1 1 00:00:00,330 --> 00:00:02,460 Mobile Forensics. 2 2 00:00:02,460 --> 00:00:03,900 Now, you may be wondering, 3 3 00:00:03,900 --> 00:00:07,050 Why am I bringing up mobile technologies and forensics 4 4 00:00:07,050 --> 00:00:09,750 inside of this section of the course when we're talking 5 5 00:00:09,750 --> 00:00:13,110 about application related indicators of compromise? 6 6 00:00:13,110 --> 00:00:16,200 Well, the reason is a lot of our applications these days 7 7 00:00:16,200 --> 00:00:18,510 are being run on mobile devices, 8 8 00:00:18,510 --> 00:00:20,340 and these mobile devices can be a vector 9 9 00:00:20,340 --> 00:00:22,500 or a target for many of our incidents, 10 10 00:00:22,500 --> 00:00:25,110 especially in an enterprise environment. 11 11 00:00:25,110 --> 00:00:26,640 Another issue we have to consider here 12 12 00:00:26,640 --> 00:00:28,140 when we're dealing with mobile devices 13 13 00:00:28,140 --> 00:00:30,120 is the fact that many of them connect 14 14 00:00:30,120 --> 00:00:32,040 to our corporate networks. 15 15 00:00:32,040 --> 00:00:35,190 For example, if you use a VPN to connect your mobile device 16 16 00:00:35,190 --> 00:00:36,900 back into your corporate network 17 17 00:00:36,900 --> 00:00:39,180 and there's something wrong on your mobile device 18 18 00:00:39,180 --> 00:00:40,380 that was already attacked, 19 19 00:00:40,380 --> 00:00:43,260 you can now bring that into the corporate network as well. 20 20 00:00:43,260 --> 00:00:45,450 And so this can actually lead to cases 21 21 00:00:45,450 --> 00:00:46,950 where we have to conduct forensics 22 22 00:00:46,950 --> 00:00:49,530 on your endpoint, your mobile device, 23 23 00:00:49,530 --> 00:00:52,770 to find out exactly what the intrusion vector was. 24 24 00:00:52,770 --> 00:00:54,270 Now, as we go through this section 25 25 00:00:54,270 --> 00:00:56,640 we're going to talk about a couple of key areas. 26 26 00:00:56,640 --> 00:00:58,620 We're going to talk about data collection, 27 27 00:00:58,620 --> 00:01:00,630 extraction and analysis methods, 28 28 00:01:00,630 --> 00:01:03,090 forensic software, and carrier logs, 29 29 00:01:03,090 --> 00:01:04,740 and how we're going to relate all of these 30 30 00:01:04,740 --> 00:01:06,540 to mobile device forensics. 31 31 00:01:06,540 --> 00:01:08,940 First, let's talk about data collection. 32 32 00:01:08,940 --> 00:01:11,490 We're going to have to have tools that facilitate the imaging 33 33 00:01:11,490 --> 00:01:15,060 of a mobile device's system memory, the RAM inside of it, 34 34 00:01:15,060 --> 00:01:16,830 as well as the flash memory that's used 35 35 00:01:16,830 --> 00:01:20,010 for persistent storage that acts as its hard drive. 36 36 00:01:20,010 --> 00:01:22,140 Even though mobile devices don't have hard drives 37 37 00:01:22,140 --> 00:01:23,730 they have solid state devices, 38 38 00:01:23,730 --> 00:01:26,580 this is really that flash memory we're talking about. 39 39 00:01:26,580 --> 00:01:28,740 Now, how are we going to collect that information? 40 40 00:01:28,740 --> 00:01:31,290 Because the data is stored on flash memory chips 41 41 00:01:31,290 --> 00:01:33,210 that are soldered to the system board. 42 42 00:01:33,210 --> 00:01:35,460 So it's not as easy as going into a laptop 43 43 00:01:35,460 --> 00:01:37,170 and removing a hard drive. 44 44 00:01:37,170 --> 00:01:39,300 We have this soldered on memory chip, 45 45 00:01:39,300 --> 00:01:42,180 and that becomes really difficult for us to work with. 46 46 00:01:42,180 --> 00:01:43,890 Yes, it's true that if we're dealing 47 47 00:01:43,890 --> 00:01:45,540 with a law enforcement effort, 48 48 00:01:45,540 --> 00:01:48,870 we can have experts who know how to desolder these boards 49 49 00:01:48,870 --> 00:01:52,470 and collect them bit by bit using off-chip methods, 50 50 00:01:52,470 --> 00:01:55,860 but for most of us, we are not going to have that capability. 51 51 00:01:55,860 --> 00:01:58,680 And so instead, we're going to have to hook up these devices 52 52 00:01:58,680 --> 00:02:00,870 and use something like a debugging port 53 53 00:02:00,870 --> 00:02:03,720 or a joint test action group hardware interface 54 54 00:02:03,720 --> 00:02:07,140 that allow us to get the information off of those devices. 55 55 00:02:07,140 --> 00:02:10,110 Now, all modern iOS and Android devices 56 56 00:02:10,110 --> 00:02:12,630 also have encryption enabled by default 57 57 00:02:12,630 --> 00:02:14,580 for these solid state devices. 58 58 00:02:14,580 --> 00:02:16,950 So the data on them is going to be encrypted. 59 59 00:02:16,950 --> 00:02:19,650 So we better have a way to decrypt them as well. 60 60 00:02:19,650 --> 00:02:22,020 The easiest way is if we have the password 61 61 00:02:22,020 --> 00:02:24,660 or the user unlocks the device for us. 62 62 00:02:24,660 --> 00:02:26,490 If we're working with somebody in our organization 63 63 00:02:26,490 --> 00:02:29,040 that's cooperative as part of our investigation, 64 64 00:02:29,040 --> 00:02:30,450 that will likely happen. 65 65 00:02:30,450 --> 00:02:32,370 But if we're dealing with a law enforcement action, 66 66 00:02:32,370 --> 00:02:34,320 again, that's unlikely to happen, 67 67 00:02:34,320 --> 00:02:36,030 and we're going to have to use other methods 68 68 00:02:36,030 --> 00:02:38,460 including something like a zero-day exploit 69 69 00:02:38,460 --> 00:02:40,170 to get into that device. 70 70 00:02:40,170 --> 00:02:42,780 Now, one other area that I want to bring up real quick 71 71 00:02:42,780 --> 00:02:45,150 is if you're working for law enforcement 72 72 00:02:45,150 --> 00:02:48,210 and you're worried about that device being remotely wiped, 73 73 00:02:48,210 --> 00:02:49,890 you do want to collect your devices 74 74 00:02:49,890 --> 00:02:52,260 and put them in a Faraday bag. 75 75 00:02:52,260 --> 00:02:54,510 A Faraday bag is simply a device that allows you 76 76 00:02:54,510 --> 00:02:57,060 putting your smartphones or tablets into that, 77 77 00:02:57,060 --> 00:03:00,420 and it blocks any radio frequency from getting into that. 78 78 00:03:00,420 --> 00:03:03,270 So if I had a device, for instance, an iPhone, 79 79 00:03:03,270 --> 00:03:05,790 and I place it in the bag and seal up the bag, 80 80 00:03:05,790 --> 00:03:09,120 it won't let the cellular signal get in or out of that bag. 81 81 00:03:09,120 --> 00:03:12,060 That way an attacker can't remotely send a kill command 82 82 00:03:12,060 --> 00:03:15,990 or a wipe command to that device once I have it in custody. 83 83 00:03:15,990 --> 00:03:17,130 Again, this is something 84 84 00:03:17,130 --> 00:03:19,350 that all law enforcement is trained on, 85 85 00:03:19,350 --> 00:03:21,930 and they use this as one of their standard procedures 86 86 00:03:21,930 --> 00:03:24,180 to ensure nobody can affect that device 87 87 00:03:24,180 --> 00:03:25,860 after they've collected it. 88 88 00:03:25,860 --> 00:03:28,740 Now, there is one other area that we have to touch on, 89 89 00:03:28,740 --> 00:03:31,590 and I know that I have students from all around the world, 90 90 00:03:31,590 --> 00:03:32,820 but here in the United States, 91 91 00:03:32,820 --> 00:03:35,490 we have something known as the Fifth Amendment. 92 92 00:03:35,490 --> 00:03:37,830 Now in the United States, the Fifth Amendment means 93 93 00:03:37,830 --> 00:03:40,140 that a suspect cannot be compelled 94 94 00:03:40,140 --> 00:03:42,600 to give you access to their devices. 95 95 00:03:42,600 --> 00:03:45,000 For example, if I have my smartphone, 96 96 00:03:45,000 --> 00:03:47,730 and I have evidence on there that's incriminating to me, 97 97 00:03:47,730 --> 00:03:49,560 and you ask me to unlock my smartphone 98 98 00:03:49,560 --> 00:03:53,430 by using my thumbprint, or my face, or even my PIN number, 99 99 00:03:53,430 --> 00:03:55,890 I don't have to do that if that would give you access 100 100 00:03:55,890 --> 00:03:58,320 to incriminating evidence on my device. 101 101 00:03:58,320 --> 00:04:00,330 That's part of the Fifth Amendment. 102 102 00:04:00,330 --> 00:04:03,630 This has been upheld in courts time and time again. 103 103 00:04:03,630 --> 00:04:05,730 This may not apply in your region of the world 104 104 00:04:05,730 --> 00:04:07,320 if you're outside of the United States, 105 105 00:04:07,320 --> 00:04:09,330 but this is a big area of concern 106 106 00:04:09,330 --> 00:04:12,360 inside the United States and for U.S. companies, 107 107 00:04:12,360 --> 00:04:13,590 especially if you're doing something 108 108 00:04:13,590 --> 00:04:16,560 like a Bring Your Own Device Policy where you allow users 109 109 00:04:16,560 --> 00:04:19,380 to bring their own devices onto your corporate network. 110 110 00:04:19,380 --> 00:04:20,430 Once they do that, 111 111 00:04:20,430 --> 00:04:22,020 that doesn't automatically give you a right 112 112 00:04:22,020 --> 00:04:23,760 to go and search their devices. 113 113 00:04:23,760 --> 00:04:26,130 That would be an unlawful search and seizure. 114 114 00:04:26,130 --> 00:04:29,160 And so this is an area you have to be thinking about 115 115 00:04:29,160 --> 00:04:31,020 as you're dealing with different devices. 116 116 00:04:31,020 --> 00:04:33,300 And if you're working with law enforcement, remember, 117 117 00:04:33,300 --> 00:04:36,390 there are rules against what you can and cannot do. 118 118 00:04:36,390 --> 00:04:38,850 And one of those things is you can't take the device 119 119 00:04:38,850 --> 00:04:41,040 and hold it up to somebody's face to unlock it, 120 120 00:04:41,040 --> 00:04:44,070 because that would be a violation of the Fifth Amendment. 121 121 00:04:44,070 --> 00:04:45,570 Now, let's go into our second area. 122 122 00:04:45,570 --> 00:04:47,760 Let's assume that we've gotten into the device. 123 123 00:04:47,760 --> 00:04:50,910 Now, we need to extract and analyze the data. 124 124 00:04:50,910 --> 00:04:52,350 And we're going to use extraction 125 125 00:04:52,350 --> 00:04:54,060 and analysis methods for this. 126 126 00:04:54,060 --> 00:04:56,490 These are analysis techniques for mobile devices, 127 127 00:04:56,490 --> 00:04:59,250 and many of them are very similar to what we talked about 128 128 00:04:59,250 --> 00:05:01,350 with Windows and Linux workstations. 129 129 00:05:01,350 --> 00:05:03,690 Since most of our mobile devices actually rely 130 130 00:05:03,690 --> 00:05:05,940 on Unix-like operating systems. 131 131 00:05:05,940 --> 00:05:08,580 If you're using iOS, which is what iPhones use 132 132 00:05:08,580 --> 00:05:10,710 that is a Unix-based operating system. 133 133 00:05:10,710 --> 00:05:11,910 If you're using Android, 134 134 00:05:11,910 --> 00:05:13,920 it's a Linux-based operating system. 135 135 00:05:13,920 --> 00:05:16,890 If you're using one of those older Windows mobile devices, 136 136 00:05:16,890 --> 00:05:19,410 that relies on a Windows-based operating system. 137 137 00:05:19,410 --> 00:05:21,900 So again, all three of these still have roots 138 138 00:05:21,900 --> 00:05:24,810 in the Windows and Linux and Unix world, 139 139 00:05:24,810 --> 00:05:26,310 and therefore, it's going to use a lot 140 140 00:05:26,310 --> 00:05:29,010 of the same type of techniques that we used before. 141 141 00:05:29,010 --> 00:05:30,570 As we begin our extraction, 142 142 00:05:30,570 --> 00:05:32,970 there are four different ways we can do this. 143 143 00:05:32,970 --> 00:05:35,130 The first is manual extraction. 144 144 00:05:35,130 --> 00:05:37,380 This means we're going to take the device 145 145 00:05:37,380 --> 00:05:39,990 and simply scroll through the settings and the app screens 146 146 00:05:39,990 --> 00:05:41,760 to find the information we need. 147 147 00:05:41,760 --> 00:05:43,830 So if I'm part of a law enforcement team 148 148 00:05:43,830 --> 00:05:45,810 and I find a device sitting on a counter 149 149 00:05:45,810 --> 00:05:48,450 and it's already unlocked, I can actually pick it up 150 150 00:05:48,450 --> 00:05:50,070 and start looking through that, 151 151 00:05:50,070 --> 00:05:52,560 looking through the contacts, the call logs, 152 152 00:05:52,560 --> 00:05:54,570 previous areas they've looked at on maps, 153 153 00:05:54,570 --> 00:05:56,610 or different addresses they've navigated to, 154 154 00:05:56,610 --> 00:05:58,260 and collect that information. 155 155 00:05:58,260 --> 00:05:59,580 Now, if you're doing this, 156 156 00:05:59,580 --> 00:06:01,440 you should have somebody over your shoulder 157 157 00:06:01,440 --> 00:06:04,230 filming a video showing everything you're doing. 158 158 00:06:04,230 --> 00:06:05,160 This way you can prove 159 159 00:06:05,160 --> 00:06:07,110 there are no changes being introduced. 160 160 00:06:07,110 --> 00:06:09,150 For instance, you're not making phone calls 161 161 00:06:09,150 --> 00:06:10,687 that could then later be put in there and saying, 162 162 00:06:10,687 --> 00:06:13,020 "Oh, this bad person had made a phone call 163 163 00:06:13,020 --> 00:06:14,340 to this drug dealer," 164 164 00:06:14,340 --> 00:06:16,050 and you were really the one who made the call. 165 165 00:06:16,050 --> 00:06:18,150 So you need to make sure none of that happens. 166 166 00:06:18,150 --> 00:06:21,120 Second, we can move into logical extraction. 167 167 00:06:21,120 --> 00:06:24,450 Now, logical extraction refers to using different utilities. 168 168 00:06:24,450 --> 00:06:27,030 They're supplied by the device or the vendor 169 169 00:06:27,030 --> 00:06:29,370 to extract the data for later analysis. 170 170 00:06:29,370 --> 00:06:31,770 For example, if you have somebody who has an iPhone, 171 171 00:06:31,770 --> 00:06:34,050 you can do a data backup to iCloud. 172 172 00:06:34,050 --> 00:06:35,640 And then from iCloud, 173 173 00:06:35,640 --> 00:06:37,710 you could get that information you needed. 174 174 00:06:37,710 --> 00:06:39,000 This is one of the ways to do it. 175 175 00:06:39,000 --> 00:06:41,490 It's an easy way to get the information off the device, 176 176 00:06:41,490 --> 00:06:43,980 into another area for later analysis. 177 177 00:06:43,980 --> 00:06:47,250 Again, if your device was encrypted, that key, 178 178 00:06:47,250 --> 00:06:49,380 if you don't have it, you're not going to get into the data. 179 179 00:06:49,380 --> 00:06:51,270 Even if you back it up to iCloud, 180 180 00:06:51,270 --> 00:06:53,760 iCloud's going to require that key to unlock that data 181 181 00:06:53,760 --> 00:06:56,370 'cause it's going to do an encrypted backup. 182 182 00:06:56,370 --> 00:06:58,530 If you're using an Android device, for example, 183 183 00:06:58,530 --> 00:07:00,270 you can also do logical extraction 184 184 00:07:00,270 --> 00:07:02,400 over the device's debug interface, 185 185 00:07:02,400 --> 00:07:06,090 which is known as ADB, the Android Debug Bridge. 186 186 00:07:06,090 --> 00:07:09,210 This will allow you to retrieve data off the device as well. 187 187 00:07:09,210 --> 00:07:10,560 The third way we can do things 188 188 00:07:10,560 --> 00:07:12,900 is by doing a file system extraction. 189 189 00:07:12,900 --> 00:07:15,600 Now, a file system extraction is where we're going to start 190 190 00:07:15,600 --> 00:07:18,390 making a copy of all the unencrypted data, 191 191 00:07:18,390 --> 00:07:20,190 just like we did when we did an image before 192 192 00:07:20,190 --> 00:07:22,260 of a desktop or a laptop, and then we would go 193 193 00:07:22,260 --> 00:07:25,500 into something like EnCase or FTK to analyze it. 194 194 00:07:25,500 --> 00:07:27,600 Now, that will work for these devices, 195 195 00:07:27,600 --> 00:07:30,240 but again, remember, they're not Windows or Linux. 196 196 00:07:30,240 --> 00:07:31,800 They are Android and iOS, 197 197 00:07:31,800 --> 00:07:34,440 and so there are special tools you may need. 198 198 00:07:34,440 --> 00:07:37,290 A lot of the data that's stored on these devices is stored 199 199 00:07:37,290 --> 00:07:41,760 inside of individual databases known as SQLite databases. 200 200 00:07:41,760 --> 00:07:43,860 So if you download those, 201 201 00:07:43,860 --> 00:07:46,110 that's not a file you can just easily open up 202 202 00:07:46,110 --> 00:07:48,270 unless you have a specific tool to do that, 203 203 00:07:48,270 --> 00:07:50,640 such as an SQL database browser 204 204 00:07:50,640 --> 00:07:52,380 like you see here on the screen. 205 205 00:07:52,380 --> 00:07:54,480 This will allow you to get the information out of that, 206 206 00:07:54,480 --> 00:07:57,510 and a lot of these databases contain a lot of information, 207 207 00:07:57,510 --> 00:08:00,000 such as logs and user-generated data. 208 208 00:08:00,000 --> 00:08:02,940 All of that could be evidence in your investigation. 209 209 00:08:02,940 --> 00:08:05,250 Our fourth method of extraction for mobile devices 210 210 00:08:05,250 --> 00:08:07,020 is call data extraction. 211 211 00:08:07,020 --> 00:08:09,000 Now, this is where you can use tools 212 212 00:08:09,000 --> 00:08:11,820 to pull out information off of a SIM card. 213 213 00:08:11,820 --> 00:08:14,610 This would give you things like outgoing calls, 214 214 00:08:14,610 --> 00:08:17,010 text messages, and other things like that 215 215 00:08:17,010 --> 00:08:18,690 that could be stored on that SIM card, 216 216 00:08:18,690 --> 00:08:20,340 including their contacts. 217 217 00:08:20,340 --> 00:08:22,620 All of this is data that could be possible evidence 218 218 00:08:22,620 --> 00:08:24,240 in your investigation. 219 219 00:08:24,240 --> 00:08:26,490 Now, the third main area we need to talk about 220 220 00:08:26,490 --> 00:08:29,250 is mobile device forensic software. 221 221 00:08:29,250 --> 00:08:32,400 As I said, lots of these devices are Unix-based 222 222 00:08:32,400 --> 00:08:35,760 or Linux-based, but there are specific tools you can use 223 223 00:08:35,760 --> 00:08:39,060 to collect this data a lot easier and then analyze it. 224 224 00:08:39,060 --> 00:08:42,090 For example, Cellebrite is one of these tools. 225 225 00:08:42,090 --> 00:08:44,580 This is a tool that's focused on evidence extraction 226 226 00:08:44,580 --> 00:08:46,980 from smartphones and other mobile devices, 227 227 00:08:46,980 --> 00:08:48,810 including older feature phones 228 228 00:08:48,810 --> 00:08:51,210 and from cloud data and metadata 229 229 00:08:51,210 --> 00:08:55,530 using a universal forensic extraction device, or UFED. 230 230 00:08:55,530 --> 00:08:59,010 Now, what is a universal forensic extraction device? 231 231 00:08:59,010 --> 00:09:01,620 Well, this is essentially a standalone device. 232 232 00:09:01,620 --> 00:09:04,110 And you can just take the phone and plug it into it, 233 233 00:09:04,110 --> 00:09:07,440 and this all in one device does all the hard work for you. 234 234 00:09:07,440 --> 00:09:09,300 It does a forensically sound image, 235 235 00:09:09,300 --> 00:09:11,100 and then allows you to analyze the data 236 236 00:09:11,100 --> 00:09:13,710 from within this standalone workstation. 237 237 00:09:13,710 --> 00:09:16,320 In addition to this, Cellebrite does sell a version 238 238 00:09:16,320 --> 00:09:19,560 that is software-based that could be loaded onto a laptop, 239 239 00:09:19,560 --> 00:09:23,040 but most people prefer to use the standalone solution. 240 240 00:09:23,040 --> 00:09:24,420 Now, another tool you can use 241 241 00:09:24,420 --> 00:09:28,680 is what's known as the Mobile Phone Examiner Plus, or MPE+. 242 242 00:09:28,680 --> 00:09:30,660 This is a mobile device forensics tool 243 243 00:09:30,660 --> 00:09:32,370 that's created by AccessData, 244 244 00:09:32,370 --> 00:09:34,740 which is the developers of FTK. 245 245 00:09:34,740 --> 00:09:36,780 Essentially, this is a tool that allows us 246 246 00:09:36,780 --> 00:09:39,270 to do a lot of the features like FTK would, 247 247 00:09:39,270 --> 00:09:42,300 but designed specifically for mobile phones. 248 248 00:09:42,300 --> 00:09:45,810 Just like FTK has their version, EnCase has theirs. 249 249 00:09:45,810 --> 00:09:48,720 And EnCase Portable is a mobile device forensic tool 250 250 00:09:48,720 --> 00:09:50,310 created by Guidance Software, 251 251 00:09:50,310 --> 00:09:52,500 the developers of EnCase, and again, 252 252 00:09:52,500 --> 00:09:56,040 this is basically the mobile phone version of EnCase. 253 253 00:09:56,040 --> 00:09:58,290 The fourth and final area we need to talk about 254 254 00:09:58,290 --> 00:10:00,270 is carrier provided logs. 255 255 00:10:00,270 --> 00:10:02,520 This is any records of device activity 256 256 00:10:02,520 --> 00:10:04,110 that could be acquired 257 257 00:10:04,110 --> 00:10:06,240 from the mobile device's cellular service provider 258 258 00:10:06,240 --> 00:10:08,100 with the use of a warrant. 259 259 00:10:08,100 --> 00:10:10,740 Now, this is really important because as a company, 260 260 00:10:10,740 --> 00:10:12,330 we are not going to be able to do this, 261 261 00:10:12,330 --> 00:10:15,540 but if you're working for law enforcement, you could. 262 262 00:10:15,540 --> 00:10:17,850 As you go through, you're going to be able to find a lot 263 263 00:10:17,850 --> 00:10:19,470 of information from these carriers 264 264 00:10:19,470 --> 00:10:21,360 if you have the right warrant. 265 265 00:10:21,360 --> 00:10:23,340 Now, one of the things to keep in mind here 266 266 00:10:23,340 --> 00:10:24,630 is that a lot of the information 267 267 00:10:24,630 --> 00:10:26,910 has a very short retention period. 268 268 00:10:26,910 --> 00:10:30,540 For example, personal identifiable information, or PII, 269 269 00:10:30,540 --> 00:10:32,700 has an extremely short retention period 270 270 00:10:32,700 --> 00:10:34,500 due to different privacy laws. 271 271 00:10:34,500 --> 00:10:36,630 And so if you're trying to go into an investigation 272 272 00:10:36,630 --> 00:10:38,760 and ask for data from a year ago, 273 273 00:10:38,760 --> 00:10:41,250 that company may not have it anymore. 274 274 00:10:41,250 --> 00:10:43,440 Instead, you need to ask for things quickly 275 275 00:10:43,440 --> 00:10:45,750 when you need it, using the appropriate warrants. 276 276 00:10:45,750 --> 00:10:47,370 And again, this really only applies 277 277 00:10:47,370 --> 00:10:49,680 to law enforcement professionals. 278 278 00:10:49,680 --> 00:10:51,600 So what kind of information can you get 279 279 00:10:51,600 --> 00:10:53,430 from carrier provided logs? 280 280 00:10:53,430 --> 00:10:55,530 Well, you can get call details. 281 281 00:10:55,530 --> 00:10:57,300 You can get voicemail details. 282 282 00:10:57,300 --> 00:11:00,210 You can get text message, or SMS, details. 283 283 00:11:00,210 --> 00:11:02,790 You can even get images sent over those text messages 284 284 00:11:02,790 --> 00:11:04,590 using the MMS service. 285 285 00:11:04,590 --> 00:11:06,660 You can get IP address destinations 286 286 00:11:06,660 --> 00:11:08,760 of what they're trying to browse over the internet. 287 287 00:11:08,760 --> 00:11:10,410 You can get session information, 288 288 00:11:10,410 --> 00:11:12,570 and you can get geolocation data 289 289 00:11:12,570 --> 00:11:13,980 such as where was that device, 290 290 00:11:13,980 --> 00:11:16,380 at what time, and in what day. 291 291 00:11:16,380 --> 00:11:19,110 This is all really important information that you can get 292 292 00:11:19,110 --> 00:11:21,060 if you get it from your carrier provider. 293 293 00:11:21,060 --> 00:11:23,790 But again, you are going to have to have a legal warrant 294 294 00:11:23,790 --> 00:11:25,350 to be able to legally search and seize 295 295 00:11:25,350 --> 00:11:26,970 that information from the carrier, 296 296 00:11:26,970 --> 00:11:28,350 and they're not going to provide it to you 297 297 00:11:28,350 --> 00:11:29,463 without that warrant.