±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 13
Overall: 26773
Visitors: 99

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Can a SDCard be linked to a phone?

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

Can a SDCard be linked to a phone?

Post Posted: Wed Mar 19, 2014 10:55 am

I have a few SD cards recovered from a scene, and a few likely handsets they may have been in. Picture metadata tells me what phones the pictures were taken with but I need to link card to particular handsets.

So, is there data within the Android file system that may store volume serials etc? Likewise, is IMEI, IMSI or ICCID stored on memory cards?

Thanks

MRE  

RedEyes
Member
 
 
  

Re: Can a SDCard be linked to a phone?

Post Posted: Wed Mar 19, 2014 6:36 pm

Possibly, but it will take some work.

Can you take at least one, identical picture with all of the cell phones?

Can you retake at least one of the pictures you collected, with all of the cell phones?  

jhup
Senior Member
 
 
  

Re: Can a SDCard be linked to a phone?

Post Posted: Thu Mar 20, 2014 1:56 am

- RedEyes
I have a few SD cards recovered from a scene, and a few likely handsets they may have been in. Picture metadata tells me what phones the pictures were taken with but I need to link card to particular handsets.

So, is there data within the Android file system that may store volume serials etc? Likewise, is IMEI, IMSI or ICCID stored on memory cards?

Thanks

MRE


It may differ (depending on the android phone) but some devices store a list of files from external(and internal) memory cards in

\data\data\com.android.providers.media\databases\external.db

So you could check the filestructure in this database and see if it matches with the one found on the memory card.

Some phones also add the volume id to the database name, which can be compared (on windows) with the commandline "vol" followed by the drive letter.

eg: vol e:

But beware that the volume ID is not hardware-linked. It will for example change with a new partition and so on.


furthermore you could link the card to the phone based on appdata that is stored on the card.
WhatsApp for example stores backup files on the SD which contain encrypted msgstore.db's that can be compared to the msgstore.db file on the internal memory ( /data/data/##WhatsApp##\databases... ) The method to decrypt the file is wide spread among the web. Just google something like "WhatsAppXtract".
In this case you want to compare the most recent backup file so the content should be (in case it is from that phone) almost identical.  

Zergling
Member
 
 
  

Re: Can a SDCard be linked to a phone?

Post Posted: Thu Mar 20, 2014 3:42 am

Thank you for the replies, certainly gives me a steer of where to go. It will not be possible to take photos with the handsets at this stage, but maybe possible later - all avenues exhausted etc. I am aware of work being done to link lens aberration to digital images.

Hopefully I can get a test model of each phone and swap memory cards around and establish differences.

MRE  

RedEyes
Member
 
 
  

Re: Can a SDCard be linked to a phone?

Post Posted: Thu Mar 20, 2014 4:45 am

When you examined the handset did you have to input a handset password?
_________________
Institute for Digital Forensics (IDF) - LinkedIn
Mobile Telephone Examination Board (MTEB) - LinkedIn
Mobile Telephone Evidence & Forensics trewmte.blogspot.com
ForensicMobex now MTEB Linkedin Subgroup 

trewmte
Senior Member
 
 
  

Re: Can a SDCard be linked to a phone?

Post Posted: Fri Mar 21, 2014 1:28 am

We have a number of likely candidates as regards handsets. Two were reset to factory defaults. Two others are resisting all attempts at a physical download... I haven't tried a logical yet.  

RedEyes
Member
 
 
  

Re: Can a SDCard be linked to a phone?

Post Posted: Thu Mar 27, 2014 9:19 am

Just a quick note you may also search the file directory structure on the memory cards as this may steer you to which memory card was inserted in which device. For instance if it was a Blackberry there will be files which may give you the BB Pin number and also store backups of the apps installed on the device.
If you need verification if a picture was taken on that handset I am aware there are a few agencies that can assist you in this type of verification.

Regards

Chris  

bravo1800
Newbie
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 2
Go to page 1, 2  Next