIP Remote Collection features. By 

default this is not enabled and what you are seeing are not 

default settings.

*Image Source: Ralf-Philipp Weinmann., BlackBerry 10 OS from a security perspective, University of Luxembourg, black hat USA 2013 

Presentation.

June-19-14

Copyright © QuByte Logic Ltd

118
BlackBerry 10 – EScreen

• With Diagnostics enabled in the Settings-

>Privacy & Security -> Diagnostics AND

• Remote Diagnostics and Log Capture turned 

on, different types of data can be collected 

which includes: screen captures, raw 

memory dumps, audio, video, and GPS 

location. 

*Image Source: Ralf-Philipp Weinmann., BlackBerry 10 OS from a security perspective, University of Luxembourg, black hat USA 2013 Presentation.

June-19-14

Copyright © QuByte Logic Ltd

119
BlackBerry 10 Connected to Windows 7 or Mac OS X 

• When a password protected BlackBerry 10 device 

connects to the computer, regardless of operating 

system, the user will be prompted to enter the 

password in BlackBerry Link. 

• The total number of password attempts is 5. In 

contrast BB OS 7 and lower devices with 

BlackBerry Desktop Software are allowed 10 

attempts.

June-19-14

Copyright © QuByte Logic Ltd

120
BlackBerry 10 Connected to Windows 7 or Mac OS X 

• BlackBerry 10 devices can be accessed over WiFi using BlackBerry Link software on Windows or 

Mac; this allows the ability to sync multi-media 

content, and documents between the device and 

computer over Wi-Fi instead of USB. 

• By default the option to connect the 

BlackBerry device to BlackBerry Link over WiFi is enabled. Disabling this feature within 

BlackBerry Link does not affect the Wi-Fi settings 

on the device.

June-19-14

Copyright © QuByte Logic Ltd

121
BlackBerry 10 Connected to Windows 7 or Mac OS X 

• Within the BlackBerry Z10 device specifically under 

‘Storage and Access’ the device can be accessed using 

Wi-Fi through either a Windows or Mac OS X computer. 

• This is disabled by default on the device and is different 

than the Wi-Fi access via BlackBerry Link. If this is 

enabled on the device, the user will be prompted to create 

a Password Wi-Fi Storage Access.

June-19-14

Copyright © QuByte Logic Ltd

122
BlackBerry 10 Connected to Windows 7 or Mac OS X 

Image Source: http://helpblog.blackberry.com/2013/03/copy-z10-files-wifi/ 

June-19-14

Copyright © QuByte Logic Ltd

123
BlackBerry 10 Connected to Windows 7 or Mac OS X 

• When a BlackBerry Z10 device connects to a Windows 

machine, two network drive locations were mounted on the 

author's machine; they are recognized as NTFS file 

systems by Windows 7. 

June-19-14

Copyright © QuByte Logic Ltd

124
BlackBerry 10 Connected to Windows 7 or Mac OS X 

• If the device is password protected, the password must be 

entered on the first instance of connecting, within 

BlackBerry Link, before the volumes will be mounted.

June-19-14

Copyright © QuByte Logic Ltd

125
BlackBerry 10 Connected to Windows 7 or Mac OS X 

• Using the BlackBerry Device Manager Properties, 

Connected Devices tab, we can see that Volume Z is 

internal memory and Volume Y is the Removable SD card.

June-19-14

Copyright © QuByte Logic Ltd

126
BlackBerry 10 Connected to Windows 7 or Mac OS X 

• The internal volume (Z:) contains two more folders: misc

and print. 

June-19-14

Copyright © QuByte Logic Ltd

127
BlackBerry 10 Connected to Windows 7 or Mac OS X 

• When a BB 10 device connects to this Mac OS X the following 

volumes are mounted:

• media, dtm and if the device contains a removable SD card this 

too will be mounted.

• In terminal the 'mount' command was run which identifies the 

mounted volumes, which shows 3 volumes mounted in Mac OS X.

//dtm@169.254.249.49/removable_SDCARD on 

/Volumes/removable_SDCARD (smbfs, nodev, nosuid, mounted 

by qubyte)

//dtm@169.254.249.49/media on /Volumes/media (smbfs, nodev, nosuid, mounted by qubyte)

//dtm@169.254.249.49/dtm on /Volumes/dtm (smbfs, nodev, nosuid, mounted by qubyte)

June-19-14

Copyright © QuByte Logic Ltd

128
BlackBerry 10 Connected to Windows 7 or Mac OS X 

• The 'smbfs' indicates Samba file system which is accessed 

over a network path a 

smb://169.254.251.197/volumename. 

• Because it recognized as a network share, even though it 

contains an NTFS file system, the Mac OS X system can 

also write to it. If this were mounted as block device, the 

user would not be able to write to either drive natively 

because contains an NTFS file system.

• Backup files on a Mac OS X are stored to the following 

location:

• /volumename/Users/username/Documents/BlackBerry 

Backups

• A synchronization folder for multimedia content will also 

be created usually in the same path location:

/volumename/Users/username/Documents.

June-19-14

Copyright © QuByte Logic Ltd

129
BlackBerry 10: Log Files

• BlackBerry 10 log files can be collected using the 

BlackBerry Link Software:

• Checking the ‘Gather extra log information’ requires the 

BlackBerry 10 or Blackberry Playbook to be connected to 

BlackBerry Link. This is how event logs are obtained from these 

devices.

June-19-14

Copyright © QuByte Logic Ltd

130
BlackBerry 10: Log Files

• The log file (from a BlackBerry Playbook) is stored in a 

ZIP archive format to the desktop of the computer in 

this case.

June-19-14

Copyright © QuByte Logic Ltd

131
BlackBerry 10: Log Files

• Device717264340-201310211249.pb archive 

contents.

• The filenames are prefixed with a UNIX epoch time value in decimal and 

contain an 'aes' extension, which is likely indicative of AES encryption.

June-19-14

Copyright © QuByte Logic Ltd

132
BlackBerry 10 – Backups

• BlackBerry 10 device backups can be created ONLY

using BlackBerry Link for Windows and Mac (this 

does not include any third party tools capable of 

creating backups).

• For the BlackBerry Playbook, both BlackBerry 

Desktop Software and BlackBerry Link for Windows 

and Mac can be used. 

• The resultant files are identified with a ‘.bbb’ 

extension. 

June-19-14

Copyright © QuByte Logic Ltd

133
BlackBerry 10 – BBB Files

• The BBB files are ZIP archives that contain two child files 

and one child folder called ‘Archive’. 

• Two files: these two files do not get encrypted during the 

backup process, at the present time.

• PkgInfo: Contents of this file can also be viewed in a text or 

notepad type editor as shown below.

BlackBerryBackupFormatV2.0.0

Research In Motion

http://www.blackberry.com/

http://www.rim.com

1726dfe6f5336a9f1a3da1ceb11ecb69

June-19-14

Copyright © QuByte Logic Ltd

134
BlackBerry 10 – BBB Files

• Manifest.xml for a BlackBerry Playbook:

• <?xml version="1.0" encoding="UTF-8"?>

<BlackBerry_Backup>

 <Client platform="windows" osversion="Microsoft Windows NT 6.0.6002 Service Pack 2"

dtmversion="6.1.0.35" />

 <Version>2.0</Version>

 <Encryption type="RIM_AES_CBC" version="1.0" Salt="" />

 <SourceDevice pin="500F54B8" hwid="6001A06">

 <Platform type="QNX" version="1.0.7.2670" />

 </SourceDevice>

 <QnxOSDevice>

 <Archives>

 <Archive id="app" name="Application Data" count="51" bytesize="541257216" />

 <Archive id="media" name="Media" count="11" bytesize="1728000" />

 <Archive id="settings" name="Settings" count="994" bytesize="1368064" />

 </Archives>

 </QnxOSDevice>

</BlackBerry_Backup>

June-19-14

Copyright © QuByte Logic Ltd

135
BlackBerry 10 – BBB Files

• Manifest.xml for a BlackBerry 10:

• Note the ‘keyid=‘ value, which is the BlackBerry 10 

user’s BlackBerry ID value as an email address

June-19-14

Copyright © QuByte Logic Ltd

136
BlackBerry 10 – BBB Files

• Within the ‘Archive’ folder three TAR files are present: 

apps.tar, media.tar and settings.tar. 

• The contents of these files are encrypted regardless 

of which BlackBerry backup software was used and 

regardless of the device being password protected or 

not. 

• The decryption of the BBB cannot be disabled from 

within the software or the device.

• The TAR files headers differ between the Playbook 

and BlackBerry Z10.

June-19-14

Copyright © QuByte Logic Ltd

137
BlackBerry 10 – Playbook TAR Header 

• File Header: This consistently appears in all 

three TAR files regardless of software used or 

the OS platform the BBB is generated on. 

• 51 4E 58 00 30 00 00 00 00 00 00 00 31 38 

36 61 h

•'QNX 0 186a' in ASCII; the gap between 

the '0' and the start of '186' is separated by 7 

null values or 0x00.

June-19-14

Copyright © QuByte Logic Ltd

138
BlackBerry 10 – Playbook TAR Header 

June-19-14

Copyright © QuByte Logic Ltd

139
BlackBerry 10 – Z10 TAR Header 

• File Header: This consistently appears 

in all three TAR files regardless of 

software used or the OS platform the 

BBB is generated on. 

• 50 45 52 00 31 00 00 00 00 00 00 00 

31 38 36 61 30h

• 'PER 1 186a0' in ASCII; the gap 

between the '0' and the start of '186' 

is separated by 7 null values or 0x00.

June-19-14

Copyright © QuByte Logic Ltd

140
BlackBerry 10 – Z10 TAR Header 

June-19-14

Copyright © QuByte Logic Ltd

141
BlackBerry 10: Data Extraction/Analysis

• Oxygen Forensics has a solution in place for 

the BlackBerry 10 backups.

• UFED can acquire limited amount of data at 

this time. This may improve in future versions. 

•A chip off dump of the BB 10 device is 

encrypted at the chip level, as discovered by 

Bob Elder.

June-19-14

Copyright © QuByte Logic Ltd

142
BlackBerry 10: BBB Backup File

• Oxygen Forensic Suite (OFS) Analyst 6.1.x 

and higher can parse a BlackBerry 10 backup 

file:

• provided you know the password to the 

device owner's BlackBerry ID account 

(which may or may not be the same as the 

device password). 

June-19-14

Copyright © QuByte Logic Ltd

143
BlackBerry 10 Backup Files with OFS

• Import the BBB file using either File -> Import or the 

Oxygen Forensic Extractor.

June-19-14

Copyright © QuByte Logic Ltd

144
BlackBerry 10 Backup Files with OFS

Once you have selected the backup file, OFS will identify the 

email account used by the device owner to access his/her 

BlackBerry ID account. The password to the BlackBerry ID 

account will be required in order for OFS to decrypt the backup 

and subsequently parse the data.

June-19-14

Copyright © QuByte Logic Ltd

145
BlackBerry 10 Backup Files with OFS

• OFS decrypting BBB TAR files with QBEK Key.

• The QBEK Key is associated to the urn:bbid:backupandrestore

key [7,8]:

• urn = uniform resource name

• The remainder of URN syntax consists of the namespace-identifier 

(NID), separated by a colon, and then the namespace-specific 

string (NSS).

• The BlackBerry ID is associated to the encryption of the BlackBerry 

10 backup.

June-19-14

Copyright © QuByte Logic Ltd

146
BlackBerry 10 Backup Files with OFS

• End result of decryption and parsing

June-19-14

Copyright © QuByte Logic Ltd

147
BlackBerry 10 Backup Files with OFS

• The File Browser feature allows you to export the 

folders/files out of OFS for use in other forensic tools like 

UFED PA or XWF.

June-19-14

Copyright © QuByte Logic Ltd

148
BlackBerry 10 Backup Structure

The BlackBerry logical file system data consists 

of the following types:

•SQLite databases in .db and .dat format

•XML files

•INI files

•BIN files

•And various other types of files whose 

contents are in plain text such as .conf files.

June-19-14

Copyright © QuByte Logic Ltd

149
BlackBerry 10 Backup Structure

The three TAR files when decrypted consist of 

three folders: app, media and settings:

June-19-14

Copyright © QuByte Logic Ltd

150
BlackBerry 10 Backup Structure

app Folder

This folder contains the applications that are on the 

device, containing folders with long names.

June-19-14

Copyright © QuByte Logic Ltd

151
BlackBerry 10 Backup Structure

app Folder

• Naming convention follows as:

• com.XXXX.gYABG string

• sys.XXXX.gYABG string

• The XXXX = resource or application name then followed by 

a gYABg, which appears to an obfuscated string of 

alphanumeric characters.

• Expanding the folder structure shows that in almost all, if 

not all, folder sub paths, there is an folder structure as:

• /com.resrouce.gYABg string/appdata/data 

June-19-14

Copyright © QuByte Logic Ltd

152
BlackBerry 10 Backup Structure

media Folder 

This folder contains the storage areas for user created 

content, and downloaded content as shown below.

June-19-14

Copyright © QuByte Logic Ltd

153
BlackBerry 10 Backup Structure

• Be cognizant that all BlackBerry 10 smart phone 

devices come with an microSD memory card, which 

will contain a similar directory structures as shown 

below.

June-19-14

Copyright © QuByte Logic Ltd

154
BlackBerry 10 Backup Structure

settings Folder 

This folder contains the storage areas for the user 

account, system/device settings and var (variable data) 

folders with subfolders.

June-19-14

Copyright © QuByte Logic Ltd

155
BlackBerry 10 PIM Data

• Refers to personal information organized in a range of 

different application functions such as calendar, 

emails, address/contact book, tasks, and reminders.

• /app: subfolders contained in various sub-folders, 

is found under the following sys.pim folders.

June-19-14

Copyright © QuByte Logic Ltd

156
BlackBerry 10 PIM Data

• /settings/accounts/1000/sysdata/pim

June-19-14

Copyright © QuByte Logic Ltd

157
BlackBerry 10 PIM Data - Calendar

• 1-pim.db located at:

•\settings\accounts\1000\sysdata\pim\db.

• CalendarEvent table

• Time values: two time stamp columns in 

human readable time, stored relative to 

UTC/GMT.

June-19-14

Copyright © QuByte Logic Ltd

158
BlackBerry 10 PIM Data - Contacts

• 2-pim.db located at 

• \settings\accounts\1000\sysdata\pim\

db.

• The information related to a contact is 

spread across these various tables.

June-19-14

Copyright © QuByte Logic Ltd

159
BlackBerry 10 PIM Data - Call History/Call Log

• 8-pim.db located at 

• \settings\accounts\1000\sysdata\pim\db.

• Two tables, 'Call' and 'CallDetail' contain 

similar records; both tables should be 

analyzed and cross-referenced to detect 

differences in the data contained therein.

• Time values stored in human readable time, 

stored relative to UTC/GMT.

June-19-14

Copyright © QuByte Logic Ltd

160
BlackBerry 10 PIM Data – Tasks/Reminders

• 18-pim.db located at 

• \settings\accounts\1000\sysdata\pim\db.

• On the BlackBerry device this data is classified under 

the 'Remember' application.

• Time values stored in human readable time, are 

presumed to be stored relative to UTC/GMT.

June-19-14

Copyright © QuByte Logic Ltd

161
BlackBerry 10 - SMS/MMS

• messages.db located at 

• \settings\var\db\text_messagingsettings\.

• Message content in the Attachments table.

• Timestamp values in Messages table under timeStamp

and creationDate columns are stored as 13 character 

decimal value, which is a Unix epoch time stamp.

• the inbound fields in the Messages table:0 = sent 

message, and 1 = received message.

• the senders name address for sent messages are empty, 

and the sendersid value is negative integer, -1.

June-19-14

Copyright © QuByte Logic Ltd

162
BlackBerry 10 – BBM

• the master.db located at 

• \sys.bbm.gYABgLOJBR2Vz7FzS.kdgJchuag\appdata\

data. 

• BBM avatar picture resides the in the photos subdirectory, 

and is named using the BlackBerry PIN value of the 

device.

• Timestamp field is a 10 character decimal value 

(compared to the 13 digits for text messages), which is 

Unix epoch time.

• Because BBM allows voice and video chat, these events 

are also stored in the messages.db; the CallEventId field 

assigns an incremental decimal value for the start and end 

of each voice or video chat. 

• IsInbound value: 0 = sent message, and 1 = received 

message 

June-19-14

Copyright © QuByte Logic Ltd

163
BlackBerry 10 – BlackBerry Hub (BBH)

• The BlackBerry Hub includes: call log, voicemail 

notification, email, sms, mms, social networking 

notifications, BBM, instant messaging, BBM calendar 

events, and notifications.

June-19-14

Copyright © QuByte Logic Ltd

164
BlackBerry 10 – BlackBerry Hub (BBH)

• BBH unintentionally acts as timeline of activity of the 

BlackBerry 10 device, as it includes data from a 

number of application areas.

• Path: 

\sys.pim.messages.gYABgJ8jn83Ok_NEWYplPYozt5

w\appdata\data\unfied.db

June-19-14

Copyright © QuByte Logic Ltd

165
BlackBerry 10 – BlackBerry Hub (BBH)

• The unified.db database holds some excellent artifacts such as:

• Type: identifies the application such as callog, whatsapp, sms, 

notification, bbm.

• TimeStamp: 13 character decimal value, Unix epoch time.

• IconPath: indicates the status of the data such as 

• sms_read

• phone_missed

• phone_outgoing

• phone_incoming

• bbm_read

• notification_read

June-19-14

Copyright © QuByte Logic Ltd

166
BlackBerry 10 – Internet

• The Internet history artifacts are stored in several areas within 

the backup structure.

• Internet Artifacts Location 1:

\app\sys.browser.gYABgJYFHAzbeFMPCCpYWBtHAm0\appdata\data\

chrome\database\Databases.db

• This file identifies the name of three databases, so next we examine the 

database files listed in the path field, which are all stored in the same 

sub directory structure.

June-19-14

Copyright © QuByte Logic Ltd

167
BlackBerry 10 – Internet

• Carrier bookmarks = 0000000000000001.db: this contains the 

carrier provided website bookmarks.

June-19-14

Copyright © QuByte Logic Ltd

168
BlackBerry 10 – Internet

• Bookmarks and History = 0000000000000002.db: this contains 

the device user's Internet history and user bookmarks:

• The history table, urlKey field, is related to the urls table id field

June-19-14

Copyright © QuByte Logic Ltd

169
BlackBerry 10 – Internet

• Permissions = 0000000000000003.db: this database contains 

permissions that are assigned to it by the device user. 

• In this case, it appears as though the Google Maps URL has 

been given permission to access the device, based on the allow 

value of 1. The value of 0 = not allowed.

June-19-14

Copyright © QuByte Logic Ltd

170
BlackBerry 10 – Internet

• Internet Artifacts Location 2:

• The next file of interest is the local__0.localstorage SQLite file located at:

\app\sys.browser.gYABgJYFHAzbeFMPCCpYWBtHAm0\appdata\data\chro

me

• This contain the browser settings in the local__0.localstorage SQLite 

file.

June-19-14

Copyright © QuByte Logic Ltd

171
BlackBerry 10 – Internet

• Internet Artifacts Location 3:

• The areas of interest are the files and folders stored in the path 

at:

\app\sys.browser.gYABgJYFHAzbeFMPCCpYWBtHAm0\appdata\da

ta\webviews

June-19-14

Copyright © QuByte Logic Ltd

172
BlackBerry 10 – Internet

• Internet Artifacts Location 4:

• Browser cache files are stored at the path:

• \app\sys.browser.gYABgJYFHAzbeFMPCCpYWBtHAm0\appdat

a\data\webviews\cache

• \app\sys.browser.gYABgJYFHAzbeFMPCCpYWBtHAm0\appdat

a\data\webviews\cache\[data_1|data_2|data_3]

• The cache can also include Google Map tiles that are cached when 

accessing Google Maps for location and map information from the 

device.

June-19-14

Copyright © QuByte Logic Ltd

173
BlackBerry 10 – Internet

Cache Example: this google map tile shows an area of northwest 

Edmonton AB along the ring road, Anthony Henday Dr.

June-19-14

Copyright © QuByte Logic Ltd

174
BlackBerry 10 – Internet

• The file system time stamps from XWF 17.5 SR6 show that the 

file was created on 2013-09-30 07:44:53 -6. During that week 

the author (along with another colleague) was in Edmonton, 

attending an X-Ways Forensics Class! 

• By looking at the remainder of the google map tile files, and the 

proximity of the time stamps for the surrounding google map 

tiles, an inference can be drawn as to where the device (and 

possibly the device owner/user) was.

June-19-14

Copyright © QuByte Logic Ltd

175
BlackBerry 10 – Internet

• Examining the subfolder below the cache, which is the data_1 

(and the remaining ‘data_X’ folders, we can see that it contains 

search query strings.

June-19-14

Copyright © QuByte Logic Ltd

176
BlackBerry 10 – Internet

• Internet Artifacts Location 5:

• This location path contains cached web based email 

content, stored in SQLite databases.

• Path: 

\app\sys.browser.gYABgJYFHAzbeFMPCCpYWBtHA

m0\appdata\data\webviews\database

June-19-14

Copyright © QuByte Logic Ltd

177
BlackBerry 10 – Internet

• In the root of the database folder there is a 

Databases.db which identifies the email account 

relative to its corresponding database file.

June-19-14

Copyright © QuByte Logic Ltd

178
BlackBerry 10 – Internet

• 0000000000000001.db: 

• The tables contain time values as Unix epoch time, from 13 – 16 

decimal characters in length.

June-19-14

Copyright © QuByte Logic Ltd

179
BlackBerry 10 – Internet

• Internet Artifacts Location 6:

• This path location contains the visited URL's accessed 

by the device.

• Path 

\app\sys.browser.gYABgJYFHAzbeFMPCCpYWBtHAm0

\sharewith\search

June-19-14

Copyright © QuByte Logic Ltd

180
BlackBerry 10 – Pictures

• Several categories of pictures that can be found on the 

Blackberry 10 device.

1. First category is user created pictures taken with the 

BlackBerry 10 device:

• Under 'Camera Settings' if the 'Save on Media Card is 'On' then 

device created pictures are saved to the memory card under the 

path /sdcard/camera.

• If the 'Save on Media Card' is set to 'Off' then the device created 

pictures are saved to the device memory at /media/camera.

• Under 'Camera Settings' if the 'Geotag Pictures' is 'On' this will add 

the device's GPS location to the pictures, provided that it can 

receive the GPS signal.

June-19-14

Copyright © QuByte Logic Ltd

181
BlackBerry 10 – Pictures

2. Second category is device created screenshots. 

• This refers to the device user taking a screenshot of the contents being displayed 

on the BlackBerry 10 device by pressing the Volume Up AND Volume Down 

buttons. There is no EXIF data present in a BlackBerry 10 PNG screenshot 

picture.

• The image is saved as a PNG file in the \media\camera, NOT the memory card 

regardless of the 'Camera Settings' -> 'Save on Media Card is 'On' feature.

• The PNG file name will be IMG_YYYYMMDD_XXXXX.PNG and contains the 

date and time the PNG file was created.

• YYYYMMDD = 4 decimal values to represent year, 2 decimal values to 

represent, 2 decimal values to represent day.

• X = time in 24 hour format down to seconds.

June-19-14

Copyright © QuByte Logic Ltd

182
BlackBerry 10 – Pictures

3. Third category is pictures stored in /sdcard/photos or /media/photos.

• The author has observed the /media/photos folder location will store 

pictures transferred, during an upgrade from an older BlackBerry device 

that contains pictures, to a BlackBerry 10 device.

• The file name convention of a WA image contains a date value as 

YYYMMDD followed by WAXXX, where the XXX is a 3 digit numeric 

sequence.

• The date value will match the date the picture is received by the device.

• The images are stripped of any of the usual EXIF data.

June-19-14

Copyright © QuByte Logic Ltd

183
BlackBerry 10 – EXIF Pictures

EXIF Summary

1. BlackBerry 10 software 10.2.1.2141:

• Embeds the date and time value, local to device time, within the file 

name of the picture created using the Camera application of the 

device. 

• Now adds the Model value of BlackBerry Z10 within the EXIF, which 

was not done prior to 10.2.1.2141.

• If the BlackBerry 10 device OS was less than 10.2.1.214, the file 

name convention DOES NOT contain date or time value. It is 

formatted as IMG_ XXXXXXXX.JPG, where XXXXXXXX equals an 

8 character, sequential numeric value.

June-19-14

Copyright © QuByte Logic Ltd

184
BlackBerry 10 – EXIF Pictures

EXIF Summary

2. Regardless of the BlackBerry 10 OS version, within the EXIF, 

there is a unique string value, 'RIM0RD00' in pictures created with 

the camera application. I refer to this as the ‘MNUT Value’.

June-19-14

Copyright © QuByte Logic Ltd

185
BlackBerry 10 – EXIF Pictures

EXIF Summary

3. Pictures, taken with a BlackBerry Z10, viewed on the memory 

card, through the device, under the camera folder, appear to show a 

Modified Date value with wrong offset calculation being applied.

As an example we are going to look at file properties of the 

following files as displayed by the BlackBerry Z10:

• IMG_20140314_215602.jpg: As the filename indicates, the 

picture was taken with a BlackBerry Z10 on 2013-03-14, 

21:56:02, local device time.

June-19-14

Copyright © QuByte Logic Ltd

186
BlackBerry 10 – EXIF Pictures

EXIF Summary

3. The 'Modified Date' value is shown with a minus 6 hour 

difference in time relative to the filename time value.

June-19-14

Copyright © QuByte Logic Ltd

187

• offset should be 6 hours (plus 6 hours) ahead of 

the filename time value, so the Modified Date 

value should show as Mar 15, 2014 at 3:56:02 AM.

• offset is being calculated in the wrong direction, if 

the intent is to show the Modified Date value in 

UTC.
BlackBerry 10 – EXIF Pictures

EXIF Summary

3. ExifTool 9.56 output of IMG_20140314_215602.jpg.

June-19-14

Copyright © QuByte Logic Ltd

188
BlackBerry 10 – EXIF Pictures

EXIF Summary

4. The time values that are within the EXIF data of pictures created 

with BlackBerry Z10 device contain the time values of picture 

creation relative to the device's local time.

5. GPS data is present in EXIF so long as that option is enabled in 

the Camera settings and the device can receive the GPS signal. In 

the screens shots below the GPS Lat and Long values have been 

sanitized.

June-19-14

Copyright © QuByte Logic Ltd

189
BlackBerry 10 – Movies

There are several categories of movies that can be found on the 

Blackberry 10 device.

1. First category is user created movies taken with the BlackBerry 

10 device:

• Under 'Camera Settings' if the 'Save on Media Card is 'On' then 

device created movies are saved to the memory card under the 

path /sdcard/camera.

• If the 'Save on Media Card' is set to 'Off' then the device created 

pictures are saved the device memory at /media/camera.

June-19-14

Copyright © QuByte Logic Ltd

190
BlackBerry 10 – Movies

2. Second category is movies stored in /sdcard/videos or 

/media/videos.

• These locations are believed to contain content downloaded by 

the device or sent by messaging to the device.

• Note the file naming convention difference between first and 

second file indicates the MP4 files were created with two 

different BlackBerry 10 operating system versions. This follows 

the same pattern as was noted with the pictures.

June-19-14

Copyright © QuByte Logic Ltd

191
BlackBerry 10 – Movies

VID_20140315_101232.mp4

• This movie file was created on 2014:03:15 10:12:54 -06:00.

June-19-14

Copyright © QuByte Logic Ltd

192
BlackBerry 10 – EXIF Movies

EXIF Movie Summary

• File format or file type is mp4.

• The EXIF time values are stored in UTC relative to the local 

device time zone offset.

• There is no indication the movie files are created with a 

BlackBerry device compared to BlackBerry 7 and lower where 

movie files had a string value in the EXIF called 'rimm'.

• Naming convention, in BlackBerry 10 device lower than 

10.2.1.214, will not include the date and time local to the device 

in the file name.

• No geo-data is present in a movie file created with the 

BlackBerry 10.

June-19-14

Copyright © QuByte Logic Ltd

193
BlackBerry 10 – Settings: BBM PROFILE CORE

The profile file stores the device user's BBM profile information.

• Artifact Path: \settings\pps\services\bbmcore\profile

• The 'registrationId' value is 12 decimal characters in length.

June-19-14

Copyright © QuByte Logic Ltd

194
BlackBerry 10 – Settings: BP2P DEVICES

This stores the devices the BlackBerry 10 has connected with.

• Artifact Path: \settings\pps\services\bp2p\devices

June-19-14

Copyright © QuByte Logic Ltd

195
BlackBerry 10 – Settings: IMSI VALUE

IMSI value is found in the status_private file:

• Artifact Path: \settings\pps\services\cellular-voice 

service\status_private

June-19-14

Copyright © QuByte Logic Ltd

196
BlackBerry 10 – Settings: TIMEZONE

Time Zone Artifact 1:

Artifact Path: \settings\pps\services\clock\status

Time Zone Artifact 2:

Artifact Path: \settings\pps\services\confstr\ _CS_TIMEZONE

June-19-14

Copyright © QuByte Logic Ltd

197
BlackBerry 10 – Settings: DATE & TIME

Stores the device date & time settings.

• Artifact Path: \settings\pps\services\network-time

The status file, shown in the above screenshots contains the settings for:

• auto_time value = Set Date and Time Automatically is set to 'On' in Date and 

Time settings on the device.

• auto_zone value = Auto Update Time Zone is set to 'On' in Date and Time 

settings on the device.

• The last_update value is a 10 character decimal value, Unix epoch time.

June-19-14

Copyright © QuByte Logic Ltd

198
BlackBerry 10 – Settings: HOSTNAME

Contains the device name.

• Artifact Path: \settings\pps\services\confstr\ _CS_HOSTNAME

June-19-14

Copyright © QuByte Logic Ltd

199
BlackBerry 10 – Settings: PHONE NUMBER

Phone number used by BlackBerry 10 

through its SIM.

• Artifact Path: \settings\pps\services\phone\

• This folder path contains 3 sub folders each 

contain files with names ‘vchat’ and ‘cellular’.

• The path shown below contains vchat and 

cellular files.

\settings\pps\services\phone\private\lines

June-19-14

Copyright © QuByte Logic Ltd

200
BlackBerry 10 – Settings: PHONE NUMBER

• vchat file contains the PIN number.

June-19-14

Copyright © QuByte Logic Ltd

201
BlackBerry 10 – Settings: PHONE NUMBER

• cellular file contains a number of interesting artifacts, which 

includes the phone number, voicemail passcode, and the value 

that caller identify is restricted.

June-19-14

Copyright © QuByte Logic Ltd

202
BlackBerry 10 – Settings: NETWORK NAME

There are two files that contain the network operator name: 

navigator_status and status_public.

• Artifact Path: \settings\pps\services\rum\csm

June-19-14

Copyright © QuByte Logic Ltd

203
BlackBerry 10 – Settings: CAMERA

The status file stores save location of the data created using 

the Camera application, and also records the filename of the 

last captured file.

• Artifact Path: \settings\pps\system\camera

June-19-14

Copyright © QuByte Logic Ltd

204
BlackBerry 10 – Settings: DEVICE MODEL NAME 

AND MODEL NUMBER

The device properties file stores the device model name and 

model number information.

• Artifact Path: \settings\pps\system\restricted

June-19-14

Copyright © QuByte Logic Ltd

205
BlackBerry Forensics - CONCLUSION

• BlackBerry 7 and lower versus BlackBerry 10/BlackBerry 

Playbook: Two different schisms.

• BB7 (proprietary JVM) has no real file system from a 

physical level perspective compared to its BB10 (QNX) 

successor.

• BB 10 backup files are encrypted by default using 

BlackBerry Link.

• Remember to validate what you have observed in this 

presentation, as there is no official support from BlackBerry 

on the interpretation of any BB7 or BB10 artifacts.

• And finally – thanks for your patience and looking through 

all the slides! 

June-19-14

Copyright © QuByte Logic Ltd

206