Text

Linkable IdentifiersLeveraging Technology To Identify People

Purpose

Provide a broader understanding of how technology can be used to link people to their technology during an investigation as well as provide a broader understanding of digital footprints.

Linkable Identifiers in Computer Identifiers

Hardware MAC address(es) wired and wireless network cards and adapters

Hard drive serial number

Motherboard serial number

Serial numbers of removable devices stored in the registry

Bluetooth and paired devices

Video Card Serial Number

Battery serial number

Linkable Identifiers In Mobile Devices

IMEI or electronic serial number

ICCID (SIM Card)

USB serial number, Vendor ID, and Product ID

SEID or secure element ID (Apple Pay)

Wifi SSID (broadcast from device)

Wifi History

Battery serial number

NFC / RFID

Text

Case StudySurreptitious recording in the workplace

Why you need a “Digital Detective”

Line Power

Battery Power2hrs VOX

240hrs VOX

Creates a .WAV Has vendor ID Has product ID Black Market (no traceable serial number). Does not transmit so it can’t be found via TSCM

8GB USB Recording Device

The InvestigationFinger prints were destroyed due to handling

Data recovery of the USB device was conducted to uncover deleted audio recording(s)

Technical surveillance counter measures of office(s) were conducted

Identify which computer registries if any showed traces of the recording device(s)

Identify how the .WAV file(s) traversed the computer

Identify other USB devices that received files

Trace the cell phone that was plugged in six months prior

The phones USB Serial number was traced to manufacturer

Manufacturer provided service provider and other linkable identifiers

Service provider could not provide the phone number

A surveillance was conducted of the locations wifi. Investigator was alerted once the subject’s phone connected to the wifi, we knew he was in the building

Circumstantial evidence was the USB drive used to store the recordings only appeared on two machines. The second being a laptop which was taken home every night. Recordings were copied at 1:33 A.M.

Laptop and owner of the phone were the same

The accused was the person who the company trusted with their internal investigation as well as the party that implicated the IT person.

Social Media Linkable IdentifiersCriminals

Data Mining

The NSA

Leveraging Social MediaUser creates a social media account (Name & DOB)

Hardware information and location is obtained when the account is created. Cookie is inserted in to web browser

User is asked to link the account to a secondary email

User is asked to verify their account via text message, linking their phone to their online account

Text message confirms the GEO location, IP, and links the identifier(s)

User installs and agrees to App. App collects hardware information and gains access to the stored photos, contacts, camera and microphone

Information is used to profile and track user as well as link user to other users

Linkable Identifiers In Images

Selfies, Instagram post, and Facebook tagged images

EXIF Metadata From iPhone ImageApertureValue: 2.275007124536905BrightnessValue: 5.143226919758413ColorSpace: sRGBComponentsConfiguration: YCbCrDateTimeDigitized: 2015:01:25 10:35:27DateTimeOriginal: 2015:01:25 10:35:27ExifVersion: 2.2.1ExposureBiasValue: 0ExposureMode: AutoExposureProgram: NormalExposureTime: 0.01666666666666667FNumber: 2.2Flash: Off, Did not fireFlashPixVersion: 1.0FocalLenIn35mmFilm: 29FocalLength: 4.15ISOSpeedRatings: 32LensMake: AppleLensModel: iPhone 6 back camera 4.15mm f/2.2LensSpecification: 4.15,4.15,2.2,2.2MeteringMode: SpotPixelXDimension: 3264PixelYDimension: 2448SceneCaptureType: StandardSceneType: Directly PhotographedSensingMethod: One-chip color areaShutterSpeedValue: 5.908767772511848SubjectArea: X Center: 1169,Y Center: 1512,Width: 610,Height: 612

SubsecTimeDigitized: 038SubsecTimeOriginal: 038WhiteBalance: Auto(file) DateTime: 2015:01:25 10:35:27Make: AppleModel: iPhone 6Orientation: LeftResolutionUnit: InchesSoftware: 8.1.2XResolution: 72YResolution: 72Altitude: 1.935452560058238mAltitudeRef: Above sea levelDateStamp: 2015:01:25DestBearing: 240.9391304347826DestBearingRef: TImgDirection: 240.9391°= SouthwestImgDirectionRef: True NorthLatitude: 27.32692LatitudeRef: NLongitude: 82.54039666666667LongitudeRef: WSpeed: 0SpeedRef: km/hTimeStamp: 15:35:26PixelWidth: 3264PixelHeight: 2448FileName: IMG_6278.JPGFileSize: 1.92277 MB

EXIF Viewer Ap

Text

Embedded Linkable IdentifiersMicrochipping