hemu1438/forensicsgpt-training-data huggingface dataset:
Sms -
Short Message Service (SMS) is a service that digital phones can use to send short messages between phones. SMS messages are more commonly called text messages, and very popular among today's youth.
History
SMS was originally designed for GSM, but most all of the large digital mobile phone providers provide the ability to send messages to other phones via the SMS.
Popularity
Forensics Standpoint
Most modern phones store the SMS in their internal memory, rather than on the SIM card; in this case forensics should target the phone itself. If the phone does not store the SMS on the SIM card, it can be reconfigured to do so (whether this is possible and how it is done depends on the phone brand and model).
If the phone stores the SMS on the SIM card, forensics should target the card; there is a chance to recover a deleted SMS.
This is possible because some phones will only mark the SMS as deleted (instead of overwriting it with 0 or 1 bits); the text of the SMS will continue to reside on the card until a new SMS is received and the space will be overwritten with the contents of the new message.
SMS Recovery Tools
pySIM, a "SIM card management tool, capable of creating, editing, deleting, backup and restore operations on your SIM Phonebook and SMS records."
Adafruit Industries has a low-cost SIM reader kit that you can get from their website.
External Links
An entry level tutorial that explains the details behind the SMS recovery process
A video tutorial that shows how an SMS can be recovered, but does not go into the low-level details of the process.
T mobile sidekick -
The T-Mobile Sidekick, also known as the Hiptop for non T-Mobile customers, is a smartphone manufactured by Sharp.
History
In June 2006 T-mobile released its third version of the Sidekick, The Sidekick III.
Features
The Sidekick is used by many people with hearing disabilities, as it has a full QWERTY keyboard for text messaging, email, and web browsing. It is also popular among teenagers for this same reason.
The Sidekick 3 can be customized via Sidekick Themes, which can change the background image, application icons, and sounds.
Jtag samsung galaxy s4 (sgh i337) -
JTAG Samsung Galaxy S4
The Samsung Galaxy S4 is an Android based smartphone. At the time of this writing (2013JUL24), I am unaware of any method other than JTAG to acquire a physical image of the NAND on a Samsung Galaxy S4.
For the purpose of this document, a Samsung Galaxy S4 was disassembled, read via JTAG, reassembled.
Getting Started
What you need to dump the NAND:
A RIFF Box
Soldering skills and ultra-fine tip soldering iron (a JTAG jig may be available).
A DC Power supply capable of supplying 3.8V/1.83A output. The power supply used for this was an U8002A DC Power Supply.
NAND Dump Procedure
Disassemble the phone down to the PCB.
Connect the RIFF JTAG Box to the PC via USB.
Connect the RIFF JTAG Box to the PCB via the JTAG pins.
Connect the PCB to the DC power supply.
Start the "RIFF BOX JTAG" software.
Enable the power on the DC power supply.
Power the phone via the power button.
Dump the NAND via the RIFF Box software.
Instructions for disassembly can be found on Internet but it can be summarized as follows:
Remove the rear cover and battery.
Remove the 9 x Phillips screws.
Split the phone case using a case opening tool (guitar pick).
Once the phone has been disassembled, you can see the JTAG connection port located right about the power button. This JTAG port is in a great spot which makes it handy for soldering.
Solder the JTAG connector to the JTAG port as follows. I used 0.040 gauge magnet wire to connected an adapter that was inserted into the 20 pin ribbon cable supplied with the RIFF box.
Connect the PCB battery terminal connections to the DC power supply. The positive (+) connection is the outermost pin (1) and the negative (-) pin is the outermost pin (3). You can configure your power supply to match the battery specifications which in this case is 3.8V and 1.80A but do not apply power at this time.
NOTE: Attempts the connect to and read this using power supplied via the battery and USB port displayed inconsistent results. This is why we opted to use the DC power supply.
Now we can start the RIFF JTAG software and configure it, and connect the phone to the RIFF box. See the picture for more detail.
Apply power to the DC power supply and turn the phone on using the button on the side of the PCB. After powering the phone on, select "READ" under the "DCC Read/Write" tab. If all goes well the "READ" button will become the "STOP" button and the phone will begin reading... if not the RIFF software provides troubleshooting steps that should be taken to assist in diagnosing some of the issues you may experience.
NOTE: In the event of read errors the RIFF software keeps track of where the failure occurred and gives you option restart the read where it left off.
Once the acquisition is complete the resulting image can be saved and Forensic Analysis can take place using the tool of your choosing.
References
https://forensics.spreitzenbarth.de/2012/02/
1x evdo -
1X EVDO stands for EVolution Data Optimized, a wireless broadband data standard used in many CDMA providers around the world. QualComm had the initial design in 1999 to meet IMT-2000 (International Mobile Telecommunications-2000) standards being better than 2Mbit/s downlink for stationary communications.
Verizon currently implements 1X EVDO called V Cast for high speed data speeds for mobile phones. Verizon and Sprint both provide this service in most major U.S. cities. EVDO is based the 1xRTT standard technology that provides two to three times internet speed of dial-up. Since it is based on 1xRTT, if an user goes outside of the EVDO coverage zone, the user automatically is transferred to 1xRTT standard making internet access very convenient.
The advantages Evdo has over WiFi is that it has seamless roaming, customers can access corporate VPN anywhere they can get a signal, realtime downloads, and signal travel on cell phone cell sites.
Pdas -
Personal Digital Assistants (PDAs) are handheld devices with features such as calendar, notes, and so on. They are also known as a palmtop computer. They can be used to access the Internet usually through Wi-Fi.
Current Popular PDA Operating Systems
RIM BlackBerry
Linux
Palm
Symbian
Microsoft PocketPC
Microsoft Windows Mobile
PDA Forensics
PDD (pdd) is a forensic tool for capturing the contents off early Palm devices. Originally developed by Joe Grand it was one of the first Win32 executable programs to perform such an acquisition. Unfortunately there are no published methods for analyzing the resulting data.
Original paper by Grand
Actual tool
Also see
Cellebrite UFED
Paraben Device Seizure
Paraben Device Seizure Toolbox
External Links
Jansen, Ayers Guidelines on PDA Forensics
Ayers, Jansen PDA Forensic Tools: An Overview and Analysis
Bitpim -
BitPim is a free, open source, cross-platform program for viewing and editing data on a CDMA cell phone. Roger Binns was the founder, project manager, and lead developer of the project, first releasing it on March 1st, 2003. Since then leadership has been handed over to another party and over two million users have downloaded it. The program has been developed in python and originally only supported the LG VX4400 but it now supports a variety of phone manufactures including:
Audiovox
Kyocera
LG
Motorola
Nokia
Palm
Samsung
Sanyo
Toshiba
In order to use the program, a data cable and it's drivers, usually available from the supplier/manufacturer, are required. BitPim will try and automatically detect a phone but its recommended that settings are manually configured.
Features
The program can examine the phonebook, calendar, media (e.g. sounds, ringers, images), memos, todo lists, SMS messages, call history, play lists, and raw filesystem from devices.
Features are dependent on the phone model. For a full list of each phones supported features see BitPim's supported phones list.
The data can be manipulated through the software and changes can be uploaded to the phone. Calendar, Phonebook, Memo, Todo, and Playlist data can all be imported from an external file. For backup purposes all of the data can be exported to external files.
Forensics
If doing a forensic investigation the application should always be in read only mode, which claims to block all write commands to the phone. The program will not recover deleted data nor does it always recover all undeleted data. The file system view is a very important feature forensically as it allows a raw view of data from the phone, possibly uncovering data that BitPim missed or found unimportant. An advanced feature that could also be vital to a forensic investigation is BitFling. This feature allows another computer to remotely access a phones data over the internet. A phone could be confiscated in California, connected to BitPim with BitFling configured, and be forensically analyzed in New York. Lastly exporting the data is very important so that copies of the data can be made, ensuring no data is lost or manipulated.
Compatability
BitPIM runs on Windows, Linux, and MacOS.
External Links
Official website
Isplumia635 -
ISP Lumia 635
The Nokia Lumia 635 is a Windows OS based smartphone. As of the time of this writing (2015AUG12), two methods are known to acquire a physical image of the eMMC on this device. A chip-off procedure can be used (which is a destructive procedure) or the phone can be read using the ISP method documented below. The ISP method provides you with a working device after the extraction is complete.
For the purpose of this document, a Nokia Lumia 635 was disassembled, read via ISP, and then reassembled.
Getting Started
What you need to dump the eMMC:
An ATF Turbo Flasher
Soldering skills and ultra-fine tip soldering iron.
A hot air re-work station. The hot air re-work station used for this was an LF-852D Hot Air Station.
eMMC Dump Procedure
Disassemble the phone down to the PCB.
Solder wires to the eMMC connection points on the PCB.
Connect the ATF box to the PC and start the ATF software.
Configure the ATF software.
Connect the PCB with the ATF 4in1 adapter to the ATF box.
Connect the PCB via USB to the computer.
Read the device via the ATF software.
Detailed Procedure
* Remove the back cover. * Remove the battery. * Remove the 6 x Torx T-5 screws from the back of the phone and the 2 x Torx T-5 screws to the right of the battery on the side of the phone.
* Remove the black sticker located above the USB port to reveal a hidden screw (Sneaky! Sneaky! Nokia).
* Using a pick, or plastic pry tool, separate the display from the back panel. Note that there is a ribbon cable that connects the display to the main board of the phone. Disconnect this cable. * Disconnect the 2 remaining ribbon cables and remove the main board from the body of the phone.
* The ISP taps are located under the shield located adjacent to the volume up and volume down buttons. The shield can either be cut off or removed using a soldering iron or hot air rework station. Hot air was used in this case. Care must be taken to avoid damaging or removing components around the heat shield when removing it.
* The ATF box uses a colour combination in order to connect the ATF to the eMMC. The following table documents the colour mapping to the standard eMMC taps required for the Lumia 635:
Green --> DATAO
Blue --> CMD 
Red --> CLK 
Yellow --> TDO
Brown --> GND 
* Using 0.040 gauge wire, solder the taps. Note: The yellow and red taps connect to the same test point. I recommend soldering a single wire to the tap and breaking it out to separate wires for the red and yellow connections. These wires are then connected to a ATF 4-in-1 adapter.
* For this procedure, the circuit was powered via USB connected to the computer. The following image documents the ATF settings used to read the eMMC:
Afentis forensics -
Scientific support and investigation practice with expert witnesses providing DNA analysis, fingerprint evaluations, firearm and ballistic evidence, mobile telephone examinations and Cell Site Analysis (CSA) - from crime scene to court.
Produce a number of eDiscovery and digital evidence software tools, including:
Facebook Forensic Toolkit
YouTube Forensic Toolkit
Twitter Forensic Toolkit
LinkedIn Forensic Toolkit
Tumblr Forensic Toolkit
External Link
Official Website
Arabic pdfs -
Documents in PDF format that contain Arabic text may present problems for examiners. This page presents the difference between a glyph and a character and how PDF documents can commingle them.
Glyphs vs. Characters
The term chracter describes an abstract concept of a letter. The term glyph describes how a character prints. A single character can have multiple glyphs (for example, glyphs with serifs and those without). A single glyph can have multiple characters. For example, in the font Helvetica the same shape is used to represent a lower case 'l' (ell) and a capital 'I' (eye).
Unicode is set up as a catalog of nominal characters, independent and irrespective of the (computer) typographical consequences. For example, the English/US Unicode page has an entry for the character 'lower case a', but does not define how that letter should be displayed.
PDF documents can contain both glyphs and characters. Modern PDFs emulate the 19th century-style metal-based typesetting process. Ideally PDFs should encode characters, not glyphscitation needed. When typesetting Arabic, Unicode is used as a glyph list, rather than a character list. The glyphs are used as indexes into a huge font book.
By interpreting the Unicode standard as a look-up for glyph indexes, Unicode is abused as if it were a huge font book. This confuses multi-lingual encoding with computer typography.
An underlying cause for this error is the idea that there can be such a thing as a Character-Glyph model. However, in the real world there is no connection between abstract characters and the glyphs used to represent them.
Increasingly font designers are discovering the enormous conceptual freedom one gets without any Character-Glyph constraint. But Adobe still uses the Unicode standard to extract the nominal character values from the font glyph numbers used to represent them. That is why more advanced Arabic fonts that do not use the Unicode Presentation Blocks produce gibberish when text is extracted from the PDF.
Future versions of PDF are planned to embed Unicode as text in addition to the font information, which would resolve this issue.
Part of the problem is that Unicode’s Arabic Presentation Blocks are officially deprecated by the Unicode Consortium. Their inclusion was at the time – late 1980’s - a technical compromise to allow the ISO 10646 to join Unicode. As such the compromise was incomplete, as only 400 out of originally 4000 requested Arabic ligatures we allowed to remain in the Unicode Standard. Ironically, all the printed examples in the Unicode standard were designed by Thomas Milo based on computer-generated synthesis of the underlying letter block fusions of traditional Arabic "Script Grammar". This was done using DecoType’s famous ACE technology, that eventually became the working model for Microsoft’s True Type Open, the precursor of today's OpenType.
Arabic Presentation Forms should never be encoded, such a practice amounts to reverting to Font Pages, whose very proliferation caused the development of a more intelligent alternative: Unicode.
Blackberry os -
BlackBerry OS is the proprietary software platform made by Research In Motion for their BlackBerry line of handhelds. It provides multi-tasking, and makes heavy use of the device's specialized input devices, particularly the thumbwheel. The OS provides support for MIDP 1.0 and WAP 1.2. Previous versions allowed wireless synchronization with Microsoft Exchange Server's e-mail and calendar, as well as with Lotus Domino's e-mail. The current OS 4 provides a subset of MIDP 2.0, and allows complete wireless activation and synchronization with Exchange's e-mail, calendar, tasks, notes and contacts, and adds support for Novell GroupWise and Lotus Notes.
Newest OS Versions
Key: Old Version Current Version Developer Beta 
				
Version
Release date
Features/details
4.2.1.114
	
March 18, 2008
(?)
	
Latest for 8700 series
	
4.2.2.194
	
March 18, 2008
(?)
	
Latest stable release
Ships with new 8300 series and 8800 series phones
	
4.5.0.42 Release 58
	
June 8, 2008
		
4.5.0.37
	
June 12, 2008
	
Released by Vodafone Germany, contains bugs
Major changes: 
Video camera
Youtube support
HTML Emails
Voice recording
Improved UI for media player
	
4.5.0.44
	
June 22, 2008
		
4.5.0.46
	
June 29, 2008
	
slightly faster web browsing
slightly faster boot up time (by a few seconds)
a bit better camera quality
	
4.5.0.72
	
July 22, 2008
	
Released by Orange Romania, posted through www.blackberry.com though its actually beta OS version 4.5.0.52 repackaged.
	
4.5.0.108
	
September 25, 2008<br \> (?)
	
Released by Vodafone Fiji, posted through www.blackberry.com though it is actually just beta OS version 4.5.0.81 repackaged.
	
All OS Versions With Model
9000 - 4.6.0.167
8830 - 4.2.2.196
8820 - 4.5.0.81
8800 - 4.5.0.81
8707 - 4.2.2.205
8703 - 4.2.1.119
8700 - 4.5.0.81
8330 - 4.5.0.77
8320 - 4.5.0.81
8310 - 4.5.0.81
8300 - 4.5.0.81
8220 - 4.6.0.174
8130 - 4.5.0.77
8120 - 4.5.0.81
8110 - 4.5.0.81
8100 - 4.5.0.81
7780 - 4.0.2.56
7750 - 4.0.2.41
7730 - 4.0.2.56
7520 - 4.1.0.380
7510 - 4.0.2.37
7290 - 4.1.0.377
7280 - 4.0.2.56
7250 - 4.1.0.385
7230 - 4.0.2.56
7210 - 4.0.2.56
7130 - 4.2.1.110
7105 - 4.1.0.377
7100 - 4.1.0.382
6750 - 4.0.0.250
6720 - 3.7.1.41
6710 - 4.0.0.185
6510 - 4.0.0.160
6280 - 4.0.2.56
6230 - 4.0.2.51
6210 - 4.0.2.56
5810 - 3.6.0.87
					
External links
Research In Motion, the manufacturer of the BlackBerry OS.
BlackBerry.com, the BlackBerry OS main site.
BlackBerry Frequently Asked Questions, Largest collaboration of Answers to Questions for BlackBerry
Artifacts -
ForensicArtifacts.com Artifact Repository Build Status
A free, community-sourced, machine-readable knowledge base of forensic artifacts that the world can use both as an information source and within other tools.
Terminology
The term artifact (or artefact) is widely used within computer (or digital) forensics, though there is no official definition of this term.
The definition closest to the meaning of the word within computer forensics is that of the word artifact within archaeology. The term should not be confused with the word artifact used within software development.
If archaeology defines an artifact as:
something made or given shape by man, such as a tool or a work of art, esp an object of archaeological interest 
The definition of artifact within computer forensics could be:
An object of digital archaeological interest. Where digital archaeology roughly refers to computer forensics without the forensic (legal) context. 
History
The artifact definitions originate from the GRR project. It was made into a stand-alone project to provide more flexibility and allow other projects to make use of the definitions.
See Also
GRR
External Links
Project site
Knowledge Base site
pypi site
Symbian -
Symbian is an open operating system, designed for mobile devices, with associated libraries, user interface frameworks and reference implementations of common tools, produced by Symbian Ltd. Symbian evolved from Psion's EPOC in 1998.
Symbian OS is currently owned by:
BenQ
Ericsson
Nokia
Panasonic
Siemens AG
Sony Ericsson.
Versions
There are several variations of the Symbian OS that are tailored for different devices. The capabilities of the Symbian OS depend on the device for which it was tailored. Each variation is called a Device Family Reference Design (DFRD).
DFRDs
Device Family Reference Designs (DFRDs) are variations of Symbian OS tailored for different types of mobile information devices including one for smart phones, one for pen-based communicators, and another for keyboard-based communicators. There are three DFRDs: Crystal, Pearl, and Quartz.
Crystal
Crystal is a DFRD tailored for feature-rich, communicator-type devices. Hardware platforms are phones with a full keyboard and a relatively large, landscape-oriented display. Crystal devices are designed for business users who need a lot of information.
Pearl
Pearl is a DFRD for a Symbian smart phone. Hardware platforms typically look like standard cell phones with small displays and limited keyboards.
Quartz
Quartz is a DFRD for a pen-based phone similar to the Palm PDAs. Hardware platforms do not include keyboards, and the relatively large displays are portrait-oriented (vertical). Quartz devices are designed for consumer users and are geared toward information gathering.
History
Symbian is a joint venture between Nokia, Motorola, Ericsson, Matsushita, and Psion that became independent in June 1998. Symbian was established by leaders in the computing and mobile industries to enable the mass market of communicators and smart phones. Here is a brief overview of the milestones in the history of Symbian.
In 1980, Psion Software was founded by David Potter.
1990-1998 Psion releases devices using the EPOC16 OS, also known as SIBO. These devices are catagorized as Series 3.
1997 EPOC OS Releases 1–3. The Series 5 device becomes available, its was the first movement towards 32-bit Symbian.
In 1998, Symbian Ltd. Created.
1999 - EPOC Release 5. Series 5 devices are in production using ER5. Symbian OS v6.0 and v6.1 becomes the first 'open' Symbian OS phone.
2003 Symbian OS v7.0 and v7.0s released.
In 2004, Psion sells Symbian. The first for mobile phones using Symbian OS. Symbian OS v8.0 and v8.1 released. Symbian OS v9.0 fails and is taken out of production before hitting the market.
2005 - Symbian OS v9.1 announced.
Benefits of Symbian OS
Faster time-to-market for platform vendors
Open, standards-based platform for third-party application developers
Excellent connectivity
Advanced design
Extensibility
High-performance, 32-bit OS with pre-emptive multitasking
Long battery life
Wide industry support and commitment
Applications that can be designed once and run on multiple devices
Diversity of devices for consumers
Sim explorer -
SIM Explorer is an advanced SIM card analysis tool designed for reverse engineers, forensic detectives, or those who are learning about SIM cards.
SIM Explorer's primary advantage is that it can work with any type of SIM card and show all the files on that card; this includes new card types that will be released in the future. The software is specifically compatible with SIM, USIM, RUIM and Nextel iDEN cards and it will be able to interpret their standard files and show them in a human-readable form.
Feature highlights
A scan mode that can reveal all the files on the SIM card, including files that are not present on standard cards.
Displays the raw data of each file and record on the SIM, as well as the high-level (i.e. human readable) interpretation of the raw data.
Edit the raw data and upload it to the card.
Provides an offline analysis capability that enables you to save a SIM card to a file and use that file as if it were the card itself. This way SIM card images can be archived or exchanged with colleagues.
Can backup and restore individual files on the SIM as well as the entire SIM card.
Interpret and display a SIM Toolkit Application.
Interpret the ATR of a SIM card.
Side-by-side SIM card comparison.
Generate a printable SIM card report.
Compute the hash of a SIM card (by hashing file contents and file properties).
Supports Unicode SMS
Requirements
Any PC/SC compliant smart card reader.
Screenshots
External Links
SIM Explorer video demo