ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Difference between pages "Cell phones" and "Chrome Disk Cache Format"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(Forensics)
 
 
Line 1: Line 1:
'''Cell phones''' or '''mobile phones''' are an important target for [[forensic investigator]]s.
+
{{expand}}
  
== Technologies ==
+
== Cache files ==
+
The cache is stored in multiple:
* [[CDMA]]
+
{| class="wikitable"
* [[TDMA]]
+
|-
* [[GSM]]
+
! Filename
* [[iDEN]]
+
! Description
* [[EDGE]]
+
|-
* [[GPRS]]
+
| index
* [[UMTS]]
+
| The index file
 +
|-
 +
| data_#
 +
| Data block files
 +
|-
 +
| f_######
 +
| (Separate) data stream file
 +
|}
  
== Hardware ==
+
== Cache address ==
 +
The cache address is 4 bytes in size and consists of:
 +
{| class="wikitable"
 +
|-
 +
! offset
 +
! size
 +
! value
 +
! description
 +
|-
 +
| <i>If file type is 0 (Separate file)</i>
 +
|
 +
|
 +
|
 +
|-
 +
| 0.0
 +
| 28 bits
 +
|
 +
| File number <br> The value represents the value of # in f_######
 +
|-
 +
| <i>Else</i>
 +
|
 +
|
 +
|
 +
|-
 +
| 0.0
 +
| 16 bits
 +
|
 +
| Block number
 +
|-
 +
| 2.0
 +
| 8 bits
 +
|
 +
| File number (or file selector) <br> The value represents the value of # in data_#
 +
|-
 +
| 3.0
 +
| 2 bits
 +
|
 +
| Block size <br> The number of contiguous blocks where 0 represents 1 block and 3 represents 4 blocks.
 +
|-
 +
| 3.2
 +
| 2 bits
 +
|
 +
| Reserved
 +
|-
 +
| <i>Common</i>
 +
|
 +
|
 +
|
 +
|-
 +
| 3.4
 +
| 3 bits
 +
|
 +
| File type
 +
|-
 +
| 3.7
 +
| 1 bit
 +
|
 +
| Initialized flag
 +
|}
  
* [[RIM BlackBerry]]
+
=== File types ===
* [[T-Mobile Sidekick ]]
+
{| class="wikitable"
* [[SIM Cards]]
+
|-
 +
! Value
 +
! Description
 +
|-
 +
| 0
 +
| (Separate) data stream file
 +
|-
 +
| 1
 +
| (Rankings) block data file (36 byte block data file)
 +
|-
 +
| 2
 +
| 256 byte block data file
 +
|-
 +
| 3
 +
| 1024 byte block data file
 +
|-
 +
| 4
 +
| 4096 byte block data file
 +
|-
 +
|
 +
|
 +
|-
 +
| 6
 +
| Unknown; seen on Mac OS X 0x6f430074
 +
|}
  
== Operating Systems ==
+
==== Examples ====
 +
{| class="wikitable"
 +
|-
 +
! Value
 +
! Description
 +
|-
 +
| 0x00000000
 +
| Not initialized
 +
|-
 +
| 0x8000002a
 +
| Data stream file: f_00002a
 +
|-
 +
| 0xa0010003
 +
| Block data file: data_1, block number 3, 1 block of size
 +
|}
  
* [[Microsoft PocketPC]]
+
== Index file format (index) ==
* [[Microsoft Windows Mobile]]
+
Overview:
* [[Palm]]
+
* File header
* [[RIM BlackBerry]]
+
* least recently used (LRU) data (or eviction control data)
* [[Symbian]]
+
* index table
* [[Linux]]
+
  
== Forensics ==  
+
=== File header ===
 +
*TODO*
  
'''Procedures'''
+
== Data block file format (data_#) ==
 +
Overview:
 +
* File header
 +
* array of blocks
  
* [[Cell Phone Forensics]]
+
=== File header ===
* [[SIM Card Forensics]]
+
*TODO*
* [[External Memory Card Forensics]]
+
* [[Blackberry Forensics]]
+
* [[JTAG Forensics]]
+
* [[Chip-Off Forensics]]
+
  
== Tools ==
+
== Data stream ==
 +
See: [[gzip]]
  
'''Flashers'''
+
== See Also ==
* [[UFS Tornado]]
+
* [[Google Chrome]]
 +
* [[gzip]]
  
'''Hardware'''
+
== External Links ==
* [[Azimuth RadioProof™ Enclosures]]
+
* [http://www.chromium.org/developers/design-documents/network-stack/disk-cache Disk Cache], The Chromium Projects
* [[Cellebrite UFED]]
+
* [[LogiCube CellDEK]]
+
* [[LogiCube CellDEK TEK]]
+
* [http://www.msab.com/xry/field-version | Micro Systemation Field Version]
+
* [[Network Security Solutions Secure Tents]]
+
* [[Network Security Solutions Seizure Bags for Cell Phones/PDAs/Laptops]]
+
* [[Paraben CSI Stick]]
+
* [[Paraben Device Seizure Toolbox]]
+
* [[Paraben Handheld First Responder Kit]]
+
* [[Paraben StrongHold Bag]]
+
* [[Radio Frequency (RF) Jammers]]
+
* [[Radio Tactics Acesso]]
+
* [[Radio Tactics Apollo]]
+
* [[Radio Tactics Athena]]
+
* [[SIM Card Readers]]
+
  
'''Software'''
+
[[Category:File Formats]]
* [[BitPIM]]
+
* [[BK Forensics Cell Phone Analyzer]]
+
* [[FloAt's Mobile Agent]]
+
* [[ForensicMobile]]
+
* [[ForensicSIM]]
+
* [[Guidance Software Neutrino]]
+
* [[iDEN Companion Pro]]
+
* [[iDEN Media Downloader]]
+
* [[iDEN Phonebook Manager]]
+
* [[.XRY |MicroSystemation .XRY]]
+
* [[MOBILedit!]]
+
* [[Oxygen Forensic Suite 2010]]
+
* [[Paraben Device Seizure]]
+
* [[Paraben SIM Seizure]]
+
* [[Pandora's Box]]
+
* [[Quantaq USIMdetective]]
+
* [[Quantaq USIMcommander]]
+
* [[Quantaq USIMdetective]]
+
* [[Quantaq USIMexplorer]]
+
* [[Quantaq USIMprofiler]]
+
* [[Quantaq USIMregistrar]]
+
* [[SIMiFOR]]
+
* [[Susteen Secure View]]
+
* [[TULP2G]]
+
* [[WOLF]]
+
 
+
==See Also==
+
[[Cell phone forensics bibliography]]
+

Revision as of 08:43, 22 June 2014

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

Cache files

The cache is stored in multiple:

Filename Description
index The index file
data_# Data block files
f_###### (Separate) data stream file

Cache address

The cache address is 4 bytes in size and consists of:

offset size value description
If file type is 0 (Separate file)
0.0 28 bits File number
The value represents the value of # in f_######
Else
0.0 16 bits Block number
2.0 8 bits File number (or file selector)
The value represents the value of # in data_#
3.0 2 bits Block size
The number of contiguous blocks where 0 represents 1 block and 3 represents 4 blocks.
3.2 2 bits Reserved
Common
3.4 3 bits File type
3.7 1 bit Initialized flag

File types

Value Description
0 (Separate) data stream file
1 (Rankings) block data file (36 byte block data file)
2 256 byte block data file
3 1024 byte block data file
4 4096 byte block data file
6 Unknown; seen on Mac OS X 0x6f430074

Examples

Value Description
0x00000000 Not initialized
0x8000002a Data stream file: f_00002a
0xa0010003 Block data file: data_1, block number 3, 1 block of size

Index file format (index)

Overview:

  • File header
  • least recently used (LRU) data (or eviction control data)
  • index table

File header

  • TODO*

Data block file format (data_#)

Overview:

  • File header
  • array of blocks

File header

  • TODO*

Data stream

See: gzip

See Also

External Links