Skip to content

Paraben forensics

Paraben is a United States based company that sells products for analyzing disk drives and portable devices like cell phones and PDAs.

Products

Cell Seizure

Cell Seizure is a piece of software that serves the main purpose of collection and examining data pulled from various types of cell phones. It is part of Paraben's collection of forensics tools.

The main goal of Cell Seizure is to organize and report various types of files. Following the same guidelines as other Paraben products, Cell Seizure is able to generate comprehensive HTML reports of acquired data. Moreover the software is able to retrieve deleted files and check for file integrity.

Advantages

One important advantage that separates Cell Seizure from other similar products is the fact that it is designed not to change the data stored on the SIM card or cell phone. In other words, all of the data can be examined while keeping the process undetected. Most commercial or free software for cell phones is designed do not only view data but to upload data to cell phones. This is not a safe way to perform a forensic evaluation of cell phone data. In fact, even some forensic software warns of possible data loss. Cell Seizure does not allow data to be changed on the phone.

Disadvantages

A disadvantage of Cell Seizure is that it does not support all makes and models of cell phones. As with most mobile device forensics software, Cell Seizure is frequently updated with support for new devices as they proliferate in the consumer market. However, this application can acquire information from most models made by the following companies:

Also can acquire GSM SIM Cards.

Another disadvantage would be that the format of acquired data can sometimes be confusing. The data is not organized nice and neat and given to the user in a way that they can easily understand what they are seeing. It is not the most user-friendly way of displaying the data that has been acquired.

Features

  • Supports GSM, TDMA, and CDMA cell phones
  • Acquires text messages, address books, call logs, etc.
  • Acquires complete GSM SIM card
  • Recovers deleted data and full flash downloads
  • Supports multiple languages
  • Contains comprehensive HTML reporting and other reporting formats
  • Provides advanced searching including text & hex values
  • Contains viewers for proprietary media file formats;
  • Allows viewing of multiple workspaces at one time

Device Seizure

Device Seizure is a handheld forensics tool that provides deleted data recovery, full data dumps of certain cell phone models, logical and physical acquisitions of PDAs, data cable access, and advanced reporting. The amount and quality of data you can get from a full physical acquisition surpasses the information you can get from a simple logical acquisition. Device Seizure does not change data on the device.

Note: Accessing phones via IrDA and Bluetooth should only be used when other data connections are not available due to the insecure nature of these communication methods.

Supported Cell Phone Manufacturers

  • LG
  • Motorola - Including iDen
  • Nokia
  • Siemens
  • Samsung
  • Sony-Ericsson

Device Seizure supports PDAs with the following Operating Systems:

  • Palm through 5.4
  • Windows CE/Pocket PC/Mobile 5.0 and earlier
  • BlackBerry 4.x and earlier
  • Symbian 6.0, 6.1, 7.X, 8.X, & 9.X
  • EPOC 16/32 (Psion devices)

Device Seizure supports GSM SIM cards with use of a SIM card reader (which can be found in Device Seizure Toolbox).

Device Seizure also supports the following types of GPS Devices with more manufacturers to follow:

  • Garmin

Device Seizure Toolbox

The Device Seizure Toolbox was designed as a collection of the items that would be needed in different scenarios for Device Seizure. The items in this toolbox in combination with the appropriate software allow for acquisitions of hundreds of Cell Phones & PDAs. Please note that the supported model list below is not comprehensive. These cables and charging tips may support many more models.

Email Examiner

Email Examiner is a commercial product for reading email archives from:

  • AOL 6,7,8,9 (PFC)
  • Calypso
  • Eudora
  • Fox Mail
  • Juno
  • MBox
  • Mozilla Mail
  • MSN Mail
  • Outlook Express (DBX)
  • Outlook (PST)
  • USENET newsgroups

SIM Card Seizure

Paraben acquired SIMCon and integrated it into SIM Card Seizure and Device Seizure. Recover deleted sms/text messages and perform comprehensive analysis of SIM card data. SIM Card Seizure takes the SIM Card acquisition and analysis components from Device Seizure and puts it into a specialized SIM Card forensic acquisition and analysis tool. SIM Card Seizure includes the software as well as a Forensic SIM Card Reader. If you already have Device Seizure & the Device Seizure Toolbox, there's no need for you to get SIM Card Seizure as well because they contain the components to perform a forensic SIM Card acquisition and analysis. This tool is for the investigator who only wants to acquire SIM Cards and does not want to perform forensic exams of all cell phone data.

SIM Card Seizure has unicode support to read multiple languages such as Arabic, Chinese, & Russian: Features:

  • Forensic SIM Card Reader Included
  • Calculates MD5 & SHA1 Hash Values
  • Search Function
  • Recovers Deleted SMS Data
  • Bookmarking Options
  • Report Creation Wizard
  • Save Workspaces for Further Review
  • Time Stamps Calculate GMT Offset
  • Access to Paraben's Forum
  • Access to Paraben's 24 Hour Support

Data Acquired from SIM Cards

  • Phase Phase ID
  • SST SIM Service table
  • ICCID Serial Number
  • LP Preferred languages variable
  • SPN Service Provider name
  • MSISDN Subscriber phone number
  • AND Short Dial Number
  • FDN Fixed Numbers
  • LND Last Dialed numbers
  • EXT1 Dialing Extension
  • EXT2 Dialing Extension
  • GID1 Groups
  • GID2 Groups
  • SMS Text Messages
  • SMSP Text Message parameters
  • SMSS Text message status
  • CBMI Preferred network messages
  • PUCT Charges per unit
  • ACM Charge counter
  • ACMmax Charge limit
  • HPLMNSP HPLMN search period
  • PLMNsel PLMN selector
  • FPLMN Forbidden PLMNs
  • CCP Capability configuration parameter
  • ACC Access control class
  • IMSI IMSI
  • LOCI Location information
  • BCCH Broadcast control channels
  • Kc Ciphering key

SIM Card Seizure also acquires the whole catalog system with data in a tree-view presentation. Additionally, it can recover some deleted SMS data by analysis of unallocated space.

Wireless StrongHold Bag

Wireless StrongHold Bag is an "evidence bag" for wireless radio frequency devices, for PDAs, Cell Phones, and SmartPhones.

In order to prevent a wireless device from connecting to the network, the device (e.g. a Cell Phone) can be placed inside of a RF Isolation bag or Faraday bag to blocks radio transmissions.

First responders can help to maintain the integrity of evidence contained in wireless devices through the use of this equipment. It should be noted that power should be supplied to the device if the data is volatile in nature, but the cable may introduce a pathway for electromagnetic signals to penetrate the controlled environment.

One example of such a kit is Wireless StrongHold Bag. This bag is weaved from three layers of nickel, copper, and nylon silver. The company also produces a StrongHold Tent, which allows the investigator to enter the radio signal dampened environment and also to bring in other equipment, such as laptops, in order to facilitate the investigation. As with any type of tool, RF isolation must be thoroughly tested before introduction to actual digital evidence.