Digital Forensics report

Report of Examination

Silvius Laboratory

North Bend, Oregon

Case # SEC355_Week4

September 24, 2021

Examiner – Jennifer Silvius

Physical Evidence for Case SEC355_WEEK4

CP1: One (1) Apple iPad mini 2 (Serial number – F4KLX4RJFCM5)

The listed item under “physical evidence” of the report followed the proper chain of custody during the

analysis process and has been turned over to law enforcement (Brunty, 2021).

Objectives:

I have been asked to identify whether this device has been jailbroken. If the device has been

jailbroken, I have been asked to identify with what application was used. Additionally, I have

been to identify any social media applications downloaded and searches that were completed

using a search engine. Finally, I have been asked to identify the model of the device, unique

identification number, model, and version of the OS in use.

Mobile Device Forensic Examination:

On September 24, 2021, I completed an acquisition on an iPad2, using Magnet Axiom

(v.2.10.1). I was instructed to pull a file off of a windows 7 virtual machine and analyze this

device and look for several different artifacts such as device information, application

information, and search information.

• Analysis #1 – File f68CA861554485DA92BEDB927C5A0FE5F79D7274 was

downloaded onto Magnet Axiom on September 24, 2021. Steps were taken to ensure that

no evidence would be altered or lost during the downloading process. After thoroughly

checking the web-related artifacts, I discovered three recent search terms listed under iOS

safari, which were as follows "Meth bust," "list of motivational words," and "Donald

Trump."

• Analysis #2 – I was asked to identify the device along with the personal identification

number and operating system version. The product under analysis is an Apple iPad Mini

2. However, the model identification shows as an Apple iPad4. This is an indication that

the iPad has been jailbroken at some point. The system is running off of iOS 9.3.3, which

makes me wonder if the individual jailbroke the iPad to get the more up-to-date operating

system of iOS. As noted, before, the serial number is F4KLX4RJFCM5. The UIN

(Unique Identification Number) is

f68CA861554485DA92BEDB927C5A0FE5F79D7274.

• Analysis #3 – I have identified that there are 71 downloaded applications on this device.

Of the 71 applications that have been downloaded on this device, several fall into the

social media communication type of applications. The following applications have been

identified Facebook, Text Free with Voice, Twitter, mobile me, and media Social Share.

All these applications are third-party applications that promote either social media or

communications.

• Analysis #4 – Additionally, there has been a jailbreaking tool installed on this device

called StorekitUI service. After searching the browser history, I was able to locate the

website Jailbreakme9.com.

Findings

As Suspected, the mobile device was indeed Jailbroken; the device user may be involved

in drugs and maybe a fan of Donald Trump. However, there is not enough evidence, and

at best, the evidence is circumstantial. In addition, the device has multiple social media

applications on device which involve alternative ways of communicating. Overall, other

than jailbreaking the device, nothing indicates any crime related to the device at hand.

Reference

Brunty, J. (2021, February 4). Writing dfir reports: A primer. Forensic Focus. Retrieved

September 25, 2021, from https://www.forensicfocus.com/articles/writing-dfir-reports-aprimer

Comments

Popular posts from this blog

Gangs and Differential Association Theory

Using Technology to Combat Human Trafficking

Behavior Influenced by Environmental and Social Factors