Guidelines on Pda Forensics

By Jansen, Wayne A.

Description
Technical Reference Publication

Excerpt
Executive Summary: Personal Digital Assistants (PDAs) are a relatively recent phenomenon, not usually covered in classical computer forensics. This guide attempts to bridge that gap by providing an in-depth look into PDAs and explaining the technologies involved and their relationship to forensic procedures. It covers three families of devices ? Pocket PC, Palm OS, and Linux-based PDAs ? and the characteristics of their associated operating system. This guide also discusses procedures for the preservation, acquisition, examination, analysis, and reporting of digital information present on PDAs, as well as available forensic software tools that support those activities. The objective of the guide is twofold: to help organizations evolve appropriate policies and procedures for dealing with PDAs, and to prepare forensic specialists to deal with new situations involving PDAs, when they are encountered. The guide is not all-inclusive nor is it a mandate for the law enforcement and incident response communities.

Table of Contents
Table of Contents TABLE OF CONTENTS.............................................................................................................V LIST OF FIGURES....................................................................................................................VII LIST OF TABLES....................................................................................................................VIII EXECUTIVE SUMMARY...........................................................................................................1 1. INTRODUCTION..................................................................................................................2 1.1 AUTHORITY......................................................................................................................2 1.2 PURPOSE AND SCOPE........................................................................................................2 1.3 AUDIENCE AND ASSUMPTIONS.........................................................................................3 1.4 DOCUMENT STRUCTURE..................................................................................................3 2. BACKGROUND....................................................................................................................4 2.1 DEVICE CHARACTERISTICS..............................................................................................4 2.2 PALM OS...........................................................................................................................6 2.3 POCKET PC.......................................................................................................................9 2.4 LINUX.............................................................................................................................12 2.5 GENERIC STATES............................................................................................................14 3. FORENSIC TOOLS.............................................................................................................16 3.1 PALM DD (PDD)...............................................................................................................17 3.2 PILOT-LINK.....................................................................................................................17 3.3 POSE.............................................................................................................................17 3.4 PDA SEIZURE.................................................................................................................18 3.5 ENCASE.........................................................................................................................18 3.6 DUPLICATE DISK (DD)....................................................................................................19 3.7 MISCELLANEOUS TOOLS................................................................................................19 3.8 CUSTOM TOOLS..............................................................................................................20 4. PROCEDURES AND PRINCIPLES..................................................................................21 4.1 ROLES AND RESPONSIBILITIES.......................................................................................21 4.2 EVIDENTIAL PRINCIPLES................................................................................................22 4.3 PROCEDURAL MODELS...................................................................................................23 5. PRESERVATION................................................................................................................26 5.1 SEARCH..........................................................................................................................28 5.2 RECOGNITION.................................................................................................................28 5.3 DOCUMENTATION...........................................................................................................29 5.4 COLLECTION...................................................................................................................30 v