- #APPLE SERIAL NUMBER FINALLY BY FORENSIC MAC OS#
- #APPLE SERIAL NUMBER FINALLY BY FORENSIC PORTABLE#
- #APPLE SERIAL NUMBER FINALLY BY FORENSIC ANDROID#
- #APPLE SERIAL NUMBER FINALLY BY FORENSIC SOFTWARE#
First of all, in Section 2, AirPrint and its mode of operation both from a user’s and technical standpoints are presented.
#APPLE SERIAL NUMBER FINALLY BY FORENSIC SOFTWARE#
Several authors have reviewed the existing (mostly commercial) forensic investigation tools for iOS devices however, analysis of AirPrint activity does not seem to be covered by any of the existing software solutions. In addition, even when the mobile threat landscape has been covered by other authors, there seems to be no additional research on how AirPrint works behind the scenes and the forensic traces it may leave. Analyzing the behavior of AirPrint posed an interesting challenge since iOS is a closed operating system and lacks public documentation about many internal aspects. The main contribution of this paper is the exposition of a method to recover from an iOS device the contents and metadata of documents printed through AirPrint, even in modern devices which feature hardware-based data encryption. Considering the rise of mobile devices and applications in general and the hundreds of millions iOS devices in particular, any available process which allows to recover user data becomes especially relevant from both a computer forensics and a privacy concern standpoint.
This paper extends our previous research to analyze if these temporary files can be recovered even in modern iOS versions which use hardware-based data encryption. In a previous paper we observed that printing a document through AirPrint leaves a trace in the filesystem of the iOS device in the form of a temporary file containing the printed content and with a specific metadata that allows for the identification of this precise kind of files in the filesystem. This paper focuses on the AirPrint feature of iOS devices (iPhone, iPad, and iPod Touch), which allows them to print wirelessly to compatible printers. However, some of these new features may manage personal user data and are worth analyzing from a forensic investigation standpoint. Furthermore, because of the competitive nature of the market, with each new version of these systems, new functionalities are added in order to appeal to a greater set of users and thus become their device of choice.
#APPLE SERIAL NUMBER FINALLY BY FORENSIC ANDROID#
Now we find that the most personal devices, the ones that always accompany their users and are more prone to contain sensitive information, run software environments which simply did not exist a few years ago, namely, Android and iOS.
#APPLE SERIAL NUMBER FINALLY BY FORENSIC MAC OS#
We once had a homogeneous personal computer market, mainly dominated by a few different Windows versions, with minor representations of Mac OS or Unix-based systems. The practice of digital forensics has needed to adapt quickly to the emerging mobile technologies. In this scenario, where mobile devices become ubiquitous, privacy and cyber-security become a great concern since such devices may contain huge amounts of sensible valuable data about us: contacts, calendar, e-mails, and photographs as well as a pile of logs: phone calls, chat, geographic positions, and so forth.
#APPLE SERIAL NUMBER FINALLY BY FORENSIC PORTABLE#
Portable devices such as smartphones and tablets have evolved from simple phones and agendas into literally full-fledged, always-online computers. Information technologies have grown rapidly in the last decades, changing the way we live, work, and communicate. This paper describes the traces left in the iOS device when AirPrint is used and presents a method for recovering content and metadata of documents that have been printed. In 2010, version 4 of the iOS operating system introduced AirPrint, a simple and driverless wireless printing functionality supported by hundreds of printer models from all major vendors. This fact, added to the given idiosyncrasies of these new portable devices and the kind ofĭata they may store, opens new opportunities in the field of computer forensics. Since its presentation by Apple, both the iPhone and iPad devices have achieved great success and gained widespread popularity.