Android forensics: Interpretation of timestamps

Interpretation of traces found on Android devices is an important aspect of mobile forensics. This is especially true for timestamps encountered on the device under investigation. In the presence of both naive and UTC timestamps, some form of timestamp normalisation is required. In addition, the investigator needs to gain some understanding of potential clock skew that may exist, especially when evidence from the device under investigation has to be correlated to real world events or evidence from other devices. A case study is presented where the time zone on the Android device was set incorrectly, while the clock was set to correspond to the time zone where the device was actually located. Initially, the fact that both time zones enforced daylight saving time (DST) at different periods was expected to complicate the timestamps normalisation. However, it was found that the version of the Time Zone Database on the device was outdated and did not correspond to the actual time zone rules for the given period. After the case study, the results of experiments on a broader range of devices are presented. Among other things, these results demonstrate a method to detect clock skew based on the mmssms.db database. However, it was also found that the applicability of this method is highly dependent on specific implementation choices made by different vendors.     

手机无线增值服务中消费者权益保护问题

手机无线增值服务是移动通信运营商与服务提供商(SP)联合向手机用户提供的增值服务,属于电子商务的范畴。在这种商务活动中,移动通信企业和服务提供商赚取了巨额利润,却忽视甚至严重侵害了消费者的合法权益,引发了不少矛盾与纠纷。集中分析了有关消费者权益保护六大问题,试图引起人们对这一领域的关注。     

Private Land Mobile Radio Services--Federal Communications Commission. Final rule

The Commission adopts a Second Report and Order releasing reserved radio spectrum in the 806-821/851-866 MHz bands for Private Land Mobile Radio Service use. The rules adopted provide enhanced flexibility in radio system design and user options. The action is necessary to satisfy land mobile spectrum needs across the country.     

Sketching and validating the location-based services (LBS) regulatory framework in Australia

Location-based services (LBS) are defined as those applications that combine the location of a mobile device associated with a given entity (individual or object) together with contextual information to offer a value-added service. LBS solutions are being deployed globally, and in some markets like Australia, without appropriate regulatory provisions in place. Recent debates in Australia have addressed the need to bridge the gap between technological developments and legal/regulatory provisions. This requires an assessment of the regulatory environment within a given social context such as Australia. The core components of such an investigation include: (a) composing a conceptual framework for analysing regulation of technologies such as LBS, one that is sensitive to public policy themes and challenges, and (b) applying this conceptual framework to the Australian setting in order to sketch and define the components of the present framework, and identify areas for improvement through a process of validation. This paper addresses these aims, demonstrating how the current regulatory framework in Australia is bound by legislation with respect to privacy, telecommunications, surveillance, and national security (that is, anti-terrorism), in addition to a set of industry guidelines for location-service providers (LSPs). The existing Australian framework, however, is lacking in its coverage and treatment of LBS and location data, and does not adequately address the themes and challenges in the defined conceptual framework.     

Private Land Mobile Radio Services; amendment of the commission's rules concerning mobile station, control point and control system authorization procedures for common user systems for a certain MHz frequency--Federal Communications Commission. Final rule

The Commission is amending its rules and regulations in Part 90--Private Land Mobile Radio Service, by adopting a new temporary licensing procedure for special mobile radio systems (SMRS's) and multiple licensed mobile relay stations operating in the 806-821 and the 851-866 megahertz (MHz) bands. This new system of licensing will benefit radio users by enabling them to begin operations more quickly than in the past, and will not in any way lessen the ability of the Commission to determine whether an applicant is eligible and otherwise possesses the necessary qualifications to be permanently licensed to operate in these bands. This new system is a part of the Commission's on-going program for reviewing its rules and regulations and eliminating unnecessary burdens on licensees to facilitate the administration of the Private Land Mobile Radio Service.     

Loose‐Lipped Mobile Device Intelligent Personal Assistants: A Discussion of Information Gleaned from Siri on Locked iOS Devices

The forensic analysis of mobile handsets is becoming a more prominent factor in many criminal investigations. Despite such devices frequently storing relevant evidential content to support an investigation, accessing this information is becoming an increasingly difficult task due to enhanced effective security features. Where access to a device's resident data is not possible via traditional mobile forensic methods, in some cases it may still be possible to extract user information via queries made to an installed intelligent personal assistant. This article presents an evaluation of the information which is retrievable from Apple's Siri when interacted with on a locked iOS device running iOS 11.2.5 (the latest at the time of testing). The testing of verbal commands designed to elicit a response from Siri demonstrate the ability to recover call log, SMS, Contacts, Apple Maps, Calendar, and device information which may support any further investigation.     

How does initial public financing influence private incentives for follow-on investment in early-stage technologies?

One common rationale supporting public financing programs for small firms is that initial public investment creates incentives for follow-on private investment. However, there does not appear to be a unified statement in the literature describing how initial public investment creates incentives for follow-on private investment. Focusing on external private investors, we use a two-stage net present value model to identify four effects from initial public investment on the private decision for follow-on investment. Our empirical analysis uses a sample of non-venture backed firms entering the SBIR program to examine how reduced risk, the number of SBIR awards, and size of initial public investment influence the likelihood of follow-on venture capital investment. We find the probability of follow-on venture capital investment is more likely when firms reach Phase II of the program, is less likely as firms win multiple Phase I and Phase II awards, and is more likely as the size of initial public investment in Phase I increases.

Forensic Inspection of Sensitive User Data and Artifacts from Smartwatch Wearable Devices

Wearable devices allow users the ability to leave mobile phones behind while remaining connected to the digital world; however, this creates challenges in the examination, acquisition, identification, and analysis of probative data. This preliminary research aims to provide an enhanced understanding of where sensitive user data and forensic artifacts are stored on smartwatch wearable devices, both through utilization as a connected and standalone device. It also provides a methodology for the forensically sound acquisition of data from a standalone smartwatch wearable device. The results identify significant amounts of data on the Samsung^? Gear S3 Frontier, greater than that stored on the companion mobile phone. An Apple Watch^® Series 3 manual examination method which produces native screenshots was identified; however, the companion mobile phone was found to store the greatest amount of data. As a result of this research, a data extraction tool for the Samsung^? Gear S3 Frontier was created.     

TRICARE program; TRICARE Prime Remote for active duty family members and TRICARE Prime enrollment period. Final rule

This final rule implements 10 U.S.C. 1079(p), as added by section 722(b) of the Floyd D. Spence National Defense Authorization Act for Fiscal Year 2001. The rule provides coverage for medical care for active duty family members who reside with an active duty member of the Uniformed Services assigned to remote areas and eligible for the program known as TRICARE Prime Remote. Active duty family members who enroll in TRICARE Prime Remote for Active Duty Family Members (TPRADFM) will enjoy benefits generally comparable to TRICARE Prime enrollees including access standards, benefit coverage, and cost-shares. This final rule also implements Section 702 of the NDAA for FY 2003, which establishes circumstances under which dependents of Reserve Components and National Guard members called to active duty in support of contingency operations may enroll in TRICARE Prime Remote for Active Duty Family Members, and dependents of TRICARE Prime Remote service members may remain enrolled when the service member receives orders for an unaccompanied follow-on assignment. Finally, this final rule establishes circumstances under which eligible beneficiaries may enroll in TRICARE Prime for a period of less than 1 year.     

TREND AND DEVIATION IN CRIME RATES: A COMPARISON OF UCR AND NCS DATA FOR BURGLARY AND ROBBERY*

Trends and year-to-year deviations in UCR and NCS data on burglary and robbery are examined for the period 1973 to 1985. We find strong correspondence between year-to-year deviations in UCR crime rates and NCS victimization rates for both crime types. The difference between the two data series lies primarily in their contrasting trends, although there is some evidence that trends in UCR and NCS crime rates have been converging in recent years. Ex post forecasts reveal that the UCR/NCS relationships estimated from the 1973–1985 data continued through 1986 and 1987. Although the UCR rates in 1986 were somewhat influenced by unusual increases in the proportion of crimes reported to the police that year, changes in crime reporting for the period as a whole have had little effect on UCR burglary and robbery rates. We conclude that, within the two serious crime types examined in this study, there is strong consistency between the alternative data sources on variations in crime rates over time.     

Remote Wiping and Secure Deletion on Mobile Devices: A Review

Mobile devices have become ubiquitous in almost every sector of both private and commercial endeavors. As a result of such widespread use in everyday life, many users knowingly and unknowingly save significant amounts of personal and/or commercial data on these mobile devices. Thus, loss of mobile devices through accident or theft can expose users—and their businesses—to significant personal and corporate cost. To mitigate this data leakage issue, remote wiping features have been introduced to modern mobile devices. Given the destructive nature of such a feature, however, it may be subject to criminal exploitation (e.g., a criminal exploiting one or more vulnerabilities to issue a remote wiping command to the victim's device). To obtain a better understanding of remote wiping, we survey the literature, focusing on existing approaches to secure flash storage deletion and provide a critical analysis and comparison of a variety of published research in this area. In support of our analysis, we further provide prototype experimental results for three Android devices, thus providing both a theoretical and applied focus to this article as well as providing directions for further research.     

Digital forensic text string searching: Improving information retrieval effectiveness by thematically clustering search results

Current digital forensic text string search tools use match and/or indexing algorithms to search digital evidence at the physical level to locate specific text strings. They are designed to achieve 100% query recall (i.e. find all instances of the text strings). Given the nature of the data set, this leads to an extremely high incidence of hits that are not relevant to investigative objectives. Although Internet search engines suffer similarly, they employ ranking algorithms to present the search results in a more effective and efficient manner from the user's perspective. Current digital forensic text string search tools fail to group and/or order search hits in a manner that appreciably improves the investigator's ability to get to the relevant hits first (or at least more quickly). This research proposes and empirically tests the feasibility and utility of post-retrieval clustering of digital forensic text string search results – specifically by using Kohonen Self-Organizing Maps, a self-organizing neural network approach.This paper is presented as a work-in-progress. A working tool has been developed and experimentation has begun. Findings regarding the feasibility and utility of the proposed approach will be presented at DFRWS 2007, as well as suggestions for follow-on research.     

Mobile payments: Current and emerging regulatory and contracting issues

Sitting at the heart of m-commerce and at the intersection of the value chains of the payments, mobile, retail and technology industries, mobile payments are set to grow rapidly in the short and medium terms. M-payments are giving rise to the development of a new ecosystem of market participants including card schemes, MNOs, retailers, device suppliers, service providers and trusted service managers. Key regulatory considerations arising include e- money and payment services, mobile services regulation, consumer protection, data privacy and standards. The contractual landscape linking the various parties inhabiting the ecosystem is also rapidly developing, with key issues around revenue models, customer ownership, technology development, and risk and liability. Parties involved in mobile payments will need to carefully assess their and others' roles and regulatory aspects in determining their strategy and how to approach contractual discussions.     

Rethinking the medical causes of infant death in early modern Europe: a closer look at church registers and medical terminology

The historical roots of the prevailing hypothesis about the main causes of high infant mortality in Europe in the last four centuries are presented in detail focusing on German sources and publications. Assumptions about infections being the main cause of deaths during infancy clearly need to be reevaluated. The terminology of early sources has passed many steps of translation and interpretation. In the old church registers, wording in the local vernacular merely described the most visible symptoms before the final stages of diseases. Scientific medicine and its terminology repeatedly went astray before real pediatric competence was acquired in the nutritional physiology of infants. The combination of different kinds of evidence points to serious flaws in the prevailing hypothesis, while source data and publications confirm a different conclusion: inadequate nutrition due to early weaning and unsuitable substitute food caused the specific set of symptoms described in the historical sources. Medical evidence about infant malnutrition in developing countries supports this new interpretation.     

Medical devices; immunology and microbiology devices; classification of the immunomagnetic circulating cancer cell selection and enumeration system. Final rule

The Food and Drug Administration (FDA) is classifying the Immunomagnetic Circulating Cancer Cell Selection and Enumeration System device into class II (special controls). The special control that will apply to the device is the guidance document entitled "Class II Special Controls Guidance Document: Immunomagnetic Circulating Cancer Cell Selection and Enumeration System." The agency is taking this action in response to a petition submitted under the Federal Food, Drug, and Cosmetic Act (the act) as amended by the Medical Device Amendments of 1976 (the amendments), the Safe Medical Devices Act of 1990 (the SMDA), the Food and Drug Administration Modernization Act of 1997 (FDAMA), and the Medical Device User Fee and Modernization Act of 2002 (MDUFMA). The agency is classifying the device into class II (special controls) in order to provide a reasonable assurance of safety and effectiveness of the device. Elsewhere in this issue of the Federal Register, FDA is publishing a notice of availability of a guidance document that is the special control for this device.     

A comparison of forensic evidence recovery techniques for a windows mobile smart phone

Acquisition, decoding and presentation of information from mobile devices is complex and challenging. Device memory is usually integrated into the device, making isolation prior to recovery difficult. In addition, manufacturers have adopted a variety of file systems and formats complicating decoding and presentation.A variety of tools and methods have been developed (both commercially and in the open source community) to assist mobile forensics investigators. However, it is unclear to what extent these tools can present a complete view of the information held on a mobile device, or the extent the results produced by different tools are consistent.This paper investigates what information held on a Windows Mobile smart phone can be recovered using several different approaches to acquisition and decoding. The paper demonstrates that no one technique recovers all information of potential forensic interest from a Windows Mobile device; and that in some cases the information recovered is conflicting.     

Beyond Cynicism: A Review of the FCC's Reasoning for Modifying the Newspaper/Broadcast Cross-Ownership Rule

In 1975, the FCC established the newspaper/broadcast cross-ownership rule prohibiting common ownership of a daily newspaper and a full-power broadcast station that serve the same city. Unpopular among owners of media conglomerates since its inception, the rule has remained at the heart of the contentious debate over media ownership consolidation. More than three years after its failed attempt to justify modification in Prometheus Radio v. FCC, the FCC has again voted to change the rule. This article reviews the Report & Order, assessing the Commission's central arguments used to justify its position and posits that these arguments are largely unsubstantiated. The Commission clings to contestable assertions and stakeholder comments, while ignoring extensive empirical data that refute each claim. The lack of empirical evidence presented to justify such a major (and unpopular) decision suggests that the FCC might have been motivated by a neo-liberal agenda and/or influenced by the corporate media lobby.     

We are meeting on Microsoft Teams: Forensic analysis in Windows,Android, and iOS operating systems

Microsoft released a new communication platform, Microsoft Teams, in 2017. Due in part to COVID-19, the popularity of communication platforms, like Microsoft Teams, increased exponentially. Given its user base and increased popularity, it seems likely that digital forensic investigators will encounter cases where Microsoft Teams is a relevant component. However, because Microsoft Teams is a relatively new application, there is limited forensic research on the application particularly focusing on mobile operating systems. To address this gap, an analysis of data stored at rest by Microsoft Teams was conducted on the Windows 10 operating system as well as on Android and Apple iOS mobile operating systems. Basic functionalities, such as messaging, sharing files, participating in video conferences, and other functionalities that Teams provides, were performed in an isolated testing environment. Cellebrite UFED Physical Analyzer and Magnet AXIOM Examine tools were used to analyze the mobile devices and the Windows device, respectively. Manual or non-automated investigation recovered, at least partially, the majority of artifacts across all three operating systems. In this study, a total of 77.6% of the populated artifacts were partially or fully recovered in the manual investigation. On the other hand, forensic tools used did not automatically recover many of the artifacts found with the manual investigation. Only 13.8% of artifacts were partially or fully recovered by the forensic tools across all three devices. These discovered artifacts and the results of the investigations are presented in order to aid digital forensic investigations.     

人脾细胞核几何参数变化与早期死亡时间的相关性研究

目的运用图像分析技术探讨人脾脏细胞核几何参数变化与死亡时间的关系。方法选31例已知死亡时间的人离体脾组织,在死后36h内每h细胞学涂片、Feulgen-Vans染色,对人脾细胞核的异形指数等5个几何参数进行图像分析。结果脾脏细胞核异形指数在死后5～36h呈上升趋势,r=0.983,线性回归方程y=11.334x-33.339,面积、等效直径、平均直径、周长均与死亡时间无明显的相关性。结论异形指数能较客观地反映人脾细胞核DNA降解后的离散分布状况,与死亡时间有明显相关性,可能是推断早期准确死亡时间的较好形态学指标。