Chirashi Security » Forensics

Puttering around with BlackBerry forensics — Part 1

chopstick — Fri, 22 Jul 2011 16:29:38 +0000

I’m guilty of sitting on source code which I should have released a long time ago. I make excuses to myself that I didn’t release any of it because I was waiting for someone to come along and prove to me that there was a better way of doing things. I guess the bottom line was that I was just lazy and procrastinating.

Today, I’m releasing source code to three of my projects that I’ve been incubating. 1) bbt 2) evt2sqlite 3) ConParse Take! Build! Enjoy! ~~At some point or another, I may just split them up into their own repos. For now, they all live in the bb-tools repository down at github.~~ Update: I’ve split them up now

In today’s post, I’ll cover the first tool, bbt.

bbt

bbt is a python script that analyzes the thumbnail cache from a BlackBerry. The purpose of a thumbnail cache in any system, is generally to speed up the browsing of large numbers of graphic or video files. Instead of presenting a static icon to the user, a small thumbnail of the picture or frame of the video file is shown. Apparently this is a good thing, because you can see an icon of the image that you’re clicking on and will hopefully be able to find the file you’re looking for quicker. Typically, the Operating System will find and shrink pictures found in directories of the filesystem. These shrunk pictures will then be placed inside the thumbnail cache.

When conducting a digital forensics analysis of a computer, looking for these thumbnail caches often provide clues as to what files may have existed before they were deleted off the file system. The thumbnail cache is important enough to warrant its own entry on the Forensics Wiki (albeit only the Windows thumbnail cache is spoken about). The principle generally remains the same when extended to the BlackBerry device as well. So, bottom line: being able to analyze this file is useful.

bbt will do just that for thumbnail cache files found on BlackBerry devices. There are two types of thumbnail caches on the BlackBerry device: 1) BBThumbs.dat format 2) key/dat format.

Format 1 is pre OS 5.0 and the key/dat format is post OS 5.0 The key/dat combination is interesting because it uses two files to keep track of thumbnails. They look something like thumbs86x86.key and thumbs86x86.dat (the 86×86 indicates the size of the thumbnail – 86 pixels by 86 pixels). I’ve noticed quite a few interesting things in these files and no doubt, you will too after you look through the source or play around with them long enough:

The BBThumbs.dat header is 0×24052003 (which is a hex number)
The thumbs.dat file header is 0×22062009 (hex again)
The thumbs.key file header is 0×08062009 (hex)

This is pure speculation, but if you took those hexadecimal representations and looked at just the numbers, don’t they look like dates?

0×24052003 –> 24 05 2003
0×22062009 –> 22 06 2009
0×08062009 –> 08 06 2009

Maybe birth dates of the file format itself or someone significant to someone who wrote it? Dunno.

Another interesting observation of the key/dat thumbnail cache is that it not only stores image thumbnails, but also stores details of all types of media including ‘wav’, ‘mp3′, and ‘mid’. It doesn’t store any content inside it though. The only content stored inside the files is image data.

I’m not actually going to tell you what is found inside the thumbs files in this post, but instead, I am going to tell you how to run bbt. bbt is a python script and as such will require that you have python installed on your system. I’d always recommend cloning my repository on github so that you can easily pull any updates. You may also want to sign up for a github account and watch the repository so that you will be notified of any commits I make. You could also fork the project and get to work on it yourself.

azazel:Device sheran$ ~/github/bb-tools/bbt/bbt.py
Usage: bbt.py [options]
  -h, --help: This cruft
  -k, --key : Process post OS5 thumbs.key file (requires thumbs.dat file in same directory)
  -b, --bbthumbs : Process pre OS5 BBThumbs.dat file
  -x, --extract: Extracts the thumbnails into directory specified by -o
  -o, --output : Directory to extract thumbs to (used only with -x)
azazel:Device sheran$

The output above is what you will receive if you run bbt without options. As of the latest release (0.3b), the most magical thing you can do with this tool is to extract the thumbs into a specific output directory. Additionally, bbt will parse out information about 1) What thumbnails are stored in the file (filename) for BBThumbs.dat files or 2) Where at what offset in a ‘dat’ file a specific record id is stored. Here’s some example output when parsing a key/dat pair:

azazel:Device sheran$ ~/github/bb-tools/bbt/bbt.py -k thumbs116x116.key -x -o out
*** Processing thumbs116x116.key on 2011-07-22 21:50:48.156899
Record ID C620B80A is at offset 7 in 'dat' file // [1306132653179.jpeg]
Record ID DB0B7CA3 is at offset 25930 in 'dat' file // [1306492410606.jpeg]
Record ID D2EC23E3 is at offset 52123 in 'dat' file // [1306732433796.jpeg]
*** thumbs116x116.key has 9 records
*** Processed 3 records
azazel:Device sheran$

When you parse a key/dat file combination, you need to make sure that both the ‘key’ and ‘dat’ file are in the same directory. When you run bbt, you will point it to the location of the ‘key’ file. From the output above, you can see that it has discovered 3 records, corresponding record ids and offsets where they are stored in the ‘dat’ file. Also, the filename of the thumbnail is provided. What do the offsets mean? Well, if you were to take the numbers and open up the ‘dat’ file in a hex editor, then you would land on the location where that specific record began. This is what it looks like:

The highlighted portion is the first part of the record with the correct starting offset. You may also notice that the ‘key’ file supposedly has 9 records but only 3 were processed. This happens because the ‘key’ file holds 9 record ids and 9 offsets, but only 3 of those actually match up in the ‘dat’ file. One assumption that can be made is that the files were deleted from the ‘dat’ file, but the ids and offsets still remained in the ‘key’ file.

bbt also has the ‘-x’ option which allows you to extract the thumbnails that are inside either the BBThumbs.dat file or the key/dat files. You do this by specifying the ‘-x’ option along with the ‘-o’ option to tell bbt where to extract the thumbnails to. You will need to make sure that the output directory specified by the ‘-o’ option does not already exist.

For now, that’s as much as you’re going to get out of bbt. Some features that are planned in the roadmap for bbt are:

HTML Reporting
Identification of Exif data within thumbnails
Completely parsing some of the header and record bytes that are as yet unknown

I’ll cover the other tools in subsequent posts. For now, though, the tools are all live in the github repository. All of the tools contain a basic README doc that tells you how to get started with each of the tools.

Recover Deleted Data from SQLite Databases

Mon, 29 Nov 2010 06:50:43 +0000

Recovering data from an SQLite database has many uses. Why you ask? One main reason is that SQLite has increased in popularity to epic proportions. It is the most ideal candidate for use in a resource constrained environment. Like where you ask? The industry most benefiting from SQLite at the moment is the mobile phone one. The BlackBerry, Android and iPhone platforms rely on SQLite. As a matter of fact, a large portion of the iPhone’s data storage, like Address Book or SMS Messages are stored in SQLite databases. Google Chrome and Firefox store it’s history and bookmarks in SQLite Databases. The WhatsApp application on a BlackBerry phone stores information on an SQLite Database. It’s everywhere.

With all this popularity, the inner workings of SQLite have held a sense of mystery and intrigue. But not anymore. We’ve cracked the internals of how an SQLite database stores and handles its data. We know where your unreferenced data hides and we know how to recover it. So the next best thing? Write a tool for it. Thus this post serves to introduce our new tool – SQLUn, or simply the SQLite Undeleter. The tool is very ideally suited to Forensics Analysts and investigators who focus on smartphones – most notably iPhones.

SQLUn successfully recovers data from not only unreferenced areas of the database, but also from the slack space of referenced records. In this manner, a Forensic Analyst is certain that data is recovered from every nook and cranny of the database and no area is left unturned. To aid Law Enforcement analysts, SQLUn also has the ability to manage information based on a specific case number. Additionally, data integrity is maintained by conducting SHA1 hashes of all relevant records and databases. Data is further protected by disabling writes to the database and working off a duplicate copy rather than the database file itself. This feature is added to ensure that the database remains intact even if the operator forgets to take a backup.

By now, I’m pretty sure that you’re dying to get your hands on this little gem and I don’t blame you. If you want to become a beta tester for the application, email us at sql-beta@zenconsult.net and we will take it from there. Please provide some details about yourself including where you work and why we should consider you for beta testing the product. If you work in the Law Enforcement industry, please mail us from your agency email address for expedited handling of your beta tester request.

You want the BlackBerry Event Log? beg damnit!

Thu, 01 Jul 2010 07:03:41 +0000

It’s been quite a while since my last post. I’ve been a bit on the busy side with work, family and a bit of research. Inspired by a friend and fellow researcher – Cst. Shafik Punja, I decided to look deeper into BlackBerry connectivity via USB. If I succeeded at understanding this topic, I would be able to directly connect to a BlackBerry device and collect all the information that I wanted. I wouldn’t be bound by tools like JavaLoader or the Desktop Manager and would have the freedom to write my own tools. Well, I succeeded at understanding this and went a step further, I’m releasing a tool today.

I know that many forensic analysts are always looking at ways to pull data off mobile devices without installing invasive tools. So I set about coding a tool to do something simple — pull the BlackBerry Event Log (you can open the event log from a BlackBerry device by holding down “ALT” and typing “LGLG”) from a BlackBerry device. Sure, JavaLoader does this, so to differentiate the tool from JavaLoader, I made it a little more intelligent. I called it beg – BlackBerry Eventlog Grepper. beg can add a little bit of sanity to the madness that is the BlackBerry event log. In other words, it translates the seemingly gibberish looking data to a more human friendly format.

Example Event Log Output:

guid:0x3B91E1630F0745BC time:2010/06/30 22:45:40.0 severity:Always Log type:String app:net.rim.tunnel data:Clos-MagicRudyAPN.rim
guid:0x316C1626A9DDC375 time:2010/06/30 22:45:40.0 severity:Always Log type:String app:net.rim.tcp data:clos
guid:0xB2EC7A712090AD8F time:2010/06/30 22:45:46.0 severity:Always Log type:String app:net.rim.smsui data:UTSC
guid:0xB2EC7A712090AD8F time:2010/06/30 22:45:46.0 severity:Always Log type:String app:net.rim.smsui data:UTSC
guid:0xB2EC7A712090AD8F time:2010/06/30 22:45:54.0 severity:Always Log type:String app:net.rim.smsui data:UTSC
guid:0xB2EC7A712090AD8F time:2010/06/30 22:45:54.0 severity:Always Log type:String app:net.rim.smsui data:UTSC
guid:0xB2EC7A712090AD8F time:2010/06/30 22:45:57.0 severity:Always Log type:String app:net.rim.smsui data:UTSC
guid:0x647E5DBBC34B5549 time:2010/06/30 22:46:09.0 severity:Always Log type:String app:net.rim.clock data:+CHG
guid:0xDAA64EAD4E49C5D5 time:2010/06/30 22:46:09.0 severity:Always Log type:String app:net.rim.usb.pwd data:CbCn
guid:0x5D41D4729582C2DA time:2010/06/30 22:46:09.0 severity:Always Log type:String app:RootRegister data:usbConnectionStateChange:1

I started by looking at the phone calls that are written to the event log. One thing you may notice from the event log is this: If you delete a call from your call history, the event log does not delete it. So if you pull the event logs, you will be caught in a lie. I know that my friend in Law Enforcement would find this invaluable, so I started there. For now, beg is able to dump the event logs, dump only the phone event logs and translate the phone event logs into something more readable. The output looks something like this:

sheran@devbox:~/progs$ ./beg -p -r
Connected to 20fe2f60
2010/06/30 21:07:55.0: Incoming Call from +622157939018
2010/06/30 22:29:19.0: Outgoing Call to 02114045
2010/06/30 22:30:37.0: Outgoing Call to +628119917931
2010/06/30 22:41:54.0: Outgoing Call to +6281219684934
2010/06/30 22:53:27.0: Outgoing Call to +6281219684934
sheran@devbox:~/progs$

Inner workings

First, I’d like to quickly go over the two main ways that you can connect to your BlackBerry device. One of the initial methods I used was to write a Python script to take advantage of the libusb and PyUSB libraries. I would then send raw commands back and forth. These commands were sniffed from legitimate connections made between the BlackBerry and either JavaLoader or Desktop Manager. The second method was to use an already existing library called Barry. Barry was developed to allow Linux users to sync their BlackBerry devices on . Since most of the work was already done, I decided to go with method 2 – using the Barry library. So bear in mind that you will need to install the Barry library and it’s pre-requisites first.

To use beg, just download it and untar/gzip it to a folder. Then, have a look through the README file. It contains everything you would ever need to know. For the moment, beg only works on Linux distributions and does require the Barry library and libusb library. Support can always be found by getting in touch via the Contact page.