dissertation

phone contacts were visible (figure 5.18b).XRY does not have functionality for reading data from the SIM throughthe phone. It requires the SIM to be removed and inserted into an externalreader. Therefore, SIM anti-forensics on the phone have no effect on XRY.5.4.8 Hiding SMS messagesThe phone will be reinstalled using a modified CyanogenMod 7.2 operatingsystem. The only modification will be to the SMS provider, which will bechanged to return no SMS messages when the phone is in USB debuggingmode.Before the phone is connected to any analysis tool, an SMS message willbe sent to it. This should produce a notification and be visible in the SMSapplication. Then, the phone will be connected to each of Cellebrite andXRY in turn, and extractions of SMS messages performed. No messagesshould be extracted. While the phone is still connected to each tool, anotherSMS will be sent to it. This should not produce a notification and shouldnot be visible to the user. The built-in messaging application should showno messages while the phone is connected using USB debugging.No notifications were produced when messages were sent to the phonewhile it was connected to the analysis tools. After the phone was disconnectedfrom the tools, the messages were available through the standardphone application.Cellebrite found no SMS messages when the anti-forensics was enabled,as seen in figure 5.19b. The message “SMS Information Not Available” seemsto be an error message. However, it is also present when the phone is runningstandard CyanogenMod and legitimately has no SMS messages stored.XRY also did not find any SMS messages when the anti-forensics wasenabled. The extraction report from XRY does not detail which pieces ofinformation were sought, only which were returned, so the report simply lacksa section for SMS messages. The built-in messaging application showed nomessages while the phone’s USB debugging connection was active (figure5.20b).44