Hash values of files sent via MMS can vary

Multimedia Messaging Service is used by cell phones to send video, audio and multiple images. It contrasts with Short Message Service that can only send text up to 160 characters in a message. Unlike other files collected from a mobile device, images sent on separate occasions via MMS can have different hash values. A study conducted by researchers at Purdue University concluded that, " While the results for the majority of tests were uniform, the hash values reported for data objects transferred via Multimedia Messaging Service (MMS) were variable." Shira Danker, Rick Ayers, and Richard P. Mislan, Hashing Techniques for Mobile Device Forensics, 3 Small Scale Digital Device Forensics J. No. 1 (June 2009).

The study shows that the same JPEG file sent via MMS on different devices at different times would have an entirely different hash value.

Whatsapp photos inadvertently saved on iPhone

When you’re collecting digital evidence from an iPhone keep in mind that WhatsApp may save photos to the phone by default- any

photos any group decides to forward to the phone’s owner. So the photos on the camera roll are not necessarily ones that the user saved.

Check under settings for WhatsApp, and under Chats . . .see if the option for ‘Save to Camera Roll’ is checked off.

It’s a good idea to keep this deactivated not only to save storage space but also to avoid any confusion about where suspect photos on a cell phone came from.

Pegasus Attacks! Be on Watch!

The big news today was about Pegasus, the exploit targeting Apple devices. Pegasus exploits a vulnerability in iMessage, and can install itself on a device without a user doing anything to facilitate the installation. The spyware allows an attacker to steal messages, emails, and location data, and record with the camera and microphone.

Don't miss that you need to also separately upgrade your Apple Watch after you have updated your iPhone's operating system. Go to the Apple Watch app on the phone, and select General . . . Software Update.