MSAB Whitepaper – Investigating RAM in a Mobile Device

The newwhitepaperfrom MSAB, written by Dave Lauder, explores the often overlooked value of mobile device RAM in digital investigations. Once considered too volatile or inaccessible to be useful, RAM may in fact contain ephemeral but crucial data, such as user input, application activity, and system information, that may never be stored elsewhere.

Read an excerpt below and download thewhitepapercomplete to discover how RAM analysis can reveal new sources of digital evidence.

Removing RAM from a mobile device is often considered difficult and not very useful, since traditional methods to do so usually involverootthe device. AlthoughrootA device gives you access to RAM dumps, these do not contain information useful for an investigation, because the device is rebooted and any relevant data has already been overwritten.

This knowledge has become a kind of “established truth,” transmitted from experienced researchers and analysts to new ones, and embodied in data collection procedures. Nobody questions it, because “that's the way things are.” But technology doesn't stand still, and this type of knowledge should be questioned from time to time, as things change. Still, removing RAM from a mobile device remains a complex process, but techniques are improving, and this established knowledge is becoming obsolete as capture methods become more established.

Leaving aside the capture of the RAM dump for a moment, the next question would be: why would you want it? In data analysis we usually classify information into two types. The first is “at rest” data. This type of data is typically located on some storage medium that allows long-term access to read, update, or create new information. On a mobile device, this corresponds to the typical file system you would get in a standard computer dump.

As time goes by, this is becoming increasingly inaccessible due to the use of encryption and other data hiding techniques. That also means that a lot of effort is required to discover the encryption method and keys, or the obfuscation technique used for this “at rest” data. Therefore, a time lag may occur between an update of an app's data structure and the ability to examine it. And that's problematic for two reasons: The first is that apps update whenever they want, which can cause a data structure to only exist for a short time.

An example of a short interval: Facebook changed a data structure in an update and changed it again two hours later. If the terminal had been intervened between both updates, that short-lived data structure would exist on that device. Would the forensic tool you use to analyze the data identify it? The other problem is that sometimes there are bespoke applications to communicate, so the data structure may only exist on five endpoints around the world.

If the data is not “at rest,” then it is “in transit.” This describes data that is being actively used and changed and may have a lifetime of just milliseconds as useful data within a device. That is usually the type of data we find in RAM. They may have a lifetime of milliseconds for the app, but the device's memory management may not reuse the area where that data resides for an extended period of time, so it will still appear in the RAM dump.

The app needs this data in a raw, unencrypted or deobfuscated format in order to process it; then encrypts/obfuscates them again to store them “at rest”. Additionally, the structure of that data may be different from that of data stored at rest. An example is an SMS: in RAM they may appear in PDU format, but at rest they are saved as entries in a database. The app transforms the PDU format into its own structure to store it, but both types of structure can coexist in the app's memory.

For “at rest” data there is a lot of research and knowledge—both from tool makers and within the industry—to solve the challenges of obfuscation and encryption. Some analysts end up creating their own tools or scripts to solve very specific and rare problems. In the case of “in-transit” data, the problem has always been obtaining data to examine those structures; now that is possible thanks to the use of RAM dumps.

Download theMSAB Whitepaper – Investigating RAM in a Mobile Device