Difference between pages "Upcoming events" and "Damaged SIM Card Data Recovery"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(Conferences)
 
 
Line 1: Line 1:
<b>PLEASE READ BEFORE YOU EDIT THE LISTS BELOW</b><br>
+
== Summary ==
When events begin the same day, events of a longer length should be listed first.  New postings of events with the same date(s) as other events should be added after events already in the list. Please use three-letter month abbreviations (i.e. Sep, NOT Sept. or September), use two digit dates (i.e. Jan 01 NOT Jan 1), and use date ranges rather than listing every date during an event(i.e. Jan 02-05, NOT Jan 02, 03, 04, 05).<br>
+
<i>Some events may be <u>limited</u> to <b>Law Enforcement Only</b> or to a specific audience.  Such restrictions should be noted when known.</i>
+
  
This is a BY DATE listing of upcoming events relevant to [[digital forensics]].  It is not an all inclusive list, but includes most well-known activities. Some events may duplicate events on the generic [[conferences]] page, but entries in this list have specific dates and locations for the upcoming event.
+
A prerequisite for the use of SIMIS, is that the SIM card must be functional. A physically damaged, broken or dirty SIM may not function correctly, resulting in the recovery of corrupted data, or no data at all. In the forensic data recovery environment, SIM's will be presented in a variety of different conditions, ranging from good, but lightly soiled, through blood soaked to physically broken. Lightly soiled and blood soaked SIM's may be cleaned using appropriate methods, ensuring that the SIM is not further damaged taking care to preserve surface printing where possible.
  
This listing is divided into three sections (described as follows):<br>
+
However, physically damaged or broken SIM's require more specialised processing to produce a viable SIM for data recovery purposes. Crownhill has extensive experience in the area of SIM data recovery through its activity in the SIM manufacturing process. Crownhill works directly with the SIM silicon manufacturers and SIM card manufacturers. Processes developed to aid fault analysis and qualitative measurements are an invaluable advantage when attempting to repair and recover data from physically damaged SIM modules.
<ol><li><b><u>[[Upcoming_events#Calls_For_Papers|Calls For Papers]]</u></b> - Calls for papers for either Journals or for Conferences, relevant to Digital Forensics (Name, Closing Date, URL)</li><br>
+
<li><b><u>[[Upcoming_events#Conferences|Conferences]]</u></b> - Conferences relevant for Digital Forensics (Name, Date, Location, URL)</li><br>
+
<li><b><u>[[Training Courses and Providers]]</u></b> - Training </li><br></ol>
+
  
== Calls For Papers ==
+
Crownhill have invested in purpose-built laboratory facilities to provide professional card cleaning, data recovery and card repair service. Based in discrete, secure premises, Crownhill can provide the full compliment of services required to clean, repair and recover data from damaged SIM's. Drawing on its own expertise and relationships with Card manufacturers and silicon vendors world-wide, Crownhill have created a centre of excellence for this specialised work. An overview of the procedures can be found here
Please help us keep this up-to-date with deadlines for upcoming conferences that would be appropriate for forensic research.
+
  
{| border="0" cellpadding="2" cellspacing="2" align="top"
+
Where a SIM is thought to be functional, Crownhill can provide a SIM cleaning service. Blood, soot, general soiling and body fluids are handled in an environmentally secure fashion, relieving the client of responsibility for Bio Hazards and other Health and Safety issues. Cleaned SIM's are returned without undue delay, ready for data recovery by the client. Cleaning by Crownhill must be carried out after the SIM has been pre-processed for any physical evidence required, such as Photography and DNA sampling.
|- style="background:#bfbfbf; font-weight: bold"
+
Data Recovery Process
! width="30%|Title
+
! width="15%"|Due Date
+
! width="15%"|Notification Date
+
! width="40%"|Website
+
|-
+
|7th International Conference on IT Security Incident Management & IT Forensics
+
|Oct 29, 2012
+
|Jan 03, 2013
+
|http://www1.gi-ev.de/fachbereiche/sicherheit/fg/sidar/imf/imf2013/cfp.html
+
|-
+
|IEEE Symposium on Security & Privacy
+
|Nov 14, 2012
+
|Jan 28, 2013
+
|http://www.ieee-security.org/TC/SP2013/cfp.html
+
|-
+
|FIRST Conference
+
|Dec 2012
+
|Feb 2013
+
|http://conference.first.org/2013/
+
|-
+
|The 1st ACM Workshop on Information Hiding and Multimedia Security
+
|Jan 25, 2013
+
|Apr 02, 2013
+
|http://ihmmsec.org/index.php/call-for-papers
+
|-
+
|International Workshop on Cyber Crime
+
|Feb 15, 2013
+
|Mar 01, 2013
+
|http://stegano.net/IWCC2013/
+
|-
+
|28th IFIP TC-11 SEC 2013 International Information Security and Privacy Conference
+
|TBD
+
|TBD
+
|http://www.sec2013.org/Submissions.aspx
+
|-
+
|}
+
  
See also [http://www.wikicfp.com/cfp/servlet/tool.search?q=forensics WikiCFP 'Forensics']
+
== Data Recovery Process ==
  
== Conferences ==
+
If our findings suggest that data recovery is likely to be possible, the SIM may further examined by real time X-ray, to determine the extent of the damage. Specifically we will be looking for broken or damaged wire bonds, detachment of the silicon die and possible fractures of the die.
{| border="0" cellpadding="2" cellspacing="2" align="top"
+
|- style="background:#bfbfbf; font-weight: bold"
+
! width="40%"|Title
+
! width="20%"|Date/Location
+
! width="40%"|Website
+
|-
+
|7th IEEE LCN Workshop on Security In Communication Networks
+
|Oct 22-25<br>Clearwater, FL
+
|http://www.sick-workshop.org
+
|-
+
|4th International Conference on Digital Forensics & Cyber Crime
+
|Oct 24-28<br>West Lafayette, IN
+
|http://d-forensics.org/2012/show/home
+
|-
+
|3rd Cybercrime and Trustworthy Computing Workshop
+
|Oct 29-30<br>Bellarat, Australia
+
|http://comp.mq.edu.au/conferences/ctc2011/
+
|-
+
|Paraben Forensic Innovations Conference
+
|Nov 03-07<br>Park City, UT
+
|http://www.pfic-conference.com/
+
|-
+
|2012 International Workshop on Computational Forensics
+
|Nov 11<br>Tsukuba, Japan
+
|http://iwcf12.arsforensica.org/
+
|-
+
|IEEE Conference on Technologies for Homeland Security
+
|Nov 13-15<br>Waltham, MA
+
|http://www.ieee-hst.org/
+
|-
+
|8th International Conference on Information Assurance and Security (IAS'12)
+
|Nov 21-23<br>Sao Carlos, Brazil
+
|http://www.mirlabs.org/ias12
+
|-
+
|Forensics@NIST 2012
+
|Nov 28-30<br>Rockville, MD
+
|http://www.nist.gov/oles/forensics-2012.cfm
+
|-
+
|IEEE International Workshop on Information Forensics and Security
+
|Dec 02-05<br>Tenerife, Spain
+
|http://www.wifs12.org/index.html
+
|-
+
|28th Annual Computer Security Applications Conference (ACSAC 2012)
+
|Dec 03-07<br>Orlando, FL
+
|http://www.acsac.org
+
|-
+
|2012 secau Security Congress
+
|Dec 03-05<br>Perth, Western Australia
+
|http://conferences.secau.org/
+
|-
+
|Ninth Annual IFIP WG 11.9 International Conference on Digital Forensics
+
|Jan 28-30<br>Orlando, FL
+
|http://www.ifip119.org/Conferences/
+
|-
+
|2013 DoD Cybercrime Conference
+
|Jan 29-Feb 01<br>Louisville, KY
+
|http://www.dodcybercrime.com/
+
|-
+
|65th Annual AAFS Meeting
+
|Feb 18-23<br>Washington, DC
+
|http://www.aafs.org/aafs-2013-annual-meeting
+
|-
+
|IMF 2013 - 7th International Conference on IT Security Incident Management & IT Forensics
+
|Mar 12-14<br>Nuernberg, Germany
+
|http://www1.gi-ev.de/fachbereiche/sicherheit/fg/sidar/imf/imf2013/about.html
+
|-
+
|IEEE Symposium on Security & Privacy
+
|May 19-23<br>San Francisco, CA
+
|http://www.ieee-security.org/TC/SP2013/index.html
+
|-
+
|International Workshop on Cyber Crime
+
|May 24<br>San Francisco, CA
+
|http://stegano.net/IWCC2013/
+
|-
+
|Techno Security and Forensics Investigation Conference
+
|Jun 02-05<br>Myrtle Beach, SC
+
|http://www.thetrainingco.com/html/Security%20Conference%202013.html
+
|-
+
|Mobile Forensics World
+
|Jun 02-05<br>Myrtle Beach, SC
+
|http://www.techsec.com/html/MFC-2013-Spring.html
+
|-
+
|FIRST Conference
+
|Jun 16-21<br>Bangkok, Thailand
+
|http://conference.first.org/2013/
+
|-
+
|The 1st ACM Workshop on Information Hiding and Multimedia Security
+
|Jun 17-19<br>Montpellier, France
+
|http://ihmmsec.org/
+
|-
+
|28th IFIP TC-11 SEC 2013 International Information Security and Privacy Conference
+
|Jul 08-10<br>Auckland, New Zealand
+
|http://www.sec2013.org/
+
|-
+
|DFRWS 2013
+
|Aug 04-07<br>Monterey, CA
+
|http://dfrws.org/2013
+
|-
+
|Regional Computer Forensics Group GMU 2013
+
|Aug 05-09<br>Fairfax, VA
+
|http://www.rcfg.org
+
|-
+
|22nd USENIX Security Symposium - USENIX Security '13
+
|Aug 14-16<br>Washington, DC
+
|https://www.usenix.org/conferences?page=1
+
|-
+
|VB2013 - the 23rd Virus Bulletin International Conference
+
|Oct 02-04<br>Berlin, Germany
+
|http://www.virusbtn.com/conference/vb2013/index
+
|-
+
|}
+
  
==See Also==
+
=== Decapsulation ===
* [[Training Courses and Providers]]
+
 
==References==
+
Where a damaged bond wire(s) is clearly identified and if there is no obvious damage to the silicon die, the die encapsulation can be removed. The de-capsulation process requires a great deal of skill and the use of proprietary mixes of aggressive solvents and/or acids. The exact process used depends upon the.
* [http://faculty.cs.tamu.edu/guofei/sec_conf_stat.htm Computer Security Conference Ranking and Statistic]
+
 
* [http://www.kdnuggets.com/meetings/ Meetings and Conferences in Data Mining and Discovery]
+
=== Testing ===
* http://www.conferencealerts.com/data.htm Data Mining Conferences World-Wide]
+
 
 +
After de-capsulation, further electrical tests are carried out to confirm the viability of the recovered silicon die. The die bonding pads are then probed and once electrical connection is established, the silicon is accessed and the sim data recovered using proprietary software.
 +
 
 +
=== X-Rays ===
 +
 
 +
Real time X-ray examination is used to confirm the conclusions drawn from the preceding Physical, Optical and Electrical tests. X-ray examination is only undertaken where the integrity of the silicon die is thought to be uncompromised.
 +
 
 +
== References ==
 +
 
 +
1. http://www.3gforensics.co.uk/sim-card-data-recovery.htm

Revision as of 01:20, 24 September 2008

Summary

A prerequisite for the use of SIMIS, is that the SIM card must be functional. A physically damaged, broken or dirty SIM may not function correctly, resulting in the recovery of corrupted data, or no data at all. In the forensic data recovery environment, SIM's will be presented in a variety of different conditions, ranging from good, but lightly soiled, through blood soaked to physically broken. Lightly soiled and blood soaked SIM's may be cleaned using appropriate methods, ensuring that the SIM is not further damaged taking care to preserve surface printing where possible.

However, physically damaged or broken SIM's require more specialised processing to produce a viable SIM for data recovery purposes. Crownhill has extensive experience in the area of SIM data recovery through its activity in the SIM manufacturing process. Crownhill works directly with the SIM silicon manufacturers and SIM card manufacturers. Processes developed to aid fault analysis and qualitative measurements are an invaluable advantage when attempting to repair and recover data from physically damaged SIM modules.

Crownhill have invested in purpose-built laboratory facilities to provide professional card cleaning, data recovery and card repair service. Based in discrete, secure premises, Crownhill can provide the full compliment of services required to clean, repair and recover data from damaged SIM's. Drawing on its own expertise and relationships with Card manufacturers and silicon vendors world-wide, Crownhill have created a centre of excellence for this specialised work. An overview of the procedures can be found here

Where a SIM is thought to be functional, Crownhill can provide a SIM cleaning service. Blood, soot, general soiling and body fluids are handled in an environmentally secure fashion, relieving the client of responsibility for Bio Hazards and other Health and Safety issues. Cleaned SIM's are returned without undue delay, ready for data recovery by the client. Cleaning by Crownhill must be carried out after the SIM has been pre-processed for any physical evidence required, such as Photography and DNA sampling. Data Recovery Process

Data Recovery Process

If our findings suggest that data recovery is likely to be possible, the SIM may further examined by real time X-ray, to determine the extent of the damage. Specifically we will be looking for broken or damaged wire bonds, detachment of the silicon die and possible fractures of the die.

Decapsulation

Where a damaged bond wire(s) is clearly identified and if there is no obvious damage to the silicon die, the die encapsulation can be removed. The de-capsulation process requires a great deal of skill and the use of proprietary mixes of aggressive solvents and/or acids. The exact process used depends upon the.

Testing

After de-capsulation, further electrical tests are carried out to confirm the viability of the recovered silicon die. The die bonding pads are then probed and once electrical connection is established, the silicon is accessed and the sim data recovered using proprietary software.

X-Rays

Real time X-ray examination is used to confirm the conclusions drawn from the preceding Physical, Optical and Electrical tests. X-ray examination is only undertaken where the integrity of the silicon die is thought to be uncompromised.

References

1. http://www.3gforensics.co.uk/sim-card-data-recovery.htm