hemu1438/forensicsgpt-training-data huggingface dataset:
Jtag samsung galaxy s3 (sgh i747m) -
JTAG Samsung Galaxy S3 (SGH-I747M)
The Samsung Galaxy S3 is an Android based smartphone. At the time of this writing (2014JAN22), I am unaware of any method other than JTAG to acquire a physical image of the NAND on this device.
For the purpose of this document, a Samsung Galaxy S3 was disassembled, read via JTAG, and reassembled.
Getting Started
What you need to dump the NAND:
A RIFF Box
Soldering skills and small tip soldering iron (a JTAG jig may be available).
A DC Power supply capable of supplying 3.8V/2.1A output. The power supply used for this was an U8002A DC Power Supply.
NAND Dump Procedure
Disassemble the phone down to the PCB.
Connect the RIFF Box to the PC via USB.
Connect the RIFF Box to the PCB via the JTAG pins.
Connect the PCB to the DC power supply.
Start the "RIFF Box JTAG Manager" software.
Enable the power on the DC power supply.
Power the phone via the power button.
Dump the NAND via the RIFF Box software.
Instructions for disassembly can be found on Internet but it can be summarized as follows:
Remove the rear cover and battery.
Remove the 10 x Phillips screws.
Remove the rear plate using a case opening tool (guitar pick).
Once the phone has been disassembled, you can see the JTAG connection port located closed to the edge of the PCB near the ribbon cable.
The JTAG pinouts are as follows.
Solder the JTAG connector to the JTAG port as follows. I used 0.040 gauge magnet wire, connected to breadboard pins, which were inserted into the 20 pin ribbon cable supplied with the RIFF box.
Connect the PCB battery terminal connections to the DC power supply. The positive (+) connection is the outermost pin (1) and the negative (-) pin is pin (3). You can configure your power supply to match the battery specifications which in this case is 3.8V and 2.1A but do not apply power at this time.
Now we can start the RIFF JTAG software, configure it, and connect the phone to the RIFF box. See the picture below for more detail.
NOTE: In the picture, the "JTAG TCK Speed" has been changed from "Sample at MAX" to "Sample at 9MHz". This was done in attempt to eliminate disconnects between the RIFF Box and the phone mid-read. Leave this setting at "Sample at MAX" unless you experience this problem.
Apply power to the DC power supply and turn the phone on using the button on the side of the PCB. After powering the phone on, select "READ" under the "DCC Read/Write" tab. If all goes well the "READ" button will become the "STOP" button and the phone will begin reading...if not the RIFF software provides troubleshooting steps that should be taken to assist in diagnosing some of the issues you may experience.
NOTE: In the event of read errors the RIFF software keeps track of where the failure occurred and gives you option to restart the read where it left off. If this occurs, you can adjust the "JTAG TCK Speed" and lower it to 9MHz (or lower) which can stabilize the read.
Once the acquisition is complete the resulting image can be saved and forensic analysis can take place using the tool of your choosing.
References
https://forensics.spreitzenbarth.de/2012/02/
Chip off blackberry curve 9315 -
The hardware used in the BlackBerry 9315's and 9320's are almost identical. The following link describes the differences between the models.
Tear Down
Remove the back panel.
Remove the SIM and SD Memory Card.
Using a torx-6 screw driver remove the 2 visible screws on the back of the phone.
Remove the screen protector using a shim, guitar pick, or prying tool.
Remove 2 torx-5 screws.
Use the shim to detach the outer bezel/keyboard from the device.
Remove 4 additional torx-6 screws. The main board will now easily be separated from the back plate
Peel off the vendor sticker.
Remove the plastic cover protecting the track pad ribbon cable, and disconnect the track pad.
Remove the final torx-4 screw located beneath the plastic protector, to remove the plastic keyboard overlay.
Disconnect the ribbon cable connected to the LCD. Then using a pick separate the display from the main board.
The tear down is now complete
eMMC Removal
The eMMC is located beneath the heat shield directly above the Micro SD card slot.
Place the main board in a stand or holder and position it approximately 2 1/2" - 3" inches away from a heat gun or device the blows super hot air.
Monitoring the temperature the heat shield will come off easily between 190-200 Centigrade.
Continue working under the high heat. With the 9315/9320's I've worked on the eMMC has been ready to lift off of the main board using tweezers immediately after removing the heat shield.
Using liquid flux, or flux paste and a soldering iron clean the pads on the eMMC in preparation for a read
The eMMC is now ready to read using the appropriate adapter/programmer and software.
At the time of this writing (2013OCT29) the eMMC that was removed in this example was read using an UP828 programmer via the "VBGA169E" adapter and using the "eNAND_H9DP4GG4JJACGR-4EM/459MB" device settings. The resulting image was then parsed via the CelleBrite Physical Analyzer (V. 3.8.5.108).
Jtag nokia lumia 620 -
JTAG Nokia Lumia 620
The Nokia Lumia 620 is a Windows based smartphone. As of this writing (2014AUG28), I am unaware of any method other than JTAG to acquire a physical image of the NAND on a Nokia Lumia 620.
For the purpose of this document, a Lumia 620 was disassembled, read via JTAG, and reassembled.
Getting Started
What you need to dump the NAND:
A RIFF Box
Soldering skills and ultra-fine tip soldering iron (a JTAG jig may be available).
A DC Power supply capable of supplying 3.7V/1.30A output. The power supply used for this was an U8002A DC Power Supply.
A hot air re-work station. The hot air re-work station used for this was an LF-852D Hot Air Station.
NAND Dump Procedure
Disassemble the phone down to the PCB.
Connect the RIFF JTAG Box to the PC via USB.
Connect the RIFF JTAG Box to the PCB via the JTAG pins.
Connect the PCB to the DC power supply.
Start the "RIFF JTAG" software.
Enable the power on the DC power supply.
Power the phone via the power button.
Dump the NAND via the RIFF software.
Instructions for dis-assembly can be found on Internet but it can be summarized as follows:
* Remove the rear cover using a case opening tool (guitar pick) * Remove the battery. * Remove the 6 x T-4 Torx screws. * Remove the 2 plastic covers protecting the mainboard. * Disconnect the 2 ribbon cables that are connected to the main-board.
* Separate the main-board from the phone. * The JTAG TAPs on the Lumia 620 are located under an EMI shield above the SD card slot. The shield was removed using a hot air re-work station at a temperature of approximately 350 centigrade.
* Solder connecting wire to the JTAG TAPs as follows. I used 0.040 gauge magnet wire to connect an adapter that was inserted into the 20 pin ribbon cable supplied with the RIFF box.
* Re-connect the LCD display connector to the mainboard. * Connect the PCB battery terminal connections to the DC power supply. The positive (+) connection is the outermost pin (1) and the negative (-) pin is the outermost pin (3). You can configure your power supply to match the battery specifications which in this case is 3.7V and 1.30A but do not apply power at this time. * Now we can start the RIFF JTAG software, configure it for the LG E960, and connect the phone to the RIFF box. See the picture for more detail.
* Apply power from the DC power supply to the phone and turn the phone on using the button on the side of the PCB. After powering the phone on, select "READ" under the "DCC Read/Write" tab. If all goes well the "READ" button will become the "STOP" button and the phone will begin reading. If not, the RIFF software provides troubleshooting steps that should be taken to assist in diagnosing some of the issues you may experience.
Jtag samsung galaxy centura (sch s738c) -
Samsung Galaxy Centura SCH-S738C
This phone is supported by the Tracfone network and uses a Qualcomm MSM7625A 800 MHz Snapdragon (S1) Processor. The phone has 4 GB of internal storage with a Samsung KMSJS000KM B308 MoviNAND flash memory chip. This phone is unsupported by RIFF Box for the JTAG process but can be imaged with the direct access plugin.
Getting Started
What you need:
Riff Box
USB to Micro USB cord
NAND Dump Procedure
Remove the rear cover, exposing the 7 phillips head screws.
Remove the screws and the rear plastic casing with a plastic pry tool.
Remove the two molex connectors attached on the right and top of the printed circuit board.
Remove the printed circuit board from the screen casing exposing the nine TAPS on the reverse side. Note the small copper carrot indicating the direction of the TAPS.
Connect the RIFF box to the JTAG pins.
Connect the PCB to a Micro USB cord and power via a power supply.
Start the "RIFF box" software.
Power the PCB.
Dump the NAND.
The TAPS order is as follows:
1=GND
2=NRST
3=TDO
4=TCK
5=TDI
6=TRST
7=RTCK
8=TMS
9=N/A
Test has shown for the best results and fewer read errors, use short wires directly to the RIFF box ribbon interface.***
After the wires are connected to the board, the phone is powered by the USB connection. Plug the Micro USB into the USB connection on the device and then plug the phone into the USB port on the laptop.
Launch the Riff Box JTAG Manager and use the following settings:
Navigate to the Useful Plugins tab
Select the Direct JTAG Access to Flash Memory Plugin. Note the directions displayed in the window along with supported processors.
Activate the plugin
Choose the MSM7627A from the drop down menu on the right side ** Note this is not the processor but it will allow access the the memory.
Select eMMC SDC3 (via chipset) from the Memory Type & Host drop down.
Check Auto FullFlash size
Select Connect & Flash ID. ** This will not flash the memory chip initially, but will only connect**
Choose the read button from the bottom left corner. This will connect to the device and display the partitions and chip ID.
Notes
The phone has a 4GB MoviNAND flash memory chip which should take approximately 24 hours to download. This takes much longer the normal because the direct access plugin functions at a much slower speed then normal JTAG methods. Test have found using shorter large wires and no intermediate PCB board increases performance.
Jtag huawei u8655 -
JTAG Huawei U8655 Fusion II
This phone is supported by the At&t network. This uses a Qualcomm 7225A 800 MHz Processor and comes standard with Android version 2.3. This phone is unsupported by RIFF Box for the JTAG process for resurrector. The phone has 4gb Samsung KMSJS000KM-B308 MoviNAND flash memory.
Getting Started
What you need:
Riff Box
USB to Micro USB cord
NAND Dump Procedure
Remove battery and peel the phone label from the board.
Connect the RIFF box to the PC via USB.
Connect the RIFF box to the PCB via the JTAG pins.
Connect the PCB to a Micro USB cord and power via a power supply.
Start the "RIFF box" software.
Power the PCB.
Dump the NAND.
The TAPS are located under the battery, behind the Huawei phone label. The phone will be powered by a Micro USB cord from an AC battery charger.
The TAPS order is as follows:
1=Not Used
2=TCK
3=GND
4=TMS
5=TDI
6=TDO
7=RTCK
8=TRST
9=NRST
After the wires are connected to the board, the phone is powered by the USB connection. Plug the Micro USB into the USB connection on the device and then plug the phone into a wall outlet. The phone should respond with the vibrator switch activating for less than a second.
Launch the Riff Box JTAG Manager and use the following settings:
JTAG TCK Speed = RTCK
Resurrector Settings= Huawei U8815
Auto FullFlash size
Advanced Settings:
Ignore Target IDCODE during Resurrection and DCC Loader operations
Then connect and get the ID, you should receive the dead body signal. Then read the memory. JTAG complete.
Notes
The phone has a 4Gb Movi flash memory chip which should take approximately 30 minutes to download.
Jtag huawei y301 a1 valiant -
JTAG Huawei Y301-A1 Valiant
This phone is supported by the MetroPCS network. This uses a Qualcomm MSM8225 1GHz Processor and comes standard with Android version 4.1. This phone is unsupported by RIFF Box for the JTAG process for resurrector. The phone has 4GB MoviNAND flash memory.
Getting Started
What you need:
Riff Box
USB to Micro USB cord
NAND Dump Procedure
Remove battery and peel the phone label from the board.
Connect the RIFF box to the PC via USB.
Connect the RIFF box to the PCB via the JTAG pins.
Connect the PCB to a Micro USB cord.
Start the "RIFF box" software.
Power the PCB.
Dump the NAND.
The TAPS are located under the battery, behind the Huawei phone label. The phone will be powered by a Micro USB cord from an AC battery charger.
The TAPS order is as follows:
1=Not Used
2=TCK
3=GND
4=TMS
5=TDI
6=TDO
7=RTCK
8=TRST
9=NRST
After the wires are connected to the board, the phone is powered by the USB connection. Plug the Micro USB into the USB connection on the device and then plug the phone into a wall outlet or USB port on laptop. The phone should respond with the vibrator switch activating for less than a second.
Launch the Riff Box JTAG Manager and use the following settings:
JTAG TCK Speed = RTCK
Resurrector Settings= Huawei U8815
Select the Data Length 4gb or 0x000100000000
Advanced Settings:
Ignore Target IDCODE during Resurrection and DCC Loader operations
Then connect and get the ID, you should receive the dead body signal. Then read the memory. JTAG complete.
Notes
The phone has a 4Gb Movi flash memory chip which should take approximately 2 hours to download.
Ngrep -
Ngrep is a tool that provides GNU grep's features applying them to the network layer.
Overview
Ngrep recognizes IPv4/6, TCP, UDP, ICMPv4/6, IGMP and Raw across Ethernet, PPP, SLIP, FDDI, Token Ring and null interfaces.
Examples
Example 1: dump all common HTTP requests on a live network (eth0):
ngrep -qd eth0 '^(GET|POST|HEAD|CONNECT)' 'tcp'
Example 2: the same, but from a network dump (out.pcap):
ngrep -qI out.pcap '^(GET|POST|HEAD|CONNECT)' 'tcp'
Limitations
Ngrep cannot reconstruct data streams, it has no ability to match a string that is broken across two or more packets.
External Links
Project page
IPv4 and IPv6 fragment reassembly patch
Sim card forensics -
Procedures
Acquire SIM Card and analyze the following:
ICCID - Integrated Circuit Card Identification
MSISDN - Subscriber phone number
IMSI - International Mobile Subscriber Identity
LND - Last Dialed numbers
LOCI - Location Information
LAI - Location Area Identifier
ADN - Abbreviated Dialing Numbers (Contacts)
FDN - Fixed Dialing Numbers (Provider entered Numbers)
SMS - (Short Messages)
SMSP - Text Message parameters
SMSS - Text message status
Phase - Phase ID
SST - SIM Service table
LP - Preferred languages variable
SPN - Service Provider name
EXT1 - Dialing Extension
EXT2 - Dialing Extension
GID1 - Groups
GID2 - Groups
CBMI - Preferred network messages
PUCT - Calls per unit
ACM - Accumulated Call Meter
ACMmax - Call Limit
HPLMNSP - HPLMN search period
PLMNsel - PLMN selector
FPLMN - Forbidden PLMNs
CCP - Capability configuration parameter
ACC - Access control class
BCCH - Broadcast control channels
Kc - Ciphering Key
Hardware
Serial
MicroDrive 120 with SmartCard Adapter
USB
ACR 38T
SCR3311
SCR335
Dekart SIM Card reader
Software
Wiki Links
Paraben SIM Card Seizure
SIM Explorer
SIMcon
SIMIS
External Links
Pro Data Doctor
Forensic Card Reader (FCR) - German
SIMSpy
UnDeleteSMS
Dekart SIM Explorer, video demo of SIM Explorer
Dekart SIM Manager, video tutorial on how to recover a deleted SMS
Cell Phone SIM Card Spy
SIM Card Reader
Sim Card Reader Software
Sim Card Recovery
Recovering SIM Card Data
Damaged SIM Card Data Recovery
Security
SIM cards can have their data protected by a PIN, or Personal Identification Number. If a user has enabled the PIN on their SIM card, the SIM will remain locked until the PIN is properly entered. Some phones provide the option of using a second PIN, or PIN2, to further protect data. If a user incorrectly enters their PIN number multiple times, the phone may request a PUK, or Personal Unblocking Key. The number of times a PIN must be incorrectly entered before the phone requests the PUK will vary from phone to phone. Once a phone requests a PUK, the SIM will remain locked until the PUK is correctly entered. The PUK must be obtained from the SIM's network provider. If a PUK is incorrectly entered 10 times the SIM will become permanently locked and the user must purchase a new SIM card in order to use the phone. In some cases the phone will request a PUK2 before it permanently locks the SIM card.
See also
SIM Cards
Troubleshooting the installation of a PC/SC smart card reader (video tutorial)
Jtag lg l45c tracfone -
LG - L45C -Optimus 2
This phone is supported by the Tracfone. This uses a Qualcomm 7627 Processor and comes standard with Android version 2.3 and has internal storage of 512 MB. This phone is unsupported by RIFF Box for the JTAG process for resurrector. RIFF does support the Qualcomm 7627 processor.
Getting Started
What you need:
Riff Box
USB to Micro USB cord
NAND Dump Procedure
Disassemble the rear housing of the phone and metal plate covering the PCB board.
Connect the RIFF box to the PC via USB.
Connect the RIFF box to the PCB via the JTAG pins.
Connect the PCB to a Micro USB cord and power via a power supply.
Start the "RIFF box" software.
Power the PCB.
Dump the NAND.
The Taps are located under the white LG sticker. The easiest way to access the TAPS is to remove the back cover of the phone. first remove the 7 screws (small Philips) and then the metal cover over the board.
The TAPS order is as follows:
1= TCK
2= RTCK
3= TDO
4= TDI
5= TMS
6= TRST
7= VCC
8= NRST
9= No Used
10=GND
This order applies to the RIFF box. Other boxes refer to the VCC as VREF and NRST as RESET.
After the wires are connected to the board, the phone is powered by the USB connection to a wall charger. May need a DC power supply to supplement the phone power. In that case, connect the DC power supply to the battery connections and set the DC power supply to 4.0. May also need to attach the two negative leads. During testing, one LG phone only responded to an actual battery and not the power supply.
Launch the Riff Box JTAG Manager and use the following settings:
JTAG TCK Speed = RTCK
Resurrector Settings= Qualcomm MSM 7XXX L41 D04 NAND
Auto FullFlash size
Then connect and get the ID, you should receive the dead body signal. Then read the memory.
Notes
The phone has a 512 MB NAND flash memory chip which should take approximately 30 minutes to download.
Ssl forensics -
SSL (TLS) forensics is the process of capturing information exchanged through SSL (TLS) connections and trying to make sense of it in some kind of forensics capacity.
Overview
TLS (Transport Layer Security) provides authentication and encryption for many network protocols, such as: POP, IMAP, SMTP, HTTP. However, it is possible to tunnel almost every TCP-based protocol through TLS using such tools as stunnel.
Generally, many TLS realizations require only server to be authenticated using signed certificate.
Data decryption
Data exchanged through SSL (TLS) connections can be decrypted by performing man-in-the-middle attack. Attacker can modify TLS handshake and provide new certificates (with attacker's encryption keys).
Some commercial network forensics systems can perform such an attack:
Mera Systems Sleek Buster (supports signed by a trusted CA forged certificates)
E-Detective HTTPS/SSL Network Packet Forensics Device
Expert Team 3i Tactical System
As well as some open-source tools:
ettercap (unsupported, last version - 2005/05/29)
dsniff (obsolete, last stable version - 2000/12/17)
Other information
The TLS protocol also leaks some significant information:
Current date and time on a TLS client and server (old versions of Firefox and Thunderbird;
Hostname being accessed ("server_name" extension);
Original data size.
The Onion Router
Tor tunnels application data through TLS connections and it is not possible to decrypt such connections by performing traditional man-in-the-middle attack. Tor also sends application data in chunks to make it harder to guess exactly how many bytes users are communicating.
Links
RFC 2246 (TLS 1.0)
RFC 4346 (TLS 1.1)
Tcpflow -
tcpflow is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis and debugging. Each TCP flow is stored in its own file. Thus, the typical TCP flow will be stored in two files, one for each direction. tcpflow can also process stored ‘tcpdump’ packet flows.
tcpflow is similar to ‘tcpdump’, in that both process packets from the wire or from a stored file. It's also similar to WireShark, in that both allow analysis of network traffic. But unlike either tcpdump or WireShark, tcpflow reconstructs thousands (or millions) of TCP connections at a time and saves the results in ordinary files, making it easy to analyze the data with conventional tools.
tcpflow understands sequence numbers and will correctly reconstruct data streams regardless of retransmissions or out-of-order delivery.
Overview
tcpflow stores all captured data in files that have names of the form
128.129.130.131.02345-010.011.012.013.45103
where the contents of the above file would be data transmitted from host 128.129.131.131 port 2345, to host 10.11.12.13 port 45103.
Specify the -Fk , -Fm'' or-Fg''' options if you are likely to have more than 1000 connections; this will cause tcpflow to create subdirectories automatically. You can also use other options to create directors for each host or port.
Specify the -e netviz option to enable the network visualization layer, and make a pretty picture like this:
Limitations
tcpflow does not understand IP fragments;
tcpflow does not understand 802.11 headers.
History
Jeremy Elson developed the first version of tcpflow in 1999 but stopped maintaining it in 2003. In 2006 Simson Garfinkel took over maintenance of the program and added:
support for VLANs
support for IPv6
DFXML output of the connections in a report.xml file.
Improved performance through the use of the C++ STL classes.
Support for continuous operation (tcpflow now purges out old flows).
Variable Filename specifications.
A plug-in architecture.
tcpflow is based on the LBL Packet Capture Library (available from LBL) and therefore supports the same rich filtering expressions that programs like ‘tcpdump’ support. It should compile under most popular versions of UNIX; see the INSTALL file for details.
External Links
Project page
Distributions
Slackware package by Kanedaaa
Debian package by Robert McQueen
FreeBSD port by Jose M. Alcaide
Solaris 8 SPARC Binary for v0.12 from SunFreeware.com
1 page report -
The idea of a 1-Page Forensics Report is to have a single page that conveys information about a piece of media, a network capture, or a file.
Disk Forensics 1-Page Report
Thoughts about what should go on the report:
OS Release, Version and Patch Level
Kernel Release
Language
Distribution
Last Boot
Installation Date
Per-user information --- how many users? When was each logged on last
IP addresses assigned.
DHCP information
ISPs that were in use
DNS information
Where the connections came from
resolv.conf files on a mac?
structured text files
windows host file
SMART information from the drive - hours the drive was used
dmi decode
hdparam
smart
ishw - apple model #
File systems:
most recently edited docs
most recently run files
HFS superblock?