EnCE · Domain 7
Communication Artifacts
About 10% of the exam
Sources of communication evidence
- Device store
- local database on the handset
- Backup
- copy on a computer or cloud
- Server records
- provider held content and metadata
- Carrier records
- call and message routing detail
- Companion device
- tablet or desktop syncing the account
- Network capture
- timing and volume, rarely content
A message missing from one device may still exist on a backup, a companion device or the provider
Call detail records
- Numbers, direction, duration and time
- Serving cell indicates an approximate area
- Unanswered attempts differ from completed calls
- Duration definitions vary between providers
- Records prove routing, not who spoke
- Time zone of the record must be confirmed
Email as evidence
- Read the received chain from the bottom
- The lowest hop is nearest the origin
- Envelope sender differs from the display sender
- Reply address may route elsewhere entirely
- Compare the claimed date against relay times
- Export the raw message and hash it
Mail authentication results
- Sender policy check
- was this server allowed to send
- Signature check
- headers and body signed cryptographically
- Alignment policy
- results must match the visible domain
- Soft fail
- unauthorized but not rejected
- Pass without trust
- authentic domain, still a fraud
- Look alike domain
- passes checks, imitates a brand
Messaging platforms
Storage
- Local databases hold chats and attachments
- Encrypted stores need a device key
- Write ahead logs keep recent rows
- Attachments often sit outside the database
Encryption
- End to end protects content in transit
- Cloud chats may live on the server
- Key material presence shows the scheme used
- Protocol and version change what is recoverable
Metadata that survives
- Participant lists and group membership
- Message timestamps and sizes
- Delivery and read indicators
- Notification records on the device
Even without content, who contacted whom and when is often the finding the case actually needs
Delivery and read state
- Delivered means it reached the device
- Read means the application reported viewing
- Notification plus unlock supports actual awareness
- Indicators can be disabled by the user
- Platforms define these states differently
- State the platform version examined
Group and multi party context
- Record membership at the time of sending
- Current membership can mislead badly
- Administrators may have removed participants
- Message deletion may be per user
- Forwarded content changes the origin question
- Note who could actually see each message
Voice and other channels
- Voicemail
- audio plus a received timestamp
- Internet calling
- provider logs define session boundaries
- Conference platform
- join, leave and device records
- Fax log
- numbers, date and transmission result
- Satellite terminal
- gaps may be terrain, not power
- Push notification
- arrival record independent of the app
Attribution problems
- Accounts are shared more often than assumed
- A number can be spoofed at the caller
- Subscriber changes when the card is swapped
- One person may use several devices
- Absence from one device proves very little
- Corroborate with independent activity records
Routing records can show the true path a call took, which is how spoofing is exposed
Correlating communications
Across sources
- Device store against provider records
- Backup content against live device
- Network timing against message timestamps
- Notification history against unlock events
Across parties
- Both sides of a conversation where available
- Group membership at the moment of sending
- Forwarding chains and reply threads
- Contact list entries naming the parties
Across time
- Normalize every source to one zone
- Watch for provider clock differences
- Sequence bursts rather than single messages
- Note gaps and explain them
Legal process for content
- Provider content usually needs formal process
- Metadata and content may have different thresholds
- Preservation requests stop routine deletion
- Account recovery access must be documented
- Cross border data adds another regime
- Record the authority for every retrieval
Reporting communications
- Name the source of every message shown
- Give timestamps with their time zone
- Distinguish delivered from read
- State the platform and version examined
- Show what encryption prevented recovering
- Attach the custody record for exports
Key artifacts
- Received chain
- true path an email traveled
- Queue identifier
- links server log entries together
- Write ahead log
- recent rows not yet merged
- Notification record
- arrival independent of the application
- Participant snapshot
- who was in the group then
- Serving cell
- approximate area, not a coordinate
Know the order
- Identify the accounts
- Collect device stores
- Add backups and companions
- Request provider records
- Normalize the clocks
- Correlate and report
Collect every copy before concluding anything, because one device is the weakest possible view
Reference strip: communications
- Received chain read upward
- Envelope versus display sender
- Authentication and alignment results
- Server queue log entries
Messaging
- Local encrypted databases
- Attachment storage locations
- Delivery and read indicators
- Group membership history
Telephony
- Call detail records
- Serving cell approximations
- Voicemail and notification records
- Carrier routing for spoofing checks
Attribution
- Shared accounts and devices
- Subscriber card swaps
- Companion device syncing
- Independent activity corroboration
Process
- Preservation requests to providers
- Formal process for content
- Documented recovery access
- Custody for every export
Quick exam traps
- Trap: A call detail record proves the two parties spoke
- Trap: A cell tower record gives a precise location
- Trap: A message absent from the handset was never sent
- Trap: Delivered and read mean the same thing
- Trap: The current group membership shows who saw the message
- Trap: Two providers must report identical call durations
- Trap: A gap in a terminal log proves the device was switched off
cybercertprep.com · original revision sheet written from the public body of knowledge