Skip to content

Paraben forensics

Paraben is a United States based company that sells products for analyzing disk drives and portable devices like cell phones and PDAs.

Products

Cell Seizure

Cell Seizure is a piece of software that serves the main purpose of collection and examining data pulled from various types of cell phones. It is part of Paraben's collection of forensics tools.

The main goal of Cell Seizure is to organize and report various types of files. Following the same guidelines as other Paraben products, Cell Seizure is able to generate comprehensive HTML reports of acquired data. Moreover the software is able to retrieve deleted files and check for file integrity.

Advantages

One important advantage that separates Cell Seizure from other similar products is the fact that it is designed not to change the data stored on the SIM card or cell phone. In other words, all of the data can be examined while keeping the process undetected. Most commercial or free software for cell phones is designed do not only view data but to upload data to cell phones. This is not a safe way to perform a forensic evaluation of cell phone data. In fact, even some forensic software warns of possible data loss. Cell Seizure does not allow data to be changed on the phone.

Disadvantages

A disadvantage of Cell Seizure is that it does not support all makes and models of cell phones. As with most mobile device forensics software, Cell Seizure is frequently updated with support for new devices as they proliferate in the consumer market. However, this application can acquire information from most models made by the following companies:

Also can acquire GSM SIM Cards.

Another disadvantage would be that the format of acquired data can sometimes be confusing. The data is not organized nice and neat and given to the user in a way that they can easily understand what they are seeing. It is not the most user-friendly way of displaying the data that has been acquired.

Features

  • Supports GSM, TDMA, and CDMA cell phones
  • Acquires text messages, address books, call logs, etc.
  • Acquires complete GSM SIM card
  • Recovers deleted data and full flash downloads
  • Supports multiple languages
  • Contains comprehensive HTML reporting and other reporting formats
  • Provides advanced searching including text & hex values
  • Contains viewers for proprietary media file formats;
  • Allows viewing of multiple workspaces at one time

Device Seizure

Device Seizure is a handheld forensics tool that provides deleted data recovery, full data dumps of certain cell phone models, logical and physical acquisitions of PDAs, data cable access, and advanced reporting. The amount and quality of data you can get from a full physical acquisition surpasses the information you can get from a simple logical acquisition. Device Seizure does not change data on the device.

Note: Accessing phones via IrDA and Bluetooth should only be used when other data connections are not available due to the insecure nature of these communication methods.

Supported Cell Phone Manufacturers

  • LG
  • Motorola - Including iDen
  • Nokia
  • Siemens
  • Samsung
  • Sony-Ericsson

Device Seizure supports PDAs with the following Operating Systems:

  • Palm through 5.4
  • Windows CE/Pocket PC/Mobile 5.0 and earlier
  • BlackBerry 4.x and earlier
  • Symbian 6.0, 6.1, 7.X, 8.X, & 9.X
  • EPOC 16/32 (Psion devices)

Device Seizure supports GSM SIM cards with use of a SIM card reader (which can be found in Device Seizure Toolbox).

Device Seizure also supports the following types of GPS Devices with more manufacturers to follow:

  • Garmin

Device Seizure Toolbox

The Device Seizure Toolbox was designed as a collection of the items that would be needed in different scenarios for Device Seizure. The items in this toolbox in combination with the appropriate software allow for acquisitions of hundreds of Cell Phones & PDAs. Please note that the supported model list below is not comprehensive. These cables and charging tips may support many more models.

Email Examiner

Email Examiner is a commercial product for reading email archives from:

  • AOL 6,7,8,9 (PFC)
  • Calypso
  • Eudora
  • Fox Mail
  • Juno
  • MBox
  • Mozilla Mail
  • MSN Mail
  • Outlook Express (DBX)
  • Outlook (PST)
  • USENET newsgroups

SIMCon

SIMCon is software that securely images all files on a SIM Card with a standard PC-SC smart card reader, either serial or USB. After imaging, the forensic investigator can then analyze the contents of the card. Specific information regarding stored numbers, call history, and text messages are available.

SIMCon is an application developed by Inside Out Forensics in Norway. It is designed for use by the law enforcement community, and it can be obtained free of charge by emailing SIMCon and identifying the officers and unit. However, for anyone outside the law enforcement community, it is not free.

SIMCon is now Paraben's SIM Card Seizure.

Features

  • Acquire all available files on a SIM Card and store in an archive file
  • Analyze and interpret content of files
  • Recover deleted text messages stored on the card
  • Manage PIN and PUK codes
  • Compatible with SIM Cards and USIM Cards
  • Print reports of evidence
  • Secure file archive using hashing
  • Export items to popular spreadsheet programs
  • Supports international charsets
  • Contains a "content" view for plain text viewing of data, as well as a hexadecimal view for more specific analysis.

Data Acquisition

SIMCon is also capable of acquiring the following data from a SIM Card:

  • Abbreviated Dialing Numbers (ADN),
  • Last Dialed Numbers (LDN)
  • Short Message Service (SMS)
  • Public Land Mobile Network (PLMN) selector
  • Forbidden PLMNs, Location Information (LOCI)
  • General Packet Radio Service (GPRS) location
  • International Mobile Subscriber Identity (IMSI)
  • Integrated Circuit Card Identifier (ICCID)
  • Mobile Subscriber ISDN (MSISDN)
  • Service Provider Name (SPN)
  • Phase Identification
  • SIM Service Table (SST)
  • Language Preference (LP)
  • Card Holder Verification (CHV1) and (CHV2)
  • Broadcast Control Channels (BCCH)
  • Ciphering Key (Kc)
  • Ciphering Key Sequence Number
  • Emergency Call Code
  • Fixed Dialing Numbers (FDN)
  • Forbidden PLMNs
  • Local Area Identitity (LAI)
  • Own Dialing Number
  • Temporary Mobile Subscriber Identity (TMSI)
  • Routing Area Identifier (RIA) network code
  • Service Dialing Numbers (SDNs)
  • Service Provider Name
  • Depersonalizatoin Keys

All GSM cell phones today have a subscriber identity module (SIM) to identify the phone onto the network. SIMCon is an application to acquire all of the information from the SIM Card.

The SIM Card provides secure storing of the key identifying a mobile phone service subscriber, subscription information, preferences and text messages. Network state information, such as the current location area identity (LAI), is also stored on the card. When a handset is turned off and then back on, it will search for the LAI that it was in, rather than having to search all frequencies that the phone operates in. This saves time when trying to log on to the network. (Subscriber, 2006, para. 1)

By using SIMCon and a smart card reader, all of the above information and more can be pulled off of the card without knowing the PIN or the PUK of the card. The PIN and the PUK are ways to keep the information on the card secure. They also can be used as a security feature on the phone, not allowing anyone to use a phone to access the SIM Card without knowing the codes.

Review

  • SIMCon makes the acquisition of data very easy, simply inserting the SIM Card to the appropriate SIM Card reader, and clicking acquire is all that is needed to start analyzing evidence. After the acquisition of the data is complete SimCon will show the user a screen with two halves.

  • On the left panel is the different data sectors of the SIM Card that can either be checked on or off depending on what is needed. After choosing what data sectors are needed, the right panel will be populated with the selected data. Some of the most useful pieces of information that are shown are: the International Mobile Subscriber Identity number, every contacts name and number, and all SMS messages sent and received both stored and deleted.

  • SIMCon also comes with two more handy features that are key to an examination and in a court of law. The first is SIMCon's feature that allows the printing of a report. SIMCon will format and populate a report with the contents of the users' choosing. This can list all the key pieces to an examination and is an excellent piece of evidence to be used in a court of law. The second feature is the exportation of the acquired data. SIMCon allows the exportation of all SMS messages and also of all contacts. When these exported files are opened in a program such as Microsoft Excel the data can be read, sorted, and analyzed in a format of the users design.

  • When SMS messages are exported SIMCon automatically adds the following information about every message: file, item, status, service center, message type, number, time stamp, and text. When the contacts are exported SIMCon automatically adds the following information about every contact: file, item, identifier, and number. For reference a report of an acquired SIM Card is enclosed as well as a document that tells what information is added into an exported file at the end of this document.

  • SIMCon is known to have issues while imaging multiple cards in the same session of the program. These issues include the appearance of random characters in both the contacts list and in SMS. These complications are outlined in the paper SIM CARD FORENSICS WITH SIMCON SOFTWARE by Timothy D. Huser.

  • Currently there is no "data-dump" mode in which one can simply dump data exactly as it is on the card in order to have a more pure examination of the contents. This has proven to be a major setback up to version 1.1, as the automatic parsing of information from the card sometimes leaves certain details unseen, especially in the content view.

SIM Card Seizure

Paraben acquired SIMCon and integrated it into SIM Card Seizure and Device Seizure. Recover deleted sms/text messages and perform comprehensive analysis of SIM card data. SIM Card Seizure takes the SIM Card acquisition and analysis components from Device Seizure and puts it into a specialized SIM Card forensic acquisition and analysis tool. SIM Card Seizure includes the software as well as a Forensic SIM Card Reader. If you already have Device Seizure & the Device Seizure Toolbox, there's no need for you to get SIM Card Seizure as well because they contain the components to perform a forensic SIM Card acquisition and analysis. This tool is for the investigator who only wants to acquire SIM Cards and does not want to perform forensic exams of all cell phone data.

SIM Card Seizure has unicode support to read multiple languages such as Arabic, Chinese, & Russian: Features:

  • Forensic SIM Card Reader Included
  • Calculates MD5 & SHA1 Hash Values
  • Search Function
  • Recovers Deleted SMS Data
  • Bookmarking Options
  • Report Creation Wizard
  • Save Workspaces for Further Review
  • Time Stamps Calculate GMT Offset
  • Access to Paraben's Forum
  • Access to Paraben's 24 Hour Support

Data Acquired from SIM Cards

  • Phase Phase ID
  • SST SIM Service table
  • ICCID Serial Number
  • LP Preferred languages variable
  • SPN Service Provider name
  • MSISDN Subscriber phone number
  • AND Short Dial Number
  • FDN Fixed Numbers
  • LND Last Dialed numbers
  • EXT1 Dialing Extension
  • EXT2 Dialing Extension
  • GID1 Groups
  • GID2 Groups
  • SMS Text Messages
  • SMSP Text Message parameters
  • SMSS Text message status
  • CBMI Preferred network messages
  • PUCT Charges per unit
  • ACM Charge counter
  • ACMmax Charge limit
  • HPLMNSP HPLMN search period
  • PLMNsel PLMN selector
  • FPLMN Forbidden PLMNs
  • CCP Capability configuration parameter
  • ACC Access control class
  • IMSI IMSI
  • LOCI Location information
  • BCCH Broadcast control channels
  • Kc Ciphering key

SIM Card Seizure also acquires the whole catalog system with data in a tree-view presentation. Additionally, it can recover some deleted SMS data by analysis of unallocated space.

Wireless StrongHold Bag

Wireless StrongHold Bag is an "evidence bag" for wireless radio frequency devices, for PDAs, Cell Phones, and SmartPhones.

In order to prevent a wireless device from connecting to the network, the device (e.g. a Cell Phone) can be placed inside of a RF Isolation bag or Faraday bag to blocks radio transmissions.

First responders can help to maintain the integrity of evidence contained in wireless devices through the use of this equipment. It should be noted that power should be supplied to the device if the data is volatile in nature, but the cable may introduce a pathway for electromagnetic signals to penetrate the controlled environment.

One example of such a kit is Wireless StrongHold Bag. This bag is weaved from three layers of nickel, copper, and nylon silver. The company also produces a StrongHold Tent, which allows the investigator to enter the radio signal dampened environment and also to bring in other equipment, such as laptops, in order to facilitate the investigation. As with any type of tool, RF isolation must be thoroughly tested before introduction to actual digital evidence.