道路交通事故之行動裝置OSINT工具鑑識研究

Traffic Forensics in Mobiles on OSINT Tools Operations Ushering Evidence Revelations

何昌岳(Chang-Yueh Ho)；黃正達(Cheng-Ta Huang)；王旭正(Shiuh-Jeng WANG)

行動裝置鑑識 ； iTunes 備份 ； ADB 工具 ； buffer logs ； 道路交通事故調查 ； Mobile forensics ； iTunes backup ； ADB tools ； Buffer logs ； Traffic event investigations

資訊安全通訊

23卷3期（2017 / 07 / 01）

65 - 90

繁體中文

智慧型行動裝置的普及，及無線網路技術的成熟，透過行動裝置可達成的服務愈來愈多，但也因其即時性與方便性，使駕駛人在駕駛車輛時，常使用行動裝置上網，此行為易造成駕駛人分心，進而導致道路交通事故的發生。當事故發生時，在行動裝置發現關鍵或相關之數位證據的情形，也會隨著行動裝置使用的增長，可能性同樣增加。然而，現今行動裝置鑑識調查面臨最大窘境，便是商業型鑑識工具對於行動裝置的支援程度，追不上行動裝置硬體型號及軟體版本的更新速度，這時便迫切需要建立可支援第一線調查人員和研究者去鑑識調查的工具及方法。本文將先利用行動裝置的日誌檔內容，判別使用者的使用行為，再藉由行動裝置的備份檔，進一步找出通訊紀錄、傳送之多媒體檔案等數位證據，證明其與交通事件或犯罪行為之關連性，並透過交通事故個案研究進行觀察分析跟探討。

Following up the popularity of smart mobile devices and the maturity of wireless networking technologies, the services are able to be achieved through the operations of the mobile devices. By means of the functionalities of immediacy and convenience, the mobiles are always associated with the drivers when operating the cars on the driving ways. The behaviors are likely to distract the drivers from the driving procedures, and leading to the occurrence of road traffic accidents. When an accident occurs, finding critical or relevant digital evidence on the mobile devices associated with the drivers are necessary at the first moment. However, the biggest concern of mobile device forensic investigation now is that the support of commercial forensic tools can not catch up the upgrading rate of the hardware and software versions in the mobile operations. By the way, it is required to build the tools and methods of forensic investigations to cope with the forensics investigators to guarantee the completeness of probing evidence. In this paper, we use the log file of mobile device to analyze the user behaviors. And then fix the key evidence in terms of communication records and multimedia files to make the connections, either in the case of the traffic accidents or criminal events.

1. Developers, Android Debug Bridge, Retrieved from http://developer.android.com/tools/help/adb.html (2016/8/28).
2. Cyberlink, U 通訊App , Retrieved from http://tw.cyberlink.com/stat/product/CyberLink_app/U/cht/U.jsp (2016/8/28).
3. Developers, Dashboards , Retrieved from http://developer.android.com/intl/zh-tw/about/dashboards/index.html (2016/8/28).
4. Developers, Reading and Writing Logs , Retrieved from http://developer.android.com/tools/debugging/debugging-log.html (2016/8/28).
5. Sqlitebrowser, DB Browser for SQLite, Retrieved from http://sqlitebrowser.org/ (2016/8/28).
6. Cygwin authors, Cygwin, Retrieved from https://www.cygwin.com/ (2016/8/28).
7. Developers, Configuring Auto Backup for Apps, Retrieved from https://developer.android.com/training/backup/autosyncapi.html (2016/8/28).
8. Al Barghouthy, N.,Marrington, A.,Baggili, I.(2013).The Forensic Investigation of Android Private Browsing Sessions Using Orweb.International Conference on IEEE
9. Bader, M.,Baggili, I.(2010).iPhone 3GS Forensics: Logical Analysis Using Apple iTunes Backup Utility.Small Scale Digital Device Forensics Journal,4(1)
10. Bennett, D.(2012).The Challenges Facing Computer Forensics Investigators in Obtaining Information from Mobile Devices for Use in Criminal Investigations.Information Security Journal: A Global Perspective,21(3),159-168.
11. Bommisetty, S.,Tamma, R.,Mahalik, H.(2014).Practical Mobile Forensics.Packt Publishing Ltd..
12. Epifani, M.,Stirparo, P.(2015).Learning iOS Forensics.Packt Publishing Ltd..
13. Faheem, M.,Le-Khac, N. A.,Kechadi, T.(2014).Smartphone Forensic Analysis: A Case Study for Obtaining Root Access of an Android Samsung S3 Device and Analyse the Image without an Expensive Commercial Tool.Journal of Information Security,5,89-90.
14. He, J.,Choi, W.,McCarley, J. S.,Chaparro, B. S.,Wang, C.(2015).Texting While Driving Using Google Glass™: Promising but Not Distraction-free.Accident Analysis & Prevention,81,218-229.
15. Hoog, A.,Strzempka, K.(2011).iPhone and iOS Forensics: Investigation, Analysis and Mobile Security for Apple iPhone, iPad and iOS Devices.Elsevier.
16. Horsman, G.,Conniss, L. R.(2015).Investigating Evidence of Mobile Phone Usage byDrivers in Road Traffic Accidents.Digital Investigation,12(supplement 1),30-37.
17. Husain, M. I.,Sridhar, R.(2009).iForensics : Forensic Analysis of Instant Messaging on Smart Phones.International Conference on Digital Forensics and Cyber Crime,9-18.
18. Ige, J.,Banstola, A.,Pilkington, P.(2016).Mobile Phone Use While Driving: Underestimation of a Global Threat.Journal of Transport & Health,3(1),4-8.
19. Jansen, W.,Ayers, R.(2007).NIST Special PublicationNIST Special Publication,未出版
20. Karlsson, K. J.,Glisson, W. B.(2014).Android Anti-Forensics: Modifying Cyanogenmod.International Conference on System Sciences
21. Lessard, J.,Kessler, G.(2010).Android Forensics: Simplifying Cell Phone Examinations.Small Scale Digital Device Forensic Journal,4(1)
22. Oulasvirta, A.,Rattenbury, T.,Ma, L.,Raita, E.(2012).Habits Make SmartPhone Use More Pervasive.Personal and Ubiquitous Computing,16(1),105-114.
23. Ovens, K. M.,Morison, G.(2016).Forensic Analysis of Kik Messenger on iOS Devices.Digital Investigation,17,40-52.
24. Sgaras, C.,Kechadi, M. T.,Le-Khac, N. A.(2015).Forensics Acquisition and Analysis of Instant Messaging and VoIP Applications.Computational Forensics
25. Tso, Y. C.,Wang, S. J.,Huang, C. T.,Wang, W. J.(2012).iPhone Social Networking for Evidence Investigations Using iTunes Forensics.6th International Conference on Ubiquitous Information Management and Communication
26. WHO(2011).Mobile Phone Use: a Growing Problem of Driver Distraction.