Comparing and Contrasting Android and iOS Forensics - Report Example

Comparing and Contrasting Android and iOS Forensics Comparing andContrasting Android and iOS forensics Introduction Physical forensic examination is different from logical one, as applicable to mobile devices like iOS and Android. While forensic evaluation should stand the court of law proceedings, the procedure to extract data from mobile phones and other devices does not confirm the authentication of such evaluation. In addition, the security concerns and risks applicable to these mobile devices pose a tough challenge for the forensic investigators. While Apple mobile devices use proprietary operating system, Android is more vulnerable to malicious attacks, which may result in deletion of even the encrypted data. However, Android has employed rooting principles procedure, meant for restricting the access to various data folders and files. In contrast, jail breaking in iOS devices, particularly the Apple iPhones can provide access to malicious attackers for extracting the sensitive data from these devices. The following paragraphs discuss the forensic and security challenges that these phones pose for the expert investigators. Defining mobile forensics While engineering science is applicable to digital forensics, such investigation also deals with mobile device forensics. However, the digital forensic science, as applicable to mobile devices requires exhaustive education, training and practice. This is a part of computer science. Computer forensics is practiced more than mobile forensics in countries like USA, by the law enforcement agencies. The lack of investigative forensics in mobile devices is due to non-availability of relevant seizure procedures for such devices. The transportation procedure required should also be properly detailed, along with the sufficient guidance towards conducting of proper forensic test and its analysis in a proper manner. As forensic science is a technological tool to produce the evidence before a court of law, mobile forensics may not be able to provide such evidence that can stand the requirement of the court. This is mainly due to the rapid changes taking place in the mobile technology of both Android and IOS. In addition, the physical forensic science has one constant factor, DNA of the specific blood sample. However, the computer technology, including mobile device architecture, has changed drastically over the years. Physical forensic science relies on the comparison of DNA or tire/shoe prints, while digital forensics does not involve any comparison.(Kessler, 2014) However, logical forensic investigation will require the examination of different operating systems used by Apple and Google for their iOS and Android mobile devices. While Apple works on propriety operational system, Android does not work in such environment, as their operating system can be used by various manufacturers like Samsung, LG and many others. This creates difficulty in forensic investigation as the choice of software used for extraction of data from mobile devices becomes difficult and examiners may not be able to know the amount of data that the particular software can extract from designated device. Tests conducted by NIST and other technical experts reveal that data extraction is easy on the apple mobile platform. This is not the case when data extraction is required from the mobile devices, based on Android OS, made by different makers. Each manufacturer has its own prescription for such extraction procedure, although no maker provides any clear instructions for this purpose. While physical and logical methods are applicable for extraction of data for forensic purposes, logical methods are better as they use communication protocol provided by the mobile device. Physical extraction performs data extraction at lower levels and is time consuming as well.(Oxygen Software, 2012) Mobile security concerns Security concerns remain with the both mobile device manufactures of iOS and Android, as they design new mobile platforms. Although both makers may address the security issues faced by their mobile devices, they find themselves helpless in solving the security problems, which result from interaction of their devices with any outside cloud services and computers. The security features of such out-of-box synchronized devices remain unknown to these manufacturers. The security features applicable to both the devices include access based on permission provided, encryption, application isolation and provenance. The makers constantly work towards updating these features in order to make their mobile devices more secure. However, the consumer and user-friendly aspects of these devices limit the application of such security features. Hence, both the manufacturers may gain popularity by compromising the security features; while they certainly are enhancing the security risks. For example, employees of theses companies can use their mobile devices for downloading data from their official files and saving the same in any cloud service, outside their enterprise. This increases the chances of sensitive data loss and tempering through third party systems, which are not within the control of these enterprises. However, both the manufacturers have provided isolation application for each of their devices, while maintaining the data back up on their own cloud services. The problem rises when the user shares the same data with outside cloud systems and computers.(Nachenberg, nd) Android rooting principles Android smart phones have a rigid file protection system, as they follow the UNIX operating system. The system does not provide access to the root folder or subfolder, as process of rooting is required to unlock the file system. While rooting can be classified into two categories as temporary and permanent, Apple mobile devices have the same system under the name of jail breaking. Tethered jail breaking is like temporary rooting of Android system and untethered is like the permanent rooting. Permanent rooting would involve changes in many file systems and subsequent changes in the phones firmware. Jail-breaking software available for Apple phones does the required changes in various data systems. Software called “Oxygen Android Exploit” is applicable to Android devices for performing rooting procedure. However, it allows access to the required files only. This helps in the forensic investigations and avoids application of permanent rooting for this purpose. Apple mobile devices do not have such application classification.(Android Rooting Principles) In contrast, Apple computers provide more security against malware, as it uses methods like sandboxing of web services, for its mobile devices. In addition, iOS has tough developer certification procedure along with tight vendor-oriented vigilance. The software application author requires going through tough identification process. The identity of each application author is authenticated though such procedure to leave out the malicious applications. Google has adopted less stringent procedures for such authentication, as it allows unanimous applications to be uploaded on its mobile devices. This can result in harmful malware creeping in along with such applications. However, the jail-breaking software has also increased the security risks within the iOS mobile environment, as attackers and harmful malware carriers can get root access on the jail broken devices, resulting in plantation of files and data folders, which may pose security risks. The risk is compounded when such devices are synchronized with the ecosystem comprising of third party services that include desk top and cloud services. One of the examples of such misuse is enabling of spam receipts in the emails. Most of the internet users become victim of phishing, as these phones are used for surfing the web. They can easily fall into the trap of malicious hackers and attackers to release their individual log-in details. In this direction, many commercial banking institutions are issuing continuous warning against phishing on their websites.(Musthaler) Conclusion While both systems may not be able to provide evidence before the court of law, Apple iPhones and devices are less vulnerable to malware. This is due to the single proprietary OS system used by all Apple devices. However, jail broken Apple phones do not qualify for this statement. In contrast, Google follows a loose authentication procedure for various app developers, as they can upload the application anonymously on any Android based device. In addition, the procedure for extraction of data depends on the phone manufacturers instructions, which are not clear. While iPhones are made by Apple only, Android based mobile device makers include LG, Samsung, and others Works-Cited “Andriod Rooting pinciples.” (nd) Retrieved on Dec. 08, 2014, from: http://writer.academia-research.com/file/get/instr/1179838/file/oxygen_forensic_android_rooting_addon_principles.pdf Kessler. G, (2014) “Is Mobile Device Forensics Really Forensics?.” Retrieved on Dec. 08, 2014, from: http://writer.academia-research.com/file/get/instr/1179838/file/4-kessler-201406_nist_kessler_v2.pdf Musthaler. B, (2011) “Mobile Security Risks” Retrieved on Dec. 08, 2014, from: http://www.networkworld.com/article/2179230/infrastructure-management/mobile-security-risks--comparing-ios-to-android.html Nachenberg. C, (nd) “A Window into Mobile Device Security” Retrieved on Dec. 08, 2014, from: http://writer.academia-research.com/file/get/instr/1179838/file/symc_mobile_device_security_june2011.pdf Oxygen Software, (2012) “Mobile Phone Forensic Challenges” Retrieved on Dec. 08, 2014, from: http://articles.forensicfocus.com/2012/05/17/mobile-phone-forensic-challenges/ Read More