Geolocation | Forensic Methods

Archives For Geolocation

Collusion: Browser Tracking

By Chad Tilbury on August 1, 2012 in Browser Forensics, Geolocation — Leave a comment

Collusion for Chrome Graph

While doing some browser forensics research, I stumbled upon a Chrome extension named Collusion for Chrome. This extension provides a visual representation of the tracking information shared with third party sites during web browsing . While the notion of browser tracking is hardly surprising these days, Collusion provides some of the most compelling evidence I have seen for the “Do Not Track” movement.

As an example, the image above shows my browser activity during a brief period. I selected a specific node corresponding to Wired.com and you can see the vast number of external connections a visit to Wired spawns. Information about the various contacted sites can be identified using the following key:

Blue nodes: Sites previously visited by the user
Gray nodes: Third party sites receiving browser data (never visited by user)
Red nodes: Known aggregators of tracking information (the slash indicates the site was blocked by Collusion)

Big Brother Forensics: Device Tracking Using Browser-Based Artifacts (Part 3)

By Chad Tilbury on April 13, 2012 in Computer Forensics, Geolocation, Mobile Devices — 1 Comment

Application Specific Geo-location

Web applications can often leave their own geo-location clues similar to those found via the mapping services. While mapping artifacts are largely consistent, geo-artifacts created by applications are more haphazard. Thus the number of available artifacts can be as numerous as the applications using geo-location services. To illustrate this, we will analyze the artifacts left by two popular location-aware applications: Flickr and Twitter.

Mobile Flickr Geo-artifacts

Big Brother Forensics: Device Tracking Using Browser-Based Artifacts (Part 2)

By Chad Tilbury on April 11, 2012 in Computer Forensics, Geolocation, Mobile Devices — Leave a comment

Understanding Browser Artifacts

Geo-location artifacts demonstrate an interesting concept with regard to browser-based evidence. Among the various browser artifacts, Internet history is a fan favorite because it provides such rich information. There is no easier place to look to identify sites visited by a specific user at a specific time. Browser history is so useful, a critical shortcoming is often ignored; with today’s dynamic web pages, the vast number of web page requests go unrecorded. When a user visits a website, a multitude of requests are completed in the background to retrieve images and advertisements, populate web analytics, and load content from third parties. The content retrieved from these requests is stored within the cache, and an entry within the cache database is created. While the browser history database may only show the page visited, the cache holds most of the components retrieved to dynamically build that page.

Most browser-based geo-location artifacts are not stored within the browser history. Looking back at the HTML5 standard, this makes perfect sense. The fact that the API is JavaScript dependent is the first clue. Also, the multiple steps and asynchronous nature of a geographical lookup indicate a lot is going on behind the scenes when that initial web page is accessed. Luckily, data collected from the host must be passed to a geo-location service and those interactions are often recorded within the browser cache. When content is cached, the URLs associated with the web request are also stored. It is within these requests that we can mine geo-location parameters and coordinates passed to third parties such as Google Maps.

Continue Reading…

Big Brother Forensics: Device Tracking Using Browser-Based Artifacts (Part 1)

By Chad Tilbury on April 9, 2012 in Computer Forensics, Geolocation, Mobile Devices — 2 Comments

Geo-location artifacts have been a frequent focus of my research, and I am amazed at how quickly they are permeating operating systems, applications and file formats. In the fall of 2011 I had the pleasure of writing an article for Digital Forensics Magazine focused on browser-based geo artifacts, where much of this post was originally published.

One of the more revolutionary forensic artifacts to emerge in recent years is geo-location data. Geo-location gives us an accurate means to identify the physical location of an item on Earth. It is now possible to determine where in the world a laptop or mobile phone has been, solely using host-based forensics. In a world of increasingly mobile devices, geo-artifacts can provide a crucial extra dimension to our investigations. With it, we now have the potential to answer who, what, when, why, and where.

Carving Network Packets from Unallocated Space

By Chad Tilbury on January 17, 2012 in Computer Forensics, Geolocation, Linux Forensics — Leave a comment

Excellent paper on recovering network packets from free space. Interesting implications for geolocation | http://t.co/5hv2I83H #DFIR

January 17, 2012 5:53 pm via webReply RetweetFavorite

@chadtilbury

Chad Tilbury

Are You Missing Geolocation Artifacts?

By Chad Tilbury on November 17, 2011 in Computer Forensics, Geolocation — Leave a comment

Geolocation is booming and so are the artifacts left behind by the multitude of services adding this feature. But just how likely are you to find geolocation artifacts during a digital forensics examination? If you are reviewing mobile devices (including laptops), the simple answer is: very likely. The Pew Internet and American Life Project recently released the results of their 2011 study on mobile and social geolocation services. As expected, smartphone owners topped the list of users most likely to use geosocial and location-based services. With over 400 million smartphones estimated to be sold in 2011, the percentages can only go up. Interestingly, almost 30% of non-smartphone users also indicated they use geolocation services.

Geolocation Service Usage

I was happy to see Pew asked respondents about their geolocation preferences. Many services do not have a one-time “use my location” feature or encourage users to save their location sharing settings long-term (see Twitter instructions below). This fire-and-forget approach can result in more interesting artifacts as users no longer consider the possibility that their location is being tagged to an action.

Digital Forensics Magazine: Big Brother Forensics

By Chad Tilbury on November 8, 2011 in Computer Forensics, Geolocation — 1 Comment

My article on geo-location artifacts was chosen as the cover story in Digital Forensics Magazine for this quarter (Issue 9, November 2011). It has been some time since I have written anything for published media, and the process was intriguing. It definitely gives me new respect for journalists that pound out print articles two at a time.

Geo-location forensics has been a focus of my research for a while, and I am fascinated with how much information our devices record about our activities and how little we collectively seem to care. You can record my browsing habits all day long, but once you start tracking my physical location, it feels so much more like spying. Hence the title, Big Brother Forensics. As smartphones and mobile devices near 75% of personal computer sales, geo-tracking capabilities will become even more pervasive, and even more lucrative to marketers. Importantly, devices can be geo-located and store location artifacts even if they do not contain a GPS capability. This includes laptops, netbooks, and older smartphones. Many of the most popular applications today, like Twitter, store information that can be used to pinpoint a device’s location, even if the user has not opted into sharing his/her location. This is great for forensic analysts, but consider the ramifications when malware authors begin to take advantage of this.

“The Windows Mobile operating system is clearly sending information that can lead to accurate location information of the mobile device regardless of whether the user allowed it”

– Samy Kamkar http://cnet.co/qail1o

Windows Mobile Geolocation Collection

Posted on September 1, 2011 In Geolocation, Mobile Devices

Geolocate pictures without EXIF

By Chad Tilbury on July 31, 2011 in Computer Forensics, Geolocation — Leave a comment

Geolocate pictures without EXIF data -> Google image search is incredible. http://t.co/ehH2iJY #DFIR #privacy

July 31, 2011 5:23 am via webReply RetweetFavorite

@chadtilbury

Chad Tilbury

Feds are “thoroughly addicted to location data.”

http://bit.ly/kQYe3L

Bill Would Keep Big Brother’s Mitts Off Your GPS Data

Posted on May 27, 2011 In Geolocation

FOR408: Windows Forensics

10/08/13 - 10/13/13 FOR408: Windows Forensics in Prague, CZ at SANS Forensics Europe

FOR508: Advanced Forensics & Incident Response

07/11/13 - 07/16/13 FOR508: Advanced Forensics & Incident Response in Austin, TX at SANS DFIR Summit
09/16/13 - 09/21/13 FOR508: Advanced Forensics & Incident Response in Las Vegas, NV at SANS Network Security 2013
11/18/13 - 11/23/13 FOR508: Advanced Forensics & Incident Response in Seoul at SANS Korea 2013