Post OLAF things to do

Since OLAF spring session finished last week there are some interesting things to do with equipment. Mobile phone forensics training was done with new phones and new phone images created locally. Two training were done "Mobile Phone Forensics basic" and "Mobile Forensics Intermediate"

For this event phone preparation was done in  a hurry, but all went well. It is a brand new phone image done locally by some very helpful students who were fill phones with results of real actions and activities.
What is interesting  is to compare what is on the phones after training are finished and how much and why this phone content diverse since it was all done from same master image (for each model of phone we had master image to clone it).

Plan is to do imaging with two tools UFED and XRAY for each phone and than analyze it.
It will take some time, there is about 30 phones what take few days to acquire data. If we will have enough time EnCase and MPE will be also used.

I'll be updating this post as we are going trough whole process.

As first batch nine Samsung s5280 are processed. Phones are bought in same box, configured together before training and now after training there are some differences, one has not enabled debug mode, batteries are in different levels.

We manage to process 9 Samsungs in two working days, what was interesting is processing time varies a lot, from 30 minutes to few hours

For the rest of phones it takes longer time than expected with some peculiarities, it will be all discussed here
In general there is about 70 dump images from phones, physical, logcal, filesystem dump.

Learning NUIX

Been playing with NUIX in the time slot which opened  since I'm not involved in training on OLAF 2014 spring event. My understanding of NUIX product as my NUIX skills are far from good, but feeling is definitively good.  In nutshell I'm redoing things which were done in EnCase or some other tool.

There is nice article "A broad evidental view" about integration of NUIX and UFED eg, ability of NUIX to process results of UFED phone extractions. It works as it is suggested and quite fast, but my results are a bit unexpected because of lack of skill. Since I have XRY and UFED available I'll try same method for both tools.

For a such powerful tool manuals are bit small, it is easy to do things in a wrong way and terminology is different to EnCase jargon. One need to learn and re-calibrate to new tool

What really makes me happy is easiness to incorporate the ufed results into case with other tools results, it is as simple as adding a directory where UFED report files are stored into NUIX case. Same is for XRY image, looks to me in my lack of experience that NUIX is perfect integration tool ..

Only drawback is documentation, but this is common weakness in today digital forensic tools, can't do much about that but try, test and learn what is correct.

There are plenty of possibilities to try and evaluate, since it can be scripted and used from command line hot to create batching and automated processing also ability to use collaborative web interface.  Actually in current context NUIX as second level, more integration tool, makes much more sense. In that scenario collaborating   web interface is a big advantage.