5 Punja Nist 2014 BB Forensics FULL PDF

Blackberry Forensics
NIST Mobile Forensics Workshop June 2014
Shafik G. Punja
Cindy Murphy
June-19-14
1
Copyright © QuByte Logic Ltd
SPEAKER BACKGROUND
- Shafik G. Punja
- Active duty LE, performing digital forensics since Nov 2003
- Instructor for Teel Technologies US and Canada
- Senior Technical Officer – QuByte Logic Ltd
- Private sector work involves R n D partnerships with
various LE colleagues, digital forensics training, data
analytics and consulting services.
- Shameless plug: Course developer and primary instructor
for Advanced BlackBerry Forensics Class:
http://www.teeltech.com/tt3/blackberry4.asp?cid=16
- Contact: [email protected] or [email protected]
June-19-14
2
SPEAKER BACKGROUND
- Cindy Murphy
- Detective, City of Madison, WI Police Department since
1985.
- Involved in DFIR since 1999
- MSc Forensic Computing and CyberCrime Investigation
from Dublin in 2011
- Part time DFIR Instructor at Madison College
- Shameless plug: SANS 585 Advanced Smartphone
Forensics Instructor
- http://www.sans.org/event/for585-advanced-smartphone-
mobile-device-forensics
- Contact: [email protected]
June-19-14
3
Coverage
• Locked BlackBerry’s: access options
• BES and BlackBerry
• Unlocked BlackBerry’s: Physical versus Logical
• Backup IPD, BBB v1, BBB v2 formats
• BlackBerry Messenger (BBM)
• BlackBerry Artifacts
• Malware/Spyware on BlackBerry devices
• BlackBerry 10
June-19-14
4
BlackBerry 7 (and lower)
- Developed by Research In Motion (now called BlackBerry) based out
of Waterloo, ONT Canada.
- Device software design evolved from C++ to Java.
- Uses proprietary OS designed through JVM (Java Virtual Machine).
- The operating system is a collection of .cod files. You will not see a
true file system in any analysis tool.
- Security of device rests with its relationship with the hardware.
- In Java based BB devices, BootROM is trust anchor.
- BlackBerry applications come packaged either as .COD files or JAD
files which is associated to either OTW or OTA application installation.
June-19-14
5
Locked BlackBerry
- Option 1: If BES attached unlock via BES.
- Option 2:Attack info.mkf file on memory card

if this is present.
(http://blog.crackpassword.com/2011/09/recovering-blackberry-device-
passwords/)
- Option 3: Chipoff (maybe JTAG which might

work on older model devices).
June-19-14
6
Locked BlackBerry
- Password is
- NOT stored on computer used by device owner
for backup of
- NOT present in the backup IPD file or any other

version of the backup
- According to BlackBerry there is no backdoor into

the device
- BlackBerry, may or may not help you in accessing

the data on a locked BlackBerry device.
June-19-14
7
Locked BlackBerry
- Large Padlock lower right on handset screen = password
locked
- Large Padlock lower right AND smaller padlock upper
left = password locked and encrypted
- Less secure passwords are rejected by the smartphone,
such as those composed of identical characters, or
characters that consist of natural sequences (i.e. 1234).
- If the device is locked AND you see the device
prompting you to type the word “blackberry”, this means
that half the password attempts have already been used.
- If a password is entered incorrectly ten consecutive
times, this will automatically wipe all of the data on the
BlackBerry.
June-19-14
8
Locked BlackBerry - BES
- BES (BlackBerry Enterprise Server): runs in server
environment.
- A single BES can host as many as 500 BB devices.
- If a device is BES attached a password reset can be
pushed from the BES Management Console.
- Password Reset does not affect the user data on
the device.
June-19-14
9
Locked BlackBerry – BES 2
1. Open the BlackBerry Enterprise Server Management console.
2. Right-click the user account that requires a password change.
3. Click IT Admin > Set Password and Lock.
4. In the Set Handheld Password and Lock window, type the
new password into the New Password and New Password Again
fields.
5. Click OK.
Note: It takes approximately 30 minutes for the new IT Policy to
be sent to the device.
6. When the device receives the IT Policy, the following
message is displayed:
New IT Policy Changed Over The Air. Would you like to accept?
7. Click OK. The user can now use the new password on the
device.
Source: http://www.blackberrycool.com/2005/10/23/changing-handheld-password-from-blackberry-enterprise-server/
10
June-19-14
Locked BlackBerry – BES 2
- You remembered to ask the friendly BES admin for the BES daily
log files right?
- BES stores daily logs in folders under default path C:\Program

Files\Research in Motion\BlackBerry Enterprise Server\Logs\ -
grab them all and don’t forget the email container which is stored
separately.
- Depending upon BES version there may be over 15 or so different

types of logs: SMS logs, PhoneCall logs, PINLog and BBM logs
- By default only PhoneCall logs are enabled on BES 5 and lower. In

BES 10 and higher, it is believed that SMS, PhoneCall, PIN and BBM
data is logged.
- SMS, PIN, PhoneCall and BBM are stored in CSV format contain both
content and sender, receiver information
11
June-19-14
Locked BlackBerry – info.mkf file
- Non BES device, commonly referred to as BlackBerry Internet
Service (BIS) device.
- If BlackBerry is locked AND if memory card is encrypted with

either option 2: Security Password or option 3: Security
Password and Device (default encryption is off)
- Then a hidden file info.mkf on the memory card at

/BlackBerry/system/ will be found.
- EPPB attacks/exploits this file to obtain the password to the

BlackBerry device
- *Source: http://blog.crackpassword.com/2011/09/recovering-blackberry-device-passwords/
12
June-19-14
- /
13
June-19-14
- When an upper case character is

introduced, the english dictionary word list
attack will always fail as it only examines
lower case.
- So it might be worth while obtaining a

keyword list from other related electronic
exhibits which can be imported into EPPB
or attempting a mutation attack.
14
June-19-14
Locked BlackBerry – Chipoff
- Option 1 and 2 are not available then only
recourse is a chipoff.
- Consists of device disassembly, chip removal,

chip cleaning, and chip reading with a chip
programmer.
- This is destructive process to the device: you

cannot power on the device to validate the
parsing of the binary NAND/NOR dump.
15
June-19-14
Locked BlackBerry – Chipoff
- Best and currently the only tool that will decode a BlackBerry chipoff
NAND dump obtained through a chip programmer is UFED Physical
Analyzer (UFED PA)!
- If BlackBerry device is attached to a BES, and you don’t have access to

the BES, chip off is pointless as the data cannot be decrypted by any
commercial tool at this time. Real world scenario: hostile BES,
BlackBerry seized and is usually PGP encrypted then you are at a dead
end, even with chipoff.
- Want to decode the device password from the chipoff NAND dump?
Remember this password may also unlock other devices!
- Look at Trace Log and find SHA1 hash value; hash can be decrypted
using these two links:
http://www.stringfunction.com/sha1-decrypter.html
http://www.md5decrypter.co.uk/sha1-decrypt.aspx
16
June-19-14
Locked BlackBerry – SHA1 Password
• The hash value is 40 characters in length, which is typically
indicative of SHA1 value.
17
June-19-14
Encrypted AND Locked BlackBerry
• This applies to non-BES devices, that just use the provided
encryption (also called Content Protection options) for the device
memory.
• Take the SHA1 value and decode the hash with links presented
previously, enter the password into the field and UFED PA will
decrypt the data.
18
June-19-14
Unlocked BlackBerry Devices - Physical
- Only tool that will obtain a physical read of the NAND

over USB is UFED Classic or UFED Touch.
- This is done using a bootloader injection, into the

RAM of the device.
- This is the only way to obtain deleted artifacts and

non saved BBM chat.
- Resulting BIN file is opened in UFED PA for analysis.
19
June-19-14
Unlocked BlackBerry Devices - Physical
- Process that I recommend typically is

UFED physical extraction, followed by
UFED file system (creation of IPD/backup)
and UFED Logical parsed.
- Reason: to limit wear leveling functions on

the NAND do physical first if UFED
supports it then proceed to other extraction
methods
20
June-19-14
Unlocked BlackBerry Devices – Physical – OOOPS!
BUT……This could happen to you if you go after

the physical first and not logical:
So what happened to our unfortunate DFIR colleague?
21
June-19-14
Possible Scenarios:
1. The BlackBerry device must be turned and unlocked for the UFED boot
loader injection process to occur.
• Was it radio isolated, or did it briefly initiate a wireless connection?
2. If the device is attached to a BES, there is a BES IT policy that will initiate
a device wipe if the BlackBerry device cannot receive an IT policy update or
IT administration commands, after a specified period of time between 2 and
720 hours.
• If the device is radio isolated then it cannot connect to the BES
which could invoke the wipe IF this policy is enforced/enabled.
3. Could the bootloader injection have inadvertently triggered a device

wipe?
• In the non-volatile (NV) memory store the device sets the Device
Under Attack flag. Once this bit is set, nothing will clear this flag
except completion of the wipe.
22
June-19-14
What actually happened (cited from the listserve email):

- No “factory reset.” What happened, I would call it “wipeout”, and
Cellebrite prefers calling it “cache memory reset”.
- Blackberry 9630, on Enterprise network, not used for more than

half a year, and arrived in with the battery totally discharged.
- Connected to a charger, and as soon as it came to life, disabled

Wireless and Bluetooth (both were seen as enabled first).
- Close to the end of the process Cellbrite displayed a message,

something along the following lines “Cellebrite is completing the
physical extraction by rebooting/resetting (?) the phone”.
23
June-19-14
What actually happened (cited from the listserve email):

- Post physical extraction: device checked, almost all the data was
gone. Also, in the settings window “Connections” “Verizon
Wireless” was replaced with “Mobile Network”.
- …good news is that all the data was collected by Cellebrite,

before it was lost.
- Cellebrite’s explanation: Cellebrite installs a client on the phone

for the extraction, and needs to remove it when the extraction is
completed. On Blackberry 9.x and earlier versions the phone has
to be rebooted and this is what triggers “cache memory reset” and
loss of data.
24
June-19-14
Unlocked BlackBerry Devices - Logical
- For BlackBerry devices logical data extraction
and parsing:
- UFED Classic or Touch.
- Oxygen Forensic Suite Analyst USB
version.
- XRY (Microsystemation)
- Don’t forget about using BlackBerry Desktop

Software for Window or Mac in making a
logical backup IPD file
25
June-19-14
Unlocked BlackBerry Devices – Other Tools
- These tools connect to BlackBerry over

USB and extract the logical data structure:
- EnCase 7
- FTK MPE+
- Secure View 3
- Final Mobile (Final Data)
- May be other tools, that are not listed here.
26
June-19-14
Unlocked BlackBerry Devices – Parsing Tools
- These tools parse BlackBerry backup formats IPD and BBBv1:
- UFED PA
- Oxygen Forensic Suite Analyst
- XRY
- FTK 3.x and higher with FTK MPE
- Elcomsoft BlackBerry Explorer (EBBE)
- EnCase 7
- EnCase 6 – with script from Yogesh Khatri: www.swiftforensics.com
- Secure View 3
- Final Mobile (Final Data)
- BlackBerry Backup Explorer (Reincubate) – this will do IPD, BBBv1
and BBBv2
- phoneMiner
- Rubus (CCL Forensics, this is FREE): this allows deconstruction of
backup file into its raw structure; does not parse into clean
reporting format
- MagicBerry (FREE): does NOT support decoding of all database
structures
27
June-19-14
BlackBerry Backup Formats
- IPD File(Inter@ctive Pager Backup): This is a

collection of the data structures called databases all
coagulated into one unique backup file.
- BBB File: v1 created by Mac version of BlackBerry

Desktop Software, IPD file contained within .bbb file
which has a PK header signature (zip file)
- BBB File: v2 created by Windows version of

BlackBerry Desktop Software v7.1.x and higher; the
backup is contained within the .bbb file but each
data structure is stored as individual .DAT file
28
June-19-14
- The IPD structure is not how the data exists on the BlackBerry device at
a physical level: Logical versus physical of same record
29
June-19-14
- BBB v2 backup format
- The number of DAT files present in the Databases folder should

match the number of databases listed in the Manifest.xml; this
file is found within the root of the BBB compressed archive.
30
June-19-14
BlackBerry Date Formats
- 3 different date formats identified, and documented by Yogesh Khatri;
http://www.swiftforensics.com/2012/03/blackberry-date-formats.htm
1. Phone Call Log, SMS, Phone History
• 8-byte length Java date value, which represents the timestamp in milliseconds,
and is similar to Unix time values (which are 4 bytes).
• Also applies to BBM and PIN messages; dates in BE order (when data is viewed
in BBM.db file or BBM Conversations file)
• The Win Hex/X-Ways Forensics Manual (1995-2006 Stefan Fleischmann), page

8, describes Java date as “a 64-bit integer value that specifies the number of
milliseconds since January 1, 1970. Principally stored in big endian, which is the
typical byte order in Java.”
• Unix timestamp (4 bytes, converted into their decimal equivalent) * 1000 = Java
Date.
• Java Date/1000 = Unix Timestamp
• This is also referred to as the BlackBerry® Date
31
June-19-14
- 3 different date formats identified, and documented by
Yogesh Khatri;
http://www.swiftforensics.com/2012/03/blackberry-date-
formats.htm
2. Calendar
• Calendar date values use number of minutes since 1 Jan
1900 0:0:0.
• Precision to only the number of minutes.
• Yogesh Khatri cites this formula to obtain the unix time

value:
• UnixTimestamp = (CalendarDate – 36816480) * 60
32
June-19-14
- 3 different date formats identified, and documented
by Yogesh Khatri;
http://www.swiftforensics.com/2012/03/blackberry-
date-formats.htm
3. Email
• Sent and Received dates are stored as a 2 byte date
and 2 byte time value.
33
June-19-14
BlackBerry Endian Order
- There is no real clear direction from BlackBerry in any
official technical specifications on how to read the byte
order of the data and also whether the byte order is
signed or unsigned.
- In the IPD structure both BE and LE ordering are used.
- The only fields that are identified by BlackBerry

documentation, for the IPD/DAT file backup is the
following as LE byte order:
- record length
- database version
- database handle
- record type
34
June-19-14
BlackBerry – BBM
- BlackBerry devices that cannot use BlackBerry Messenger

5.0 or higher = take pictures; there is no backup
mechanism
- BBM Chat History: If save chat history option is enabled
chat is saved in CSV format and stored in one of 2
locations: memory card or content store data structure
on the device:
- Paths:
- /store/home/im/BlackBerry Messenger/<pinnumber>
- /SDCard/BlackBerry/im/BlackBerry
Messenger/<pinnumber>
- These locations will store CSV, .CON and .BAK files; CON
and BAK files is the device user’s BBM contact list and the
BAK is the backup of the contact (CON) file.
35
June-19-14
BlackBerry – BBM Chat CSV
- BBM Chat CSV File: Date/Time is 21 digit numeric value

which, YYYYMMDD (first 8 digits reading from the left)
followed by remainder 13 decimal values are actually the
unix DATE AND TIME stamp numeric values in millisecond
- Example: 201001291264804385552
- Parsing CSV files: bbmessenger.py (Python 3 required)
https://sites.google.com/site/slosleuth/ (John Lehr)
- Parsing CON/BAK files: ConParse (Java based)
https://github.com/sheran/bb-tools (Sheran
Gunasekera)
36
June-19-14
BlackBerry – Artifacts BBM
- Using BBM 5.0 but no chat history save enabled;
- Must do a physical extraction with UFED
Touch/Classic in order to obtain BBM chat data.
- Enabling the save chat history feature will not work on
chat conversations currently on the device; only
affects new chat from the date the option was
enabled.
37
June-19-14
BlackBerry – BBM.db
- Found in BBM 6 and higher running BB OS 6.
- BBM database file: bbm.db.
- Proprietary database that contains BBM chat
even if option of saving chat history was NOT
enabled.
- Also contains data similarly found in the CON
and BAK files.
38
June-19-14
BlackBerry – BBM.db
• A bbm.db file that is not encrypted can, generally,
be divided into several areas:
• Device owner information
• BBM contacts
• Device owner time zone
• BBM chat content
• Only one tool currently parses this right now – UFED

PA; OFS may also do this, but not tested.
• bbm.db is only observed to retain chat based on BBM
app or OS upgrade/downgrade; meaning that there
may be chat present on device that is not stored in
the bbm.db file.
39
June-19-14
BlackBerry – BBM Conversations
• This was discovered by a colleague on examination of a BlackBerry 9900
running OS 7.x.
40
June-19-14
BlackBerry – BBM Conversations
• This file appears not much different than BBM.db and follows similar
structure (grouped by PINs/Chats etc.) like the bbm.db file.
• It has only been observed on devices running OS 7.x.
• It contains the BBM contacts, and chat history, believed to be saved
regardless of whether BBM save chat history option is enabled.
• The BBM Conversations folder can be obtained with a logical file system
extraction.
• Tools that do parse the BBM Conversations structure:
• BlackBerry Backup Explorer (Reincubate)
• Tools that might or will likely parse the BBM Conversations structure:
• UFED PA?
• Oxygen Forensic Suite?
• XRY?
41
June-19-14
iOS and Android BBM
• BBM for iOS is only supported for iOS 6 and 7.
• BBM for Android is only supported for Android OS (AOS) 4.0 and later.
• A BlackBerry Messenger ID is required.
• The Android or iOS device will be assigned a unique PIN, 8 characters
long, randomly generated.
• Observed by both Sheran Gunasekera (aka Gunny), and Jose Garcia,
the iOS and Android BBM app uses SQLite database to store its data.
• BBM 10 for also offers voice and video, which connects over Wi-Fi.
42
June-19-14
iOS and Android BBM
Icons related to BBM 10 for Android, and iPhone cited from:
http://helpblog.blackberry.com/2013/10/getting-started-with-bbm-on-
android-and-iphone/
43
June-19-14
iOS and Android BBM
44
June-19-14
BlackBerry – Artifacts BBThumbs.dat
- BBThumbs.dat: Thumbnail cache of pictures currently or previously stored on
the BlackBerry device or its associated memory card; typically observed in OS
5.x and older (pre OS 6.x)
- Magic String/File Header: /x24/x05/x20/x03/
- Paths:
• SDCard/BlackBerry/foldername/BBThumbs.dat
• store/home/user/foldername/BBThumbs.dat
- The “foldername” referred to in the path can be videos, pictures, voicenotes, and
likely also audiobooks, documents, music, podcasts and ringtones.
- Records the file names of all files stored within that specific directory even if that
file has been deleted.
- BBThumbs.dat file related to the pictures directory only stores pictures (PNG,
JPG, GIF) inside it; for video BBThumbs.dat only filename is present, no image.
45
June-19-14
BlackBerry – Artifacts BBThumbs.dat
Parsing BBThumbs.dat
1. bbt.py (Python 2): https://github.com/sheran/bb-tools (Sheran
Gunasekera) can be used to parse the key/dat pair files and the older
BBThumbs.dat files.
• bbt.py will extract all the records in the BBThumbs.dat file.
• If the record is a picture, then it extracts the thumbnail that is stored

inside the BBThumbs.dat file and saves it.
• Script output will show the filename, time stamp local to the device time
and the SHA1 hash value for the record.
• If the record inside BBThumbs.dat is not a picture file, then bbt.py will
extract the metadata from the file. In this case the BBThumbs.dat file is
from another folder such as video or voicenotes. The SHA1 will be for
this record.
46
June-19-14
BlackBerry – Artifacts key/dat
thumbsXXxXX.key/thumbsXXxXX.dat:
- Instead of BBThumbs.dat, for OS 6.x, the files come in
.key and .dat pairs named by the image size of the
pictures that it is cataloguing – ONLY FOR PICTURES
- Paths:
• SDCard/BlackBerry/system/media/thumbsXXxXX.dat
• store/appdata/rim/media/thumbsXXxXX.dat
47
June-19-14
BlackBerry – Artifacts key/dat
- thumbsXXxXX.key/thumbsXXxXX.dat:
- It is believed based on examination of multimedia
content that the dat/key files only store metadata
related to images and picture images present on
the BlackBerry® device.
- The KEY file is like an index table that contains

byte values that provide indication of where the
records exist with the DAT file:
- The record in the DAT file contains images and

other meta-data.
48
June-19-14
BlackBerry – Artifacts key/dat Parsing
- Parsing thumbsXXxXX.key/thumbsXXxXX.dat:
- 1. bbt.py (Python 2):
https://github.com/sheran/bb-tools (Sheran
Gunasekera) can be used to parse the key/dat
pair files and the older BBThumbs.dat files.
- 2. bbt.exe (Windows executable): Based on

Sheran Gunasekera’s work, Detective John
Thompson (Special Investigations Section -
Technical Services Unit, Lakeland Police
Department) wrote a Windows based command
line EXE that will work very similar to bbt.py.
49
June-19-14
BlackBerry – Artifacts key/dat Parsing
-Parsing thumbsXXxXX.key/thumbsXXxXX.dat:
- 3. BBThumbs EnScript: For those that use EnCase 6.x, a
fellow colleague and very good friend, Special Constable
Jeremy Dupuis (Ontario Provincial Police) has developed an
EnScript that will run against thumbsXX and thumbsXX files
with a DAT extension. Using the script: Blue checkmark one
to multiple thumbs??x??.dat files and run script.
- 4. Commerical Tools: UFED PA, Oxygen Forensic Suite

Analyst, Final Mobile etc – don’t forget to check these tools, as
they do handle either the BBThumbs.dat variant and/or the
KEY/DAT files.
50
June-19-14
BlackBerry – Artifacts art.dat files
- xxxxart.dat files (OS 6.x and higher):
- Other multi-media content such as video,
podcasts, music are stored in files that end
with DAT;
- the file name is typically xxxxart.dat where

xxxx represents the name of the type of
multimedia content that it is referencing.
- The xxxxxart.dat files are SQLite format 3

database files
51
June-19-14
BlackBerry – Artifacts Voicenotes
- Voicenotes metadata strangely is still stored in
the BBThumbs.dat format.
- Parsing videoart.dat files (OS 6.x and higher):
- bbvideo.py: we can parse the videoart.dat file
and extract the BLOB data in from the SQLite
database file.
- http://linuxsleuthing.blogspot.com (John Lehr)
52
June-19-14
BlackBerry – Artifacts EXIF Pictures and Movies
• Exif Data:
• To understand how EXIF data is stored
within multimedia content, refer to the
JEITA CP-3451 Exchangeable image file
format for digital still cameras: Exif Version
2.2.
• pictures: can contain geotag data along
with traditional date/time values, and
make/model values.
53
June-19-14
BlackBerry – Artifacts EXIF Pictures and Movies
- Exif Data:
- movies: no geo tagging or make/model
embedded within movie files; usual time
stamps values for media creation and
embedded within the video file; and also the
encoder value called “rimm” will be observed.
- voicenotes: none observed.
- BEST Exif Analysis Tool of Choice: ExifTool

by Phil Harvey, does a great job!!!
54
June-19-14
EXIF Geo Data
- For Geo Data to be written to a device

created picture/image the following conditions
must be present:
- Device GPS Services must be enabled.
AND
- The Camera GPS function must be
enabled, by default it is disabled.
AND
- Device must be capable of receiving GPS
data.
55
June-19-14
EXIF Geo Data: Which Picture/Image Contains Geo Data?
56
June-19-14
EXIF DATA INCORRECT TIMESTAMPS IN
BLACKBERRY DEVICES
One critical observation made by a fellow research colleague, Sam

Brothers, Department of Homeland Security about EXIF values
regarding BlackBerry® devices:
“Wrong EXIF data gets written for the 1st picture every time the phone
goes to sleep or the screensaver goes on! So, EXIF in a BB cannot be
relied upon. This has been validated on (2) devices thus far.”
It is unknown if the behavior described by Sam Brothers is consistent

for every BlackBerry® device, across every OS iteration.
But this has been observed on BlackBerry OS 4, 5, 6 and 7 devices.
Blog Post where Steve Zenone also observes the same behavior:
http://blog.zenone.org/2009/01/forensics-blackberry-curve-8310-and.html
57
June-19-14
BlackBerry – Artifacts REMF
- REMF observed in file header? (Depending on your perspective

REMF could also mean Rear Echelon..ahemmm….…well…I am
sure you get the rest!).
- The .rem extension denotes an encrypted file, which can only be
decrypted by the device that encrypted the files.
- Another method is to use the latest version of UFED PA, or
Elcomsoft Phone Password Breaker and see if the .rem files can
be decrypted.
- The metadata files (like .dat, .key or BBThumb.dat) do not
appear to be affected by the encryption despite having a .rem at
the end of these files.
58
June-19-14
BlackBerry – Artifacts REMF
• Looking at the file header of a rem encrypted JPG
image we can see the header in ASCII is "REMF", or
52 45 4D 46h.
59
June-19-14
BlackBerry – Artifacts Event Logs
- Event Logs: Similar to Windows Event Logs, the
BlackBerry® handheld device keeps event logs
where applications and the BlackBerry® operating
system can log information such as recently run
events and system processes.
- To view the event log, press ALT and press key
sequence LGLG from the main (home) screen, which
should work on all BB devices with a QWERTY
keyboard.
60
June-19-14
- Event Logs:
- The main purpose of these logs is to assist developers
with debugging applications or services on the
BlackBerry® handheld device.
- However, unintentionally, the Event Logs may also serve

as a potential source of previously untapped digital
evidence.
- There has been no official documentation released by

BlackBerry® that the author can find, regarding how to
interpret or read the event log data.
- This data is volatile in that logs can roll over within 24-48
hours depending upon device usage and maximum log
size limit.
61
June-19-14
- Easiest way to get the event logs from a device is using
BlackBerry Desktop Software: Then access Support tools from:
Help (?) -> Support Resources -> Support Tools -> Generate
Support Log
62
June-19-14
63
June-19-14
- In doing research with fellow colleague, Sheran
Gunasekera, we discovered that event logs retained
call history data even after user deleted it from their
device Phone Call app.
- http://chirashi.zenconsult.net/you-want-the-
blackberry-event-log-beg-damnit/
- Only forensic tool that allows event log extraction
during its logical stage is Oxygen Forensic Suite
- UFED will obtain this only through a physical dump,
which is later parsed by UFED PA; the BlackBerry
Event Log plugin must be run in order to review this
data.
64
June-19-14
- The date/time values are local to the device user’s time zone, in this
case, Mountain Time (-7) GMT
- The application that generated the event log will be preceded by the
value “app:”, followed by the name of the application.
- GUID: 16 alphanumeric characters associated to an event or
occurrence.
65
June-19-14
- The first two lines have consistently been observed by the
author in all event log extractions on a BlackBerry® Bold 9700
(OS 5.0.0.862, Bundle 1446, Platform 5.1.0.175).
• guid:0x97C9F5F641D25E5F time: Wed Dec 31 17:00:00
1969 severity:0 type:2 app:System
• data:JVM:INFOp=33759974,a='5.0.0.862',o='5.1.0.175',
h=4001507
- The PIN # of device in hexadecimal is identified as
p=33759974
- OS version: a='5.0.0.862'
- Platform: o='5.1.0.175'
- Hardware ID: h=4001507
66
June-19-14
• Evidence of call history in BlackBerry 9700 device event log
67
June-19-14
guid:0xDDA0BC913B6AAEEC time: Thu Dec 02 20:53:56 2010 severity:0
type:2 app:PhoneApp data:StartCall: Raw Num
type:2 app:PhoneApp data:PHONE: connecting 4032068645
guid:0xE68C69BA0F2EBC4D time: Thu Dec 02 20:53:56 2010 severity:0 type:2
app:CC data:StartCall,"4032068645",0
app:CC data:Conf t+1
app:CC data:Ret,1
type:2 app:PhoneApp data:EV_CALL_INITIATED(1)
app:CC data:CallName,1,"false",""
type:2 app:PhoneApp data:sAct
type:2 app:PhoneApp data:phone: audio source on
68
June-19-14
guid:0xE68C69BA0F2EBC4D time: Thu Dec 02 20:54:00 2010 severity:0 type:2 app:CC
data:CallName,1,"false",""
data:CallName,1,"false",""
data:Delivered,1
guid:0xDDA0BC913B6AAEEC time: Thu Dec 02 20:54:03 2010 severity:0 type:2
app:PhoneApp data:endcallbyuser 1
data:StopCall,1
app:PhoneApp data:dAct
app:PhoneApp data:callsmpt; switchbg=false
app:PhoneApp data:PHONE: callId 1 stops listening.
app:PhoneApp data:uAct
app:PhoneApp data:EV_CALL_DISCONNECTED(1)
69
June-19-14
• BlackBerry Event log timestamps from a physical
memory acquisition are stored as 4 byte length (32
bytes total), LE order
01 E1 FF FF 56 05 00 00 3B 00 DD 9A 61 4D 00 4D BC 2E
0F BA 69 8C E6 47 65 74 43 61 6C 6C 4E 75 6D 62 65 72
2C 38 2C 22 66 61 6C 73 65 22 2C 22 34 30 33 38 37 35
36 37 36 36 22 FF 2C 00 00 00 00 00 FF FF
70
June-19-14
01 E1 FF FF 56 05 00 00 3B 00 DD 9A 61 4D 00 4D BC 2E
0F BA 69 8C E6 47 65 74 43 61 6C 6C 4E 75 6D 62 65 72
2C 38 2C 22 66 61 6C 73 65 22 2C 22 34 30 33 38 37 35
36 37 36 36 22 FF 2C 00 00 00 00 00 FF FF
71
June-19-14
• Real world example:
• A Bluetooth (BT) device has been paired with
BlackBerry device. Question – ‘Are you aware
of any timestamp information related to the TIME
the device was in use recorded on a BB?’
• Answer: Check the event log – but I don’t know

what event log strings identify BT activity, as I
have not had an opportunity to test this. Run the
UFED PA plugin for BlackBerry event log.
72
June-19-14
• Real world example:
• Results: LE entity had a UFED Physical memory
acquisition of BlackBerry device and they
found……
• Bluetooth pairing is always logged! And in this case,
the BT pairing was not observed, hence BT was not
used during vehicular operation
• Device in hand of driver while two calls were being
manually placed 17 minutes before the 911 call.
• Event log recorded the device has been manually slid
open by the user (only certain types of BlackBerry 7
devices came in a slider form factor).
73
June-19-14
BlackBerry Malware
2006:
• First known BlackBerry® malware (August 2006), developed by
security researcher, Jesse D'Aguanno, called BBProxy, which
exploits the link of a BES connected device via its email server.
• A BES connected BlackBerry® has a constant connection to its

corporate Local Area Network (LAN) which was used in this exploit,
also making it difficult to detect the compromise into the corporate
network as the data traffic is going through RIM’s encrypted tunnel
between the BlackBerry® and its BES network.
2009: “spyware” that was pushed to Etisalat users as update, in the

UAE by its telecommunications provider.
2010: Zeus: malware Trojan targeting the BlackBerry® and Symbian

series 60 devices designed to capture banking credential login data.
74
June-19-14
BlackBerry Malware
Infection Vectors (IV):
• Can be grouped into two overall categories:
1. Wired: Memory Card, Synchronization
between computer/laptop and device.
2. Wireless: BT, IR, SMS, MMS, IM, Email,

PIN to PIN.
75
June-19-14
BlackBerry Malware
Commercial Spy Ware:
• There are numerous commercial spy ware programs that
promote themselves as monitoring software (parental
control, employee monitoring, GPS tracking):
• MobiStealth
• FlexiSpy
• Mobile-Spy
• eBlaster Mobile
• Spy Bubble
• Neo-Call
• eStealth
• Spyera
76
June-19-14
BlackBerry Malware: Installation/Infection
Requirements
• As tested by the author on a BES and non BES device using
eBlaster Mobile.
• BES connected BlackBerry installation was unsuccessful,
due to the BES and device policies in effect = VERY
SECURE!
• Need to have physical control of device.
• If device is password protected, need to know the
password.
• BlackBerry OS 5, 6, 7 , there is a setting for having the
device prompt the device user on application install;
default is No.
• Installation of spyware is either OTA or OTW.
• The spyware will likely use a keystroke combination to
invoke the application settings and configuration.
77
June-19-14
BlackBerry Malware: Detection Measures/Steps
Start simple and work your way through the continuum:
1. Device battery draining quicker than usual which cannot be
attributed to battery or device malfunction. Device overheating
may also be another symptom that presents along with battery
exhaustion. This was experienced by Etilsalat compromised
devices.
2. Review of device owner’s carrier billing records indicates a

sudden data spike in data usage that is outside of the normal
data usage over a given time period.
3. Does review of data traffic logs from carrier point to specific

external IP address, email address or phone number?
4. Receipt of unusual emails from unknown recipients or presence

of SMS and PIN messages not identifiable by the device owner;
this data may represent control channel messages, which are
control commands sent to the malware application.
78
June-19-14
Data Analytics:
1. BlackBerry Event Log: may or may not present signs
that device is infected. Applications are not required to
write to the device event log.
2. Device running, dormant and hidden processes: May

need to place device into EScreen or Engineering
Screen mode in order to obtain this information.
3. Extraction and Review of System COD Modules and

Files: A malware application can cause itself to be
hidden from view. The FLAG_HIDDEN bit must be set
to false in order for an application to hide itself from view
in the applications list.
79
June-19-14
Data Analytics:
4. Extraction and analysis of device physical memory (if
possible), IPD (backup file), as well as any associated
memory and/or SIM card.
5. Review of each applications permission categories.
6. Device Malware Scan: may or may not be

successful. Either through on device installation of a
scanner or scan of acquired data.
80
June-19-14
BlackBerry Malware Case Study: MobiStealth Infection
• MobiStealth infected device: Screenshot of data resident from
an Blackberry 9550 IPD file:
81
June-19-14
Observation 1:
• What we are observing within the orange rectangle
is device downloads from the internet for
BlackBerry® Messenger (BBM).
82
June-19-14
Observation 2:
• What we are observing within the orange rectangle is
device downloads from the internet for BlackBerry®
Messenger (BBM).
• Due to the large size of the file (and restrictions upon

maximum file size for COD files) we see at least 27
COD files, based on RIM-COD-Size-27, related to
BBM that vary in size from 65 KB to 72 KB.
83
June-19-14
Observation 3:
We see access from the device to a number of
resources from URL link:
http://mobistealth.com/asset/new/
84
June-19-14
Observation 4:
To verify if the resources still reside at the specific URL’s
visit
http://mobistealth.com/asset/new/EmailSystemClient.
cod;
Result: total of three COD files that make up the entire
MobiStealth application for this specific device:
• EmailSystemClient.cod
• EmailSystemClient-1.cod
• EmailSystemClient-2.cod
85
June-19-14
Observation 5: Artifact Identification:

• Multiple COD filenames that identify the actual name of the rogue
software that should also be observed on the infected host.
• Creation Times in Unix epoch time format
• SHA1 hash values of COD files
• IMEI value of host device (sanitized in the screenshot)
86
June-19-14
Observation 5: Artifact Identification:

• Multiple COD filenames that identify the actual name of the rogue
software that should also be observed on the infected host.
• Creation Times in Unix epoch time format
• SHA1 hash values of COD files
• IMEI value of host device (sanitized in the screenshot)
87
June-19-14
Investigator also provided this snippet to me:
• Keyword search in EnCase 6.x of hard drive image for “mobistealth”
shows hits in unallocated space (of the suspect hard drive) that appear
like the following:
··GET /bbchat_history.php?cmd=search
HTTP/1.1 Host:www.mobistealth.com User-Agent: Mozilla/5.0
(Windows ; U; Windows NT 6.1; en-US; rv:1.9.2.13)
Gecko/20101203 Firefox/3.6.13 Accept:
text/html,application/xhtml+
xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-
us,en;q=0.5 Accept-Encoding: gzip,deflate Accept- Charset:
ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Connection:
keep-
alive Referer: http://www.mobistealth.com/sms_history.php?cmd=
search Cookie: PHPSESSID=1c1aq7t5pu8l9c450ta9duh4i6;
MobistealthVisitor=32c06 ffa5972c8cc8e00b0b86a1257cc;
SERVERID=web2;
__utma=192346166.1897014666.1297088891.1297088891.1297088891.1;
__utmb=192346166.4.10.1297088891; __utmc=192346166;
__utmz=192346166.1297088891.1.1.utmcsr=(direct)|utmccn=(
direct)|utmcmd=(none) ö£n;an·€··hn»t·ì·f–ØŠ¸õ˜
›óçKÉ:Î·ý|·,é>9·¹DœXð|Q_‘×·œ5¶%•¼û9?·P·ð¾ ñ)·Sm ƒðÕZ3¸æã‡EÂè·ù
>·zHÂéš¡¹‡”æÊ L =ÎÃPÝz!›rÓo1ª·™´·4 Ö? qÆÝ·· Ë
88
June-19-14
• GET request using likely a Mozilla type browser;
user has logged into mobistealth user account and
is accessing sms history and bbm chat.
··GET /bbchat_history.php?cmd=search
HTTP/1.1 Host:www.mobistealth.com User-
Agent: Mozilla/5.0 (Windows ; U; Windows NT
6.1; en-US; rv:1.9.2.13) Gecko/20101203
Firefox/3.6.13 Accept:
Referer: http://www.mobistealth.com/sms_his
tory.php?cmd=search Cookie:
PHPSESSID=1c1aq7t5pu8l9c450ta9duh4i6;
MobistealthVisitor=32c06
ffa5972c8cc8e00b0b86a1257cc; SERVERID=web2;
89
June-19-14
• UTM = Urchin Tracking Module
• Google Cookie Data:

• various types of utm values: utm[a|b|c|z]
• Anatomy of _umta:
• __utma=<domain hash>.<unique visitor
id>.<timstamp of first visit>.<timestamp of previous
(most recent) visit>.<timestamp of current
visit>.<visit count>
90
June-19-14
• __utma=<domain hash>.<unique visitor id>.<timstamp of first
visit>.<timestamp of previous (most recent) visit>.<timestamp of
current visit>.<visit count>
• __utma=192346166.1897014666.1297088891.1297088891.1297088891.1;
__utmb=192346166.4.10.1297088891; __utmc=192346166;
__utmz=192346166.1297088891.1.1.utmcsr=(direct)|utmccn=(
direct)|utmcmd=(none)
<domain hash>.192346166
<unique visitor id>.1897014666
<timstamp of first visit>.1297088891 = Mon, 07 February 2011 14:28:11.

UTC = date of visit to Mobistealth
<timestamp of previous (most recent) visit>.1297088891

<timestamp of current visit>. 1297088891
<visit count> 1
91
June-19-14
Summary
1. Suspect’s computer hard drive contains a BlackBerry
backup IPD file of the victim’s BlackBerry device, which
shows her device accessing and downloading (OTA install)
the mobistealth software as segmented files.
2.Suspect’s computer hard drive shows, that computer was

used to login to a mobistealth user account where the BBM
chat and SMS history web pages were accessed.
3. If the ‘infected’ device has been analyzed, it should show

the presence of the EmailSystemClient.cod file.
92
June-19-14
BlackBerry Safe Mode/JVM Error Codes
Safe mode:
• can be used to prevent third-party applications from running automatically.
• Safe mode is designed to allow troubleshooting or remove any unwanted
applications.
• only works on OS 4.6 and higher.
Steps to enabling safe mode:
• Remove and reinsert the BlackBerry® smartphone battery.
• When the red light-emitting diode (LED) light goes out, press and hold the
Escape key as the BlackBerry® smartphone is loading. See KB05470 for the
location of the Escape key.
• When the dialog box appears, click OK.
93
June-19-14
BlackBerry Safe Mode/JVM Error Codes
JVM Error Codes
• It is possible for JVM Errors to occur when interacting with the
underlying BlackBerry® smartphone hardware that is no longer
operating as expected.
• An example of such a failure would be the corruption of the
physical flash memory.
• JVM errors may also occur as a result of software related issues.
• Reloading BlackBerry® Device Software is not option for a device
that is considered to have evidence on it.
• Safe Mode may help you resolve Java Errors
• If Safe Mode does not work, then your only recourse is a chip off
solution (no guarantee of success).
94
June-19-14
BlackBerry: SIM Number Spoofing
Could one edit the phone number assigned to the SIM and spoof’s one
number to appear as something different through the Edit Phone
Number feature?
The author did perform some limited testing on a BlackBerry Bold 9700; OS
6.0.0.448; Platform 6.6.0.124 in May 2012.
• In OS 6 this is found under: Options -> Device -> Advanced System
Settings -> SIM Card.
• Shows SIM ICCID and Phone Number assigned to SIM.
95
June-19-14
Press Menu key to invoke the context options window: Access the
Edit SIM Phone Number function: Options -> Device -> Advanced
System Settings -> SIM Card -> Menu Key -> Edit SIM Phone
Number
96
June-19-14
Phone number is changed by 1 digit: from +14039096120 to
+14039096121
97
June-19-14
New message indicator also appears after edit of SIM phone
number.
98
June-19-14
In the call history screen what appears on the author's private
BlackBerry® device as My Number is: +1 403 909 6121 and not the
carrier assigned number of +1 403 909 6120.
99
June-19-14
A screenshot from a SIM extraction performed only with Cellebrite
UFED shows the MISDN value as +1 403 909 6121. This shows
that the Edit SIM Phone Number function, through the device, will
cause a write to occur to the SIM.
Connecting the device (with SIM in the device) to BlackBerry Desktop

Software, it shows the edited phone number of +1 403 909 6121.
100
June-19-14
• Calls from this number spoofed device, show up as
the original number!
• The device event log was extracted, and shows that a
phone number change did take place.
101
June-19-14
BlackBerry 10
• First released in January 2013 as a Z10; this
was followed by Q10 (keyboard) and then
Z30.
• The BB 10 device essentially comes with
16GB internal flash memory, 2GB RAM and
accepts up to a 32GB memory card and
contains the same basic hardware
infrastructure commonly observed in
smartphones.
102
June-19-14
BlackBerry 10 - Hardware
• The Z10 model is touch screen, and comes in several
sub-variants for its baseband configurations.
• STL100-[1-4]
• The STL100-1, which is non-LTE, uses the ST-
Ericsson Thor chipset with TI OMAP; this uses a
PowerVR SGX 544 GPU.
• The STL100-[2-4] variants, which are all LTE, use

the Qualcomm MSM8960 (Qualcomm Snapdragon
S4 Plus) chipset which are dual core 1.5GHz and
contain an Adreno 225 GPU.
Source: Ralf-Philipp Weinmann., BlackBerry 10 OS from a security perspective, University of Luxembourg, black hat USA 2013 Presentation.
103
June-19-14
BlackBerry 10 - OS
• Runs the QNX (Unix) based operating system and is
considered a micro kernel architecture for embedded
systems in comparison to the Monolithic Android
Kernel.
• The function of the micro kernel
• handle execution of processes passed to it by the
process manager;
• it does not deal with the file system
• and does not contain device drivers.
104
June-19-14
BlackBerry 10 - OS
*Image Source: http://upload.wikimedia.org/wikipedia/commons/thumb/6/67/OS-structure.svg/450px-OS-structure.svg.png from

http://en.wikipedia.org/wiki/Microkernel
105
June-19-14
BlackBerry 10 - OS
• Within the logical file system, QNX is mounted at /pps.

• A number of different functions are running on top of kernel
and user land [4]:
• PIM (Personal Information Manager) certain parts of the
PIM are written in Python.
• Adobe Air and QT are used in some of the apps like
Weather app.
• Android 2.3 Java runtime is present: but you need to
convert APK files into BAR files in order to run Android app
in BB OS 10.
*Sources:
1. Antukh, A., BlackBerry Z10 Research Primer: Dissecting BlackBerry 10 – An initial analysis, SEC Consult Vulnerability Lab, Vienna, 05/2013, V 1.0 Whitepaper
2. Plasket, A., Is BlackBerry Dead? An Introduction to Blackberry 10 Security (BB10 - QNX), MWR InfoSecurity, PowerPoint Presentation
3. Lanier, Z., & Nell, B., Voight-Kampff'ing The BlackBerry PlayBook, Intrepidus Group Mobile Security, PowerPoint Presentation
Blog: http://blog.n0where.org/2012/04/voight-kampff-blackberry-playbook.html
4. Ralf-Philipp Weinmann., BlackBerry 10 OS from a security perspective, University of Luxembourg, black hat USA 2013 Presentation.
106
June-19-14
BlackBerry 10 - OS
QNX firmware contains the following unique
artifacts from analysis perspective [1,2]:
• File header: mfcq (ASCII), 6d 66 63 71h
• Partition header: qcfp (ASCII), 71 63 66 70h
• There are a number of partitions that follow the
follow the file header; in the BlackBerry
Playbook for example, 5 QCFP partitions are
observed in the firmware.
Sources:
1. Antukh, A., BlackBerry Z10 Research Primer: Dissecting BlackBerry 10 – An initial analysis, SEC Consult Vulnerability Lab, Vienna, 05/2013, V 1.0 Whitepaper
107
June-19-14
BlackBerry 10 – OS Permissions
• Permissions in QNX in BB OS 10 are handled by 'authman'
which is located at /etc/authman/sys.acl [2,3,4].
• Applications are installed to /apps and they cannot read
another application's code or data; this is controlled by
'authman' [2].
• Application permissions are handled by authman:
permission categories allow, prompt and deny [2,3].
• Allow: identified apps can use the permission assigned to
them.
• Prompt: the app must prompt the user first.
• Deny: the app cannot use a capability.
Sources:
2. Plasket, A., Is BlackBerry Dead? An Introduction to Blackberry 10 Security (BB10 - QNX), MWR InfoSecurity, PowerPoint Presentation
4. Ralf-Philipp Weinmann., BlackBerry 10 OS from a security perspective, University of Luxembourg, black hat USA 2013 Presentation.
108
June-19-14
BlackBerry 10 – Security
1. The BlackBerry device contains the same foundation of
security feature as observed in BB OS 7:
• Password Protection
• Encryption for device and/or memory card
• Device wipe for device and/or memory card
2. BlackBerry ID: The device user is asked to create or sign in

with their BlackBerry ID before they can go any further into the
device on first setup.
3. BlackBerry Protect: This comes installed as part of the

operating system and a BlackBerry ID is required for this
feature to work. This allows device geo location, device
wiping, and device backup/restore.
109
June-19-14
4. Application Permissions: This lets the user control
what an application can access. Permissions settings for
applications are located in: Settings -> Security and
Privacy -> Application Permissions.
5. If the device is attached to a BES 10, the BlackBerry

Balance feature can be applied to the BlackBerry 10
device allowing separation of work and personal areas.
This separation allows the BES administrator to easily
remove the data from the workspace without affecting
the personal space.
110
June-19-14
6. From an operating system security perspective the
BlackBerry 10 has the following exploit mitigation measures
[4]:
• DEP/XN (Data Execution Prevention)
• ASRL (Address Space Randomization Layout),
• PIE (Position Independent Execution),
• full RELRO (RELocation Read Only): see this link for an
explanation about RELRO http://tk-
blog.blogspot.ca/2009/02/relro-not-so-well-known-
memory.html
• But no heap hardening.
Source: 4. Ralf-Philipp Weinmann., BlackBerry 10 OS from a security perspective, University of Luxembourg, black hat USA 2013 Presentation.
111
June-19-14
BlackBerry 10: Picture Password
Picture Password:
• Introduced in in OS 10.2.1.
• Uses a number combination of 0-9 and a picture to lock
and unlock the device.
• Requires a device password to be set in case you forget
your Picture Password or if you need to access your
device from a computer using BlackBerry Link.
• After five failed attempts to unlock your device using
Picture Password you’ll be prompted for your device
password instead.
112
June-19-14
Source: http://n4bb.com/wp-content/uploads/2013/11/Picture-Password.jpg
113
June-19-14
• To unlock the device you drag
the number you have chosen,
to the specific point on the
picture you have chosen.
• You do not need to tap the
number. The number is moved
by sliding the number grid so
the number you have chosen is
in the correct place on the
picture.
• Difficult to ascertain what your
password is as the numbers
and size of the grid varies each
Image Source: https://encrypted-
time. tbn3.gstatic.com/images?q=tbn:ANd9GcTDqcTcNqszN1lNz
OEt4k3DiQ8SOd9winkCQfeDPHASWEZ4hSNe
114
June-19-14
BlackBerry 10 – EScreen
• BlackBerry 10 also has an engineering screen, or
EScreen which is invoked in a very similar manner to
its predecessors.
• Several websites that show how to do this: one is
http://crackberry.com/how-access-engineering-
screen-blackberry-10
115
June-19-14
116
June-19-14
• One interesting aspect of the engineering screen is
Remote Log Collection.
• On the device user first has to manually enable
diagnostic and usage data collection under Settings-
>Privacy & Security -> Diagnostics.
• The feature ‘Send diagnostics and usage data’ is set
to ‘Off’ by default. The data collected by this function
is tied to the settings that are enabled in the QUIP
Remote Log Collection.
117
June-19-14
• A screenshot shows the QUIP Remote Collection features. By
default this is not enabled and what you are seeing are not
default settings.
*Image Source: Ralf-Philipp Weinmann., BlackBerry 10 OS from a security perspective, University of Luxembourg, black hat USA 2013
Presentation.
118
June-19-14
• With Diagnostics enabled in the Settings-
>Privacy & Security -> Diagnostics AND
• Remote Diagnostics and Log Capture turned

on, different types of data can be collected
which includes: screen captures, raw
memory dumps, audio, video, and GPS
location.
*Image Source: Ralf-Philipp Weinmann., BlackBerry 10 OS from a security perspective, University of Luxembourg, black hat USA 2013 Presentation.
119
June-19-14
BlackBerry 10 Connected to Windows 7 or Mac OS X
• When a password protected BlackBerry 10 device
connects to the computer, regardless of operating
system, the user will be prompted to enter the
password in BlackBerry Link.
• The total number of password attempts is 5. In

contrast BB OS 7 and lower devices with
BlackBerry Desktop Software are allowed 10
attempts.
120
June-19-14
• BlackBerry 10 devices can be accessed over Wi-
Fi using BlackBerry Link software on Windows or
Mac; this allows the ability to sync multi-media
content, and documents between the device and
computer over Wi-Fi instead of USB.
• By default the option to connect the

BlackBerry device to BlackBerry Link over Wi-
Fi is enabled. Disabling this feature within
BlackBerry Link does not affect the Wi-Fi settings
on the device.
121
June-19-14
• Within the BlackBerry Z10 device specifically under
‘Storage and Access’ the device can be accessed using
Wi-Fi through either a Windows or Mac OS X computer.
• This is disabled by default on the device and is different

than the Wi-Fi access via BlackBerry Link. If this is
enabled on the device, the user will be prompted to create
a Password Wi-Fi Storage Access.
122
June-19-14
Image Source: http://helpblog.blackberry.com/2013/03/copy-z10-files-wifi/
123
June-19-14
• When a BlackBerry Z10 device connects to a Windows
machine, two network drive locations were mounted on the
author's machine; they are recognized as NTFS file
systems by Windows 7.
124
June-19-14
• If the device is password protected, the password must be
entered on the first instance of connecting, within
BlackBerry Link, before the volumes will be mounted.
125
June-19-14
• Using the BlackBerry Device Manager Properties,
Connected Devices tab, we can see that Volume Z is
internal memory and Volume Y is the Removable SD card.
126
June-19-14
• The internal volume (Z:) contains two more folders: misc
and print.
127
June-19-14
• When a BB 10 device connects to this Mac OS X the following
volumes are mounted:
• media, dtm and if the device contains a removable SD card this
too will be mounted.
• In terminal the 'mount' command was run which identifies the

mounted volumes, which shows 3 volumes mounted in Mac OS X.
//[email protected]/removable_SDCARD on
/Volumes/removable_SDCARD (smbfs, nodev, nosuid, mounted
by qubyte)
//[email protected]/media on /Volumes/media (smbfs,

nodev, nosuid, mounted by qubyte)
//[email protected]/dtm on /Volumes/dtm (smbfs, nodev,

nosuid, mounted by qubyte)
128
June-19-14
• The 'smbfs' indicates Samba file system which is accessed
over a network path a
smb://169.254.251.197/volumename.
• Because it recognized as a network share, even though it
contains an NTFS file system, the Mac OS X system can
also write to it. If this were mounted as block device, the
user would not be able to write to either drive natively
because contains an NTFS file system.
• Backup files on a Mac OS X are stored to the following
location:
• /volumename/Users/username/Documents/BlackBerry
Backups
• A synchronization folder for multimedia content will also
be created usually in the same path location:
/volumename/Users/username/Documents.
129
June-19-14
BlackBerry 10: Log Files
• BlackBerry 10 log files can be collected using the
BlackBerry Link Software:
• Checking the ‘Gather extra log information’ requires the

BlackBerry 10 or Blackberry Playbook to be connected to
BlackBerry Link. This is how event logs are obtained from these
devices.
130
June-19-14
• The log file (from a BlackBerry Playbook) is stored in a
ZIP archive format to the desktop of the computer in
this case.
131
June-19-14
• Device717264340-201310211249.pb archive
contents.
• The filenames are prefixed with a UNIX epoch time value in decimal and
contain an 'aes' extension, which is likely indicative of AES encryption.
132
June-19-14
BlackBerry 10 – Backups
• BlackBerry 10 device backups can be created ONLY
using BlackBerry Link for Windows and Mac (this
does not include any third party tools capable of
creating backups).
• For the BlackBerry Playbook, both BlackBerry
Desktop Software and BlackBerry Link for Windows
and Mac can be used.
• The resultant files are identified with a ‘.bbb’
extension.
133
June-19-14
BlackBerry 10 – BBB Files
• The BBB files are ZIP archives that contain two child files
and one child folder called ‘Archive’.
• Two files: these two files do not get encrypted during the
backup process, at the present time.
• PkgInfo: Contents of this file can also be viewed in a text or
notepad type editor as shown below.
BlackBerryBackupFormatV2.0.0
Research In Motion
http://www.blackberry.com/
http://www.rim.com
1726dfe6f5336a9f1a3da1ceb11ecb69
134
June-19-14
• Manifest.xml for a BlackBerry Playbook:
• <?xml version="1.0" encoding="UTF-8"?>
<BlackBerry_Backup>
<Client platform="windows" osversion="Microsoft Windows NT 6.0.6002 Service Pack 2"
dtmversion="6.1.0.35" />
<Version>2.0</Version>
<Encryption type="RIM_AES_CBC" version="1.0" Salt="" />
<SourceDevice pin="500F54B8" hwid="6001A06">
<Platform type="QNX" version="1.0.7.2670" />
</SourceDevice>
<QnxOSDevice>
<Archives>
<Archive id="app" name="Application Data" count="51" bytesize="541257216" />
<Archive id="media" name="Media" count="11" bytesize="1728000" />
<Archive id="settings" name="Settings" count="994" bytesize="1368064" />
</Archives>
</QnxOSDevice>
</BlackBerry_Backup>
135
June-19-14
• Manifest.xml for a BlackBerry 10:
• Note the ‘keyid=‘ value, which is the BlackBerry 10
user’s BlackBerry ID value as an email address
136
June-19-14
• Within the ‘Archive’ folder three TAR files are present:
apps.tar, media.tar and settings.tar.
• The contents of these files are encrypted regardless
of which BlackBerry backup software was used and
regardless of the device being password protected or
not.
• The decryption of the BBB cannot be disabled from
within the software or the device.
• The TAR files headers differ between the Playbook
and BlackBerry Z10.
137
June-19-14
BlackBerry 10 – Playbook TAR Header
• File Header: This consistently appears in all
three TAR files regardless of software used or
the OS platform the BBB is generated on.
• 51 4E 58 00 30 00 00 00 00 00 00 00 31 38
36 61 h
• 'QNX 0 186a' in ASCII; the gap between

the '0' and the start of '186' is separated by 7
null values or 0x00.
138
June-19-14
BlackBerry 10 – Playbook TAR Header
139
June-19-14
BlackBerry 10 – Z10 TAR Header
• File Header: This consistently appears
in all three TAR files regardless of
software used or the OS platform the
BBB is generated on.
• 50 45 52 00 31 00 00 00 00 00 00 00
31 38 36 61 30h
• 'PER 1 186a0' in ASCII; the gap

between the '0' and the start of '186'
is separated by 7 null values or 0x00.
140
June-19-14
BlackBerry 10 – Z10 TAR Header
141
June-19-14
BlackBerry 10: Data Extraction/Analysis
• Oxygen Forensics has a solution in place for
the BlackBerry 10 backups.
• UFED can acquire limited amount of data at

this time. This may improve in future versions.
• A chip off dump of the BB 10 device is

encrypted at the chip level, as discovered by
Bob Elder.
142
June-19-14
BlackBerry 10: BBB Backup File
• Oxygen Forensic Suite (OFS) Analyst 6.1.x
and higher can parse a BlackBerry 10 backup
file:
• provided you know the password to the
device owner's BlackBerry ID account
(which may or may not be the same as the
device password).
143
June-19-14
BlackBerry 10 Backup Files with OFS
• Import the BBB file using either File -> Import or the
Oxygen Forensic Extractor.
144
June-19-14
Once you have selected the backup file, OFS will identify the
email account used by the device owner to access his/her
BlackBerry ID account. The password to the BlackBerry ID
account will be required in order for OFS to decrypt the backup
and subsequently parse the data.
145
June-19-14
• OFS decrypting BBB TAR files with QBEK Key.
• The QBEK Key is associated to the urn:bbid:backupandrestore

key [7,8]:
• urn = uniform resource name
• The remainder of URN syntax consists of the namespace-identifier
(NID), separated by a colon, and then the namespace-specific
string (NSS).
• The BlackBerry ID is associated to the encryption of the BlackBerry

10 backup.
146
June-19-14
• End result of decryption and parsing
147
June-19-14
• The File Browser feature allows you to export the
folders/files out of OFS for use in other forensic tools like
UFED PA or XWF.
148
June-19-14
BlackBerry 10 Backup Structure
The BlackBerry logical file system data consists
of the following types:
• SQLite databases in .db and .dat format
• XML files
• INI files
• BIN files
• And various other types of files whose
contents are in plain text such as .conf files.
149
June-19-14
The three TAR files when decrypted consist of
three folders: app, media and settings:
150
June-19-14
app Folder
This folder contains the applications that are on the
device, containing folders with long names.
151
June-19-14
app Folder
• Naming convention follows as:
• com.XXXX.gYABG string
• sys.XXXX.gYABG string
• The XXXX = resource or application name then followed by

a gYABg, which appears to an obfuscated string of
alphanumeric characters.
• Expanding the folder structure shows that in almost all, if
not all, folder sub paths, there is an folder structure as:
• /com.resrouce.gYABg string/appdata/data
152
June-19-14
media Folder
This folder contains the storage areas for user created
content, and downloaded content as shown below.
153
June-19-14
• Be cognizant that all BlackBerry 10 smart phone
devices come with an microSD memory card, which
will contain a similar directory structures as shown
below.
154
June-19-14
settings Folder
This folder contains the storage areas for the user
account, system/device settings and var (variable data)
folders with subfolders.
155
June-19-14
BlackBerry 10 PIM Data
• Refers to personal information organized in a range of
different application functions such as calendar,
emails, address/contact book, tasks, and reminders.
• /app: subfolders contained in various sub-folders,
is found under the following sys.pim folders.
156
June-19-14
BlackBerry 10 PIM Data
• /settings/accounts/1000/sysdata/pim
157
June-19-14
BlackBerry 10 PIM Data - Calendar
• 1-pim.db located at:
• \settings\accounts\1000\sysdata\pim\db.
• CalendarEvent table
• Time values: two time stamp columns in

human readable time, stored relative to
UTC/GMT.
158
June-19-14
BlackBerry 10 PIM Data - Contacts
• 2-pim.db located at
• \settings\accounts\1000\sysdata\pim\
db.
• The information related to a contact is

spread across these various tables.
159
June-19-14
BlackBerry 10 PIM Data - Call History/Call Log
• Two tables, 'Call' and 'CallDetail' contain

similar records; both tables should be
analyzed and cross-referenced to detect
differences in the data contained therein.
• Time values stored in human readable time,

stored relative to UTC/GMT.
160
June-19-14
BlackBerry 10 PIM Data – Tasks/Reminders
• On the BlackBerry device this data is classified under

the 'Remember' application.
• Time values stored in human readable time, are

presumed to be stored relative to UTC/GMT.
161
June-19-14
BlackBerry 10 - SMS/MMS
• messages.db located at
• \settings\var\db\text_messagingsettings\.
• Message content in the Attachments table.
• Timestamp values in Messages table under timeStamp

and creationDate columns are stored as 13 character
decimal value, which is a Unix epoch time stamp.
• the inbound fields in the Messages table:0 = sent
message, and 1 = received message.
• the senders name address for sent messages are empty,
and the sendersid value is negative integer, -1.
162
June-19-14
BlackBerry 10 – BBM
• the master.db located at
• \sys.bbm.gYABgLOJBR2Vz7FzS.kdgJchuag\appdata\
data.
• BBM avatar picture resides the in the photos subdirectory,
and is named using the BlackBerry PIN value of the
device.
• Timestamp field is a 10 character decimal value
(compared to the 13 digits for text messages), which is
Unix epoch time.
• Because BBM allows voice and video chat, these events
are also stored in the messages.db; the CallEventId field
assigns an incremental decimal value for the start and end
of each voice or video chat.
• IsInbound value: 0 = sent message, and 1 = received
message
163
June-19-14
BlackBerry 10 – BlackBerry Hub (BBH)
• The BlackBerry Hub includes: call log, voicemail
notification, email, sms, mms, social networking
notifications, BBM, instant messaging, BBM calendar
events, and notifications.
164
June-19-14
• BBH unintentionally acts as timeline of activity of the
BlackBerry 10 device, as it includes data from a
number of application areas.
• Path:
\sys.pim.messages.gYABgJ8jn83Ok_NEWYplPYozt5
w\appdata\data\unfied.db
165
June-19-14
• The unified.db database holds some excellent artifacts such as:
• Type: identifies the application such as callog, whatsapp, sms,
notification, bbm.
• TimeStamp: 13 character decimal value, Unix epoch time.
• IconPath: indicates the status of the data such as

• sms_read
• phone_missed
• phone_outgoing
• phone_incoming
• bbm_read
• notification_read
166
June-19-14
BlackBerry 10 – Internet
• The Internet history artifacts are stored in several areas within
the backup structure.
• Internet Artifacts Location 1:
\app\sys.browser.gYABgJYFHAzbeFMPCCpYWBtHAm0\appdata\data\
chrome\database\Databases.db
• This file identifies the name of three databases, so next we examine the
database files listed in the path field, which are all stored in the same
sub directory structure.
167
June-19-14
• Carrier bookmarks = 0000000000000001.db: this contains the
carrier provided website bookmarks.
168
June-19-14
• Bookmarks and History = 0000000000000002.db: this contains
the device user's Internet history and user bookmarks:
• The history table, urlKey field, is related to the urls table id field
169
June-19-14
• Permissions = 0000000000000003.db: this database contains
permissions that are assigned to it by the device user.
• In this case, it appears as though the Google Maps URL has
been given permission to access the device, based on the allow
value of 1. The value of 0 = not allowed.
170
June-19-14
• The next file of interest is the local__0.localstorage SQLite file located at:
\app\sys.browser.gYABgJYFHAzbeFMPCCpYWBtHAm0\appdata\data\chro
me
• This contain the browser settings in the local__0.localstorage SQLite
file.
171
June-19-14
• The areas of interest are the files and folders stored in the path
at:
\app\sys.browser.gYABgJYFHAzbeFMPCCpYWBtHAm0\appdata\da
ta\webviews
172
June-19-14
• Browser cache files are stored at the path:
• \app\sys.browser.gYABgJYFHAzbeFMPCCpYWBtHAm0\appdat
a\data\webviews\cache
• \app\sys.browser.gYABgJYFHAzbeFMPCCpYWBtHAm0\appdat
a\data\webviews\cache\[data_1|data_2|data_3]
• The cache can also include Google Map tiles that are cached when
accessing Google Maps for location and map information from the
device.
173
June-19-14
Cache Example: this google map tile shows an area of northwest
Edmonton AB along the ring road, Anthony Henday Dr.
174
June-19-14
• The file system time stamps from XWF 17.5 SR6 show that the
file was created on 2013-09-30 07:44:53 -6. During that week
the author (along with another colleague) was in Edmonton,
attending an X-Ways Forensics Class!
• By looking at the remainder of the google map tile files, and the
proximity of the time stamps for the surrounding google map
tiles, an inference can be drawn as to where the device (and
possibly the device owner/user) was.
175
June-19-14
• Examining the subfolder below the cache, which is the data_1
(and the remaining ‘data_X’ folders, we can see that it contains
search query strings.
176
June-19-14
• This location path contains cached web based email
content, stored in SQLite databases.
• Path:
\app\sys.browser.gYABgJYFHAzbeFMPCCpYWBtHA
m0\appdata\data\webviews\database
177
June-19-14
• In the root of the database folder there is a

Databases.db which identifies the email account
relative to its corresponding database file.
178
June-19-14
• 0000000000000001.db:
• The tables contain time values as Unix epoch time, from 13 – 16
decimal characters in length.
179
June-19-14

• This path location contains the visited URL's accessed
by the device.
• Path
\app\sys.browser.gYABgJYFHAzbeFMPCCpYWBtHAm0
\sharewith\search
180
June-19-14
BlackBerry 10 – Pictures
• Several categories of pictures that can be found on the
Blackberry 10 device.
1. First category is user created pictures taken with the
BlackBerry 10 device:
• Under 'Camera Settings' if the 'Save on Media Card is 'On' then
device created pictures are saved to the memory card under the
path /sdcard/camera.
• If the 'Save on Media Card' is set to 'Off' then the device created
pictures are saved to the device memory at /media/camera.
• Under 'Camera Settings' if the 'Geotag Pictures' is 'On' this will add
the device's GPS location to the pictures, provided that it can
receive the GPS signal.
181
June-19-14
2. Second category is device created screenshots.
• This refers to the device user taking a screenshot of the contents being displayed
on the BlackBerry 10 device by pressing the Volume Up AND Volume Down
buttons. There is no EXIF data present in a BlackBerry 10 PNG screenshot
picture.
• The image is saved as a PNG file in the \media\camera, NOT the memory card
regardless of the 'Camera Settings' -> 'Save on Media Card is 'On' feature.
• The PNG file name will be IMG_YYYYMMDD_XXXXX.PNG and contains the
date and time the PNG file was created.
• YYYYMMDD = 4 decimal values to represent year, 2 decimal values to
represent, 2 decimal values to represent day.
• X = time in 24 hour format down to seconds.
182
June-19-14
3. Third category is pictures stored in /sdcard/photos or /media/photos.
• The author has observed the /media/photos folder location will store
pictures transferred, during an upgrade from an older BlackBerry device
that contains pictures, to a BlackBerry 10 device.
• The file name convention of a WA image contains a date value as

YYYMMDD followed by WAXXX, where the XXX is a 3 digit numeric
sequence.
• The date value will match the date the picture is received by the device.
• The images are stripped of any of the usual EXIF data.
183
June-19-14
BlackBerry 10 – EXIF Pictures
EXIF Summary
1. BlackBerry 10 software 10.2.1.2141:
• Embeds the date and time value, local to device time, within the file
name of the picture created using the Camera application of the
device.
• Now adds the Model value of BlackBerry Z10 within the EXIF, which
was not done prior to 10.2.1.2141.
• If the BlackBerry 10 device OS was less than 10.2.1.214, the file

name convention DOES NOT contain date or time value. It is
formatted as IMG_ XXXXXXXX.JPG, where XXXXXXXX equals an
8 character, sequential numeric value.
184
June-19-14
EXIF Summary
2. Regardless of the BlackBerry 10 OS version, within the EXIF,
there is a unique string value, 'RIM0RD00' in pictures created with
the camera application. I refer to this as the ‘MNUT Value’.
185
June-19-14
EXIF Summary
3. Pictures, taken with a BlackBerry Z10, viewed on the memory
card, through the device, under the camera folder, appear to show a
Modified Date value with wrong offset calculation being applied.
As an example we are going to look at file properties of the
following files as displayed by the BlackBerry Z10:
• IMG_20140314_215602.jpg: As the filename indicates, the
picture was taken with a BlackBerry Z10 on 2013-03-14,
21:56:02, local device time.
186
June-19-14
EXIF Summary
3. The 'Modified Date' value is shown with a minus 6 hour
difference in time relative to the filename time value.
• offset should be 6 hours (plus 6 hours) ahead of

the filename time value, so the Modified Date
value should show as Mar 15, 2014 at 3:56:02 AM.
• offset is being calculated in the wrong direction, if

the intent is to show the Modified Date value in
UTC.
187
June-19-14
EXIF Summary
3. ExifTool 9.56 output of IMG_20140314_215602.jpg.
188
June-19-14
EXIF Summary
4. The time values that are within the EXIF data of pictures created
with BlackBerry Z10 device contain the time values of picture
creation relative to the device's local time.
5. GPS data is present in EXIF so long as that option is enabled in
the Camera settings and the device can receive the GPS signal. In
the screens shots below the GPS Lat and Long values have been
sanitized.
189
June-19-14
BlackBerry 10 – Movies
There are several categories of movies that can be found on the
Blackberry 10 device.
1. First category is user created movies taken with the BlackBerry
10 device:
• Under 'Camera Settings' if the 'Save on Media Card is 'On' then
device created movies are saved to the memory card under the
path /sdcard/camera.
• If the 'Save on Media Card' is set to 'Off' then the device created
pictures are saved the device memory at /media/camera.
190
June-19-14
2. Second category is movies stored in /sdcard/videos or
/media/videos.
• These locations are believed to contain content downloaded by
the device or sent by messaging to the device.
• Note the file naming convention difference between first and

second file indicates the MP4 files were created with two
different BlackBerry 10 operating system versions. This follows
the same pattern as was noted with the pictures.
191
June-19-14
VID_20140315_101232.mp4
• This movie file was created on 2014:03:15 10:12:54 -06:00.
192
June-19-14
BlackBerry 10 – EXIF Movies
EXIF Movie Summary
• File format or file type is mp4.
• The EXIF time values are stored in UTC relative to the local
device time zone offset.
• There is no indication the movie files are created with a

BlackBerry device compared to BlackBerry 7 and lower where
movie files had a string value in the EXIF called 'rimm'.
• Naming convention, in BlackBerry 10 device lower than

10.2.1.214, will not include the date and time local to the device
in the file name.
• No geo-data is present in a movie file created with the

BlackBerry 10.
193
June-19-14
BlackBerry 10 – Settings: BBM PROFILE CORE
The profile file stores the device user's BBM profile information.
• Artifact Path: \settings\pps\services\bbmcore\profile
• The 'registrationId' value is 12 decimal characters in length.
194
June-19-14
BlackBerry 10 – Settings: BP2P DEVICES
This stores the devices the BlackBerry 10 has connected with.
• Artifact Path: \settings\pps\services\bp2p\devices
195
June-19-14
BlackBerry 10 – Settings: IMSI VALUE
IMSI value is found in the status_private file:
• Artifact Path: \settings\pps\services\cellular-voice
service\status_private
196
June-19-14
BlackBerry 10 – Settings: TIMEZONE
Time Zone Artifact 1:
Artifact Path: \settings\pps\services\clock\status
Time Zone Artifact 2:

Artifact Path: \settings\pps\services\confstr\ _CS_TIMEZONE
197
June-19-14
BlackBerry 10 – Settings: DATE & TIME
Stores the device date & time settings.
• Artifact Path: \settings\pps\services\network-time
The status file, shown in the above screenshots contains the settings for:
• auto_time value = Set Date and Time Automatically is set to 'On' in Date and
Time settings on the device.
• auto_zone value = Auto Update Time Zone is set to 'On' in Date and Time
settings on the device.
• The last_update value is a 10 character decimal value, Unix epoch time.
198
June-19-14
BlackBerry 10 – Settings: HOSTNAME
Contains the device name.
• Artifact Path: \settings\pps\services\confstr\ _CS_HOSTNAME
199
June-19-14
BlackBerry 10 – Settings: PHONE NUMBER
Phone number used by BlackBerry 10
through its SIM.
• Artifact Path: \settings\pps\services\phone\
• This folder path contains 3 sub folders each
contain files with names ‘vchat’ and ‘cellular’.
• The path shown below contains vchat and
cellular files.
\settings\pps\services\phone\private\lines
200
June-19-14
• vchat file contains the PIN number.
201
June-19-14
• cellular file contains a number of interesting artifacts, which
includes the phone number, voicemail passcode, and the value
that caller identify is restricted.
202
June-19-14
BlackBerry 10 – Settings: NETWORK NAME
There are two files that contain the network operator name:
navigator_status and status_public.
• Artifact Path: \settings\pps\services\rum\csm
203
June-19-14
BlackBerry 10 – Settings: CAMERA
The status file stores save location of the data created using
the Camera application, and also records the filename of the
last captured file.
• Artifact Path: \settings\pps\system\camera
204
June-19-14
BlackBerry 10 – Settings: DEVICE MODEL NAME
AND MODEL NUMBER
The device properties file stores the device model name and
model number information.
• Artifact Path: \settings\pps\system\restricted
205
June-19-14
BlackBerry Forensics - CONCLUSION
• BlackBerry 7 and lower versus BlackBerry 10/BlackBerry
Playbook: Two different schisms.
• BB7 (proprietary JVM) has no real file system from a
physical level perspective compared to its BB10 (QNX)
successor.
• BB 10 backup files are encrypted by default using
BlackBerry Link.
• Remember to validate what you have observed in this
presentation, as there is no official support from BlackBerry
on the interpretation of any BB7 or BB10 artifacts.
• And finally – thanks for your patience and looking through
all the slides! 
206
June-19-14

5 Punja Nist 2014 BB Forensics FULL PDF

Uploaded by

Copyright:

Available Formats

5 Punja Nist 2014 BB Forensics FULL PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

5 Punja Nist 2014 BB Forensics FULL PDF

Uploaded by

Copyright:

Available Formats

Blackberry Forensics

NIST Mobile Forensics Workshop June 2014

- Option 2:Attack info.mkf file on memory card

- Option 3: Chipoff (maybe JTAG which might

- NOT present in the backup IPD file or any other

- According to BlackBerry there is no backdoor into

- BlackBerry, may or may not help you in accessing

- BES stores daily logs in folders under default path C:\Program

- Depending upon BES version there may be over 15 or so different

- By default only PhoneCall logs are enabled on BES 5 and lower. In

- If BlackBerry is locked AND if memory card is encrypted with

- Then a hidden file info.mkf on the memory card at

- EPPB attacks/exploits this file to obtain the password to the

- When an upper case character is

- So it might be worth while obtaining a

- Consists of device disassembly, chip removal,

- This is destructive process to the device: you

- If BlackBerry device is attached to a BES, and you don’t have access to

- Only tool that will obtain a physical read of the NAND

- This is done using a bootloader injection, into the

- This is the only way to obtain deleted artifacts and

- Resulting BIN file is opened in UFED PA for analysis.

- Process that I recommend typically is

- Reason: to limit wear leveling functions on

BUT……This could happen to you if you go after

So what happened to our unfortunate DFIR colleague?

3. Could the bootloader injection have inadvertently triggered a device

What actually happened (cited from the listserve email):

- Blackberry 9630, on Enterprise network, not used for more than

- Connected to a charger, and as soon as it came to life, disabled

- Close to the end of the process Cellbrite displayed a message,

What actually happened (cited from the listserve email):

- …good news is that all the data was collected by Cellebrite,

- Cellebrite’s explanation: Cellebrite installs a client on the phone

- Don’t forget about using BlackBerry Desktop

- These tools connect to BlackBerry over

- IPD File(Inter@ctive Pager Backup): This is a

- BBB File: v1 created by Mac version of BlackBerry

- BBB File: v2 created by Windows version of

- The number of DAT files present in the Databases folder should

• The Win Hex/X-Ways Forensics Manual (1995-2006 Stefan Fleischmann), page

• Java Date/1000 = Unix Timestamp

• This is also referred to as the BlackBerry® Date

• Precision to only the number of minutes.

• Yogesh Khatri cites this formula to obtain the unix time

- In the IPD structure both BE and LE ordering are used.

- The only fields that are identified by BlackBerry

- BlackBerry devices that cannot use BlackBerry Messenger

- BBM Chat CSV File: Date/Time is 21 digit numeric value

• Only one tool currently parses this right now – UFED

• If the record is a picture, then it extracts the thumbnail that is stored

- The KEY file is like an index table that contains

- The record in the DAT file contains images and

- 2. bbt.exe (Windows executable): Based on

- 4. Commerical Tools: UFED PA, Oxygen Forensic Suite

- the file name is typically xxxxart.dat where

- The xxxxxart.dat files are SQLite format 3

- voicenotes: none observed.

- BEST Exif Analysis Tool of Choice: ExifTool