Difference between pages "Encase hash files" and "IDEN"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
 
(Rewording of the parts copy+pasted from Wikipedia (legal reasons).)
 
Line 1: Line 1:
−
{{Expand}}
+
The '''Integrated Digital Enhanced Network''' ('''iDEN''') is a proprietary mobile communications technology from [[Motorola]]. It is a [[TDMA]] based digital wireless standard that operates in the 800 MHz, 900MHz, and 1.5 GHz bands. It combines the capabilities of a [[cell phones|digital cellular telephone]] and a two-way radio known as [[push-to-talk]] ([[PTT]]).
  
−
The [[EnCase]] forensics suite uses a proprietary file format to store sets of known hashes called the '''EnCase hash file format'''. The format stores a set of [[MD5]] hashes and [[metadata]] about the set as a whole. That is, individual hashes do not contain any information specific to them, but the set as a whole can contain some information. In particular, the filename corresponding to each hash is not stored.
+
Motorola’s iDEN technology phones support many other features including [[Bluetooth]], location-based services, [[MOTOTalk]] and support for expandable memory ([[Micro SD]]). [[Sprint Nextel]] is the largest U.S. retailer of iDEN services.
  
−
Version 3 of [[EnCase]] used a slightly different format than versions 4 and 5. Both versions start with the header, in hexadecimal:
+
Newer iDEN phones use a [[SIM card]] that is compatible with [[GSM]] phones for overseas roaming but iDEN is a very different standard from GSM. iDEN phones are not compatible with GSM networks and GSM phones are not compatible with iDEN networks.
  
−
<pre>48 41 53 48 0d 0a ff 00</pre>
+
== History ==
  
−
In ASCII, this looks like <tt>HASH</tt> followed by a newline.
+
iDEN was invented by Motorola who is presently the primary manufacturer of iDEN devices.
  
−
The hashes begin at offset 0x480 in the file.
+
[[Nextel]] has started to develop a 2.5G technology called '''WiDEN''' (an expansion of iDEN) that includes four carriers (100kHz) into one channel. This results in a much higher download speed of 96 kbit/s.
  
−
A quick look at a hash file created by Encase 6.8.1.8 revealed the following structure (to be verified):
+
== External Links ==
  
−
'''Offset 0x0000 '''
+
* [http://idenphones.motorola.com/idenHome/common/what_is_iden.jsp Motorola: The iDEN Solution]
−
 
+
* [http://idenphones.motorola.com/iden/iden_home.jsp iDEN Home]
−
A header that consists of the following 16 bytes:
+
* [http://www.phoneyworld.com/newspage.aspx?n=1907 Motorola i580 iDEN]
−
<pre>48 41 53 48 0D 0A FF 00 02 00 00 00 01 00 00 00</pre>
+
* [http://en.wikipedia.org/wiki/Integrated_Digital_Enhanced_Network Wikipedia: Integrated Digital Enhanced Network]
−
 
+
−
'''Offset 0x0010'''
+
−
 
+
−
Count: The number of MD5 sums contained in this file, written as a 4 byte integer in Intel litle endian format (i.e. least significant byte first).
+
−
 
+
−
 
+
−
 
+
−
'''Offset 0x0014'''
+
−
 
+
−
The range from 0x0014 to 0x0407 is filled by zero-bytes. The purpose of this area is unknown.
+
−
 
+
−
 
+
−
 
+
−
'''Offset 0x0408'''
+
−
 
+
−
HashSet: The text that EnCase shows in its column "Hash Set". The maximum string length is 39 characters. Characters are stored in Unicode. (''Based on hash file form EnCase v. 6.17'')
+
−
 
+
−
 
+
−
'''Offset 0x0458'''
+
−
 
+
−
Category: The text that Encase shows in its column "category". The maximum string length is 19 characters. Each character is written as a 2-byte-Unicode-number. Examples:
+
−
 
+
−
The latin letter A is represented by the 2 bytes <pre>41 00</pre>
+
−
 
+
−
The cyrillic letter &#1044; is represented by the 2 bytes <pre>14 04</pre>
+
−
 
+
−
Again, Intel little endian format is used. The unused space is filled up by zero-bytes.
+
−
 
+
−
 
+
−
 
+
−
'''Offset 0x047E'''
+
−
 
+
−
Two zero-bytes.
+
−
 
+
−
 
+
−
 
+
−
'''Offset 0x0480'''
+
−
 
+
−
Start of the hash entries. Each entry occupies 18 bytes: The hash value itself (16 bytes) followed by 2 zero-bytes. The next entry follows immediately.
+
−
 
+
−
The file ends with the last hash entry.
+
−
 
+
−
 
+
−
== See also ==
+
−
 
+
−
* [[EnCase]]
+
−
 
+
−
[[Category:Forensics File Format]]
+

Revision as of 18:40, 24 April 2006

The Integrated Digital Enhanced Network (iDEN) is a proprietary mobile communications technology from Motorola. It is a TDMA based digital wireless standard that operates in the 800 MHz, 900MHz, and 1.5 GHz bands. It combines the capabilities of a digital cellular telephone and a two-way radio known as push-to-talk (PTT).

Motorola’s iDEN technology phones support many other features including Bluetooth, location-based services, MOTOTalk and support for expandable memory (Micro SD). Sprint Nextel is the largest U.S. retailer of iDEN services.

Newer iDEN phones use a SIM card that is compatible with GSM phones for overseas roaming but iDEN is a very different standard from GSM. iDEN phones are not compatible with GSM networks and GSM phones are not compatible with iDEN networks.

History

iDEN was invented by Motorola who is presently the primary manufacturer of iDEN devices.

Nextel has started to develop a 2.5G technology called WiDEN (an expansion of iDEN) that includes four carriers (100kHz) into one channel. This results in a much higher download speed of 96 kbit/s.

External Links

Retrieved from "http://www.forensicswiki.org/w/index.php?title=Encase_hash_files&oldid=2962"
Personal tools
Namespaces

Variants
Actions
Navigation:
About forensicswiki.org:
Toolbox