Featured Papers: iOS Anti-Forensics, Google Drive Forensics, and Cell Phone Searches

Here's a roundup of new papers on SSRN:

IOS Anti-Forensics: How Can We Securely Conceal, Delete and Insert Data?

Abstract:

With increasing popularity of smart mobile devices such as iOS devices, security and privacy concerns have emerged as a salient area of inquiry. A relatively under-studied area is anti-mobile forensics to prevent or inhibit forensic investigations. In this paper, we propose a "Concealment" technique to enhance the security of non-protected (Class D) data that is at rest on iOS devices, as well as a "Deletion" technique to reinforce data deletion from iOS devices. We also demonstrate how our "Insertion" technique can be used to insert data into iOS devices surreptitiously that would be hard to pick up in a forensic investigation.

Google Drive: Forensic Analysis of Cloud Storage Data Remnants

Abstract:

Cloud storage is an emerging challenge to digital forensic examiners. The services are increasingly used by consumers, business, and government, and can potentially store large amounts of data. The retrieval of digital evidence from cloud storage services (particularly from offshore providers) can be a challenge in a digital forensic investigation, due to virtualisation, lack of knowledge on location of digital evidence, privacy issues, and legal or jurisdictional boundaries. Google Drive is a popular service, providing users a cost-effective, and in some cases free, ability to access, store, collaborate, and disseminate data. Using Google Drive as a case study, artefacts were identified that are likely to remain after the use of cloud storage, in the context of the experiments; on a computer hard drive and Apple iPhone3G, and the potential access point(s) for digital forensics examiners to secure evidence.

Cell Phone Searches in a Digital World: Blurred Lines, New Realities and Fourth Amendment Pluralism

Abstract:

State and federal courts are split over whether cell phone searches incident to a lawful arrest are permissible under the Fourth Amendment. The Supreme Court has the opportunity to create uniformity by accepting a certiorari petition in a cell phone search incident to arrest case, either United States v. Wurie or Riley v. California. The Court should do so to create an analysis that incorporates sensory enhancing technology, not avoids it, as it has done to date. 

The split in case law evidences a central contradiction. Fourth Amendment rules need to be predictable and based on clear guidelines for effective and safe crime interdiction. Technological advances cloud the application of the rules by introducing new facts into the calculus, facts that separate form from function and transform the analysis. In the past, as evidenced by search cases Katz and Jones, and exception cases for searches incident to lawful arrest, Chimel and Robinson, the Supreme Court analysis tended to be based on abstract and grand theory, which has led to a form of Gresham’s Law of constitutional application, where general principles often end up marginalizing specific provisions. Because of advancing technology, however, Fourth Amendment protection has been eroding, as predicted in Kyllo. Searches of cell phones incident to lawful arrests can provide a huge source of discretionary information for police, and searches of "smart" phones without cause can seem like a fishing expedition. Comparisons and analogues have not worked. Neutral narratives have been fractured and unsatisfying. 

This paper suggests using local structures accommodating post-digital technology instead of pre-digital comparisons like containers and walls and doors. Facts, and new realities, matter. In essence, analyses should incorporate the capabilities of the technology in question. The new doors and walls of the advancing technology era create new privacy encroachments, including nondiscoverable information without permission, but are still guided by the same textual and Framers’ intent considerations, such as invasiveness, duration and intent of the government conduct, as well as the nature and impact of the invasion. In light of this calculus, cell phone searches incident to a lawful arrest generally should require some sort of independent and legitimate reason to search the device, a search of which does not fit neatly into existing rationales of container, officer safety, or destruction of evidence.