SBIR-STTR Award

Mobile devices are increasingly utilized in criminal and terrorist activities. These devices are an important source of evidence to law enforcement officers and forensic examiners. Since inception, viaForensics has developed innovative tools and techniques for officers and examiners leveraging the latest technologies in mobile device forensics. viaForensics has previously developed forensically sound tools and techniques for analyzing NAND flash memory in Android mobile devices, and is uniquely positioned and prepared to extend this research. One of the primary challenges in forensic imaging of flash memory is that, unlike mechanical hard disks, flash memory is in a constant state of flux. Memory management transactions are ongoing within the memory independent of external activity. viaForensics proposes to continue its innovation by conducting research and development efforts toward creation of a NAND memory write blocker, as well as tools and techniques for complete, bit-by-bit forensic imaging of NAND flash memory chips. In Phase I, viaForensics will research expanding the existing tools and techniques to include the ability to decipher the wear leveling and other memory management algorithms of NAND flash memory. The research will also include investigation and feasibility analysis of methods for implementing a NAND memory write blocker. In phase II, the tools and techniques will be further developed for use on a wider range of devices and flash memory types, and a prototype of the NAND memory write blocker will be developed.

The overall goal of this project is to develop new tools and techniques to address current limitations in mobile forensics. Many factors, including NAND Flash memory, passcode protected phones, encrypted data, lack of device support and simplistic analysis techniques in current forensic tools drive the need for advancements in mobile forensic tools. Phase I of this project was highly successful. We developed techniques that created a forensically sound and verifiable image of data on devices utilizing NAND flash memory. We also developed tools which enabled more effective analysis of the acquired data. Phase II will build upon the successes of Phase I by: 1. Expanding the number of Android devices our NAND Flash Write Blocker (vNandBlock) and acquisition tools support; 2. Porting applicable vNandBlock and acquisition tools Apple iOS and Windows Phone devices; 3. Applying advanced analytic techniques to extract mobile forensics data; 4. Developing forensic training modules which incorporate the knowledge gained in the development of these new techniques and tools. The new tools and techniques developed in Phase II would provide direct benefit to law enforcement agencies tasked with analyzing mobile devices in civil, criminal and national security investigations. The advanced data analysis engine would greatly improve the amount of intelligence which could be generated from mobile devices. viaForensics believes that Phase II will enable us to expound on our existing and proven commercialization vehicles including viaExtract(TM) (our forensic software product) and proprietary training courses and aggressively pursue opportunities to license our technology to other commercial entities.