iOS anti-forensics: How can we securely conceal, delete and insert data?

In fulfilment of the requirements for the degree of M.Sc. (Cyber Security and Forensic Computing), I have conducted research on the under-studied area of anti-mobile forensics and formulated three novel techniques: a “Concealment” procedure to enhance the security of non-protected data that is at rest on iOS devices, a “Deletion” procedure to prevent data recovery from iOS devices, and an “Insertion” procedure to surreptitiously implant false evidence into iOS devices. Findings were accepted for publication by the Hawaii International Conference on System Sciences (HICSS 2014) (ERA A Rank):

D’Orazio C, Ariffin A and Choo K-K R 2014. iOS anti-forensics: How can we securely conceal, delete and insert data?. In 47th Annual Hawaii International Conference on System Sciences (HICSS 2014), 6–9 January 2014, IEEE Computer Society Press [In press].

This publication can be accessed via http://ssrn.com/abstract=2339819.

Figure 1 shows how the "Concealment" and "Deletion" procedures impact on the decryption of files on iOS devices.

Figure 1

Both procedures generate the results illustrated in Figure 2.

Figure 2

The different between "Concealment" and "Deletion" is that the latter is irreversible. Thus, the concealment procedure might be appropriate for those users who intend to safely store private or sensitive information on iOS devices that cannot be recovered when applying digital forensic techniques (e.g, if the device is stolen, misplaced, etc.). On the other hand, the deletion procedure becomes of importance to definitely thwart criminal investigations.