Forensics: Blackberry Curve 8310 and Incorrect EXIF Time Stamp

While working on a forensic investigation that involved a Blackberry 8310 I ran into an issue that just didn't settle right with me. I wanted to ensure that, beyond a reasonable doubt, the EXIF time stamp embedded within a photo taken by the Blackberry device was written accurately by the device. Before signing off on the validity of the EXIF time stamp, something just didn't seem right. After digging around and doing countless tests, I was surprised that I was able to consistently recreate a failure whereby the incorrect time stamp was written to the original date/time EXIF field. Here are additional details:

DEVICE: Blackberry Curve 8310 smartphone (EDGE)

VERSIONS: v4.5.0.55 (Platform 2.7.0.68) & v4.5.0.110 (Platform 2.7.0.90)

PROVIDER: AT&T

DATE/TIME SOURCES: Blackberry & Network

ADDITIONAL ENABLED SETTINGS WORTH NOTING:

• PASSWORD (options | security options | general settings | password)
• BACKLIGHT TIMEOUT value of 30 seconds (options | screen/keyboard | backlight timeout)
  
• SECURITY TIMEOUT value of 1 minute (options | security options | general settings | security timeout)

OBSERVED BEHAVIOR:

The EXIF original date/time embedded within a photo taken by the Blackberry 8310 had the incorrect time stamp. Consistently and repeatedly I was able to have the Blackberry device write the incorrect time stamp to the EXIF field. The EXIF original date/time was inconsistent with the actual date/time that the photo was taken in addition to the “Last Modified” time displayed by the Blackberry device.

SCENARIO REPRODUCING THE PROBLEM:

1. I take a photo with the Blackberry at 0600 on 1/22/2009. The image name is IMG00001. Using the Blackberry and looking at the properties of photo IMG00001 I see the correct “Last Modified” date and time of “Jan 22, 2009 6:00AM”. Emailing the photo to my email address I then view the EXIF data of the photo on a separate forensics system and see the correct original date/time of “2009:01:22 06:00:00”.
2. An hour passes. I delete IMG00001 from the Blackberry and then take a photo at 0700 on 1/22/2009. The image name is IMG00002. Using the Blackberry and looking at the properties of photo IMG00002 I see the correct “Last Modified” date and time of “Jan 22, 2009 7:00AM”. Again, I email myself the photo and view the EXIF data of the photo on a separate forensics system. However, this time I see the incorrect original date/time. The EXIF field shows “2009:01:22 07:02:00”.
3. [update: 1/23/2009] - I can also reproduce this EXIF incorrect time stamp issue without deleting photos. This issue presents itself only with the first photo taken after the phone has automatically locked, requiring a password to unlock before the said photo with the incorrect EXIF time stamp can be taken by the device. Subsequent photos taken before the security timeout locks the device have the correct EXIF time stamps.

IMPLICATIONS:

An assumption is made that the Blackberry device is writing the correct date/time within the EXIF data when a photo is taken with the device. EXIF data within photos could potentially be used as evidence to support what an individuals recorded statement (e.g., whereabouts at a given time). From my tests there’s reasonable doubt that the EXIF time stamp of a photo taken by a Blackberry 8310 device (and perhaps others) may be incorrect. Therefore, EXIF time stamps from photos used as evidence becomes highly questionable and ultimately, and likely, could be rendered irrelevant.

ADDITIONAL NOTES & QUESTIONS:

• Blackberry and RIM have been contacted to investigate and confirm the issue.
• I was able to reproduce this issue on a single Blackberry Curve 8310 which was initially running v4.5.0.55 (Platform 2.7.0.68). I was also able to reproduce the failure after upgrading the same Blackberry Curve 8310 to v4.5.0.110 (Platform 2.7.0.90).
• I viewed the EXIF data on a Mac using both “EXIF Viewer” and “Preview”. I viewed the EXIF data on a Windows XP system using “InfranView” with the EXIF plugin installed.
• Can others reproduce the same issue on 8310’s running similar and/or different firmwares?
• Can others reproduce the same issue on non-8310 Blackberry devices?
• [update: 1/23/2009] - Could this be a residual artifact of the security lockout feature? (will need to test after disabling the security timeout)
  

Steve

###

Tools To Get Things Done

“Give us the tools and we will finish the job.” ~  Winston Churchill

Managing tasks and keeping notes readily accessible and easily searchable has been an ongoing challenge for me. In 1997 I took a Franklin Time Management class and clearly understood the necessity to effectively manage my tasks and time. However, carrying an awkward organizer with me wherever I went wasn't convenient, and I often found it annoying to pull my organizer out when I needed review my schedule and often difficult to quickly locate notes that I had taken previously.

Fortunately...through need, advances in technology and the synergy of creative minds, many electronic productivity tools have surfaced in the market over the years to help with staying organized and getting things done.

Task Management

Over the past several years I've used tools such as Jott and Remember The Milk (RTM) to help me with managing my tasks. Over a period of time I found myself growing more and more frustrated with the two productivity tools. Jott started charging money for a service that did a mediocre job with converting speech-to-text. I tethered RTM with Jott for adding tasks through speech...in other words, I was using two productivity tools to do what one should have been able to do independently.

I can't expect to meet the challenges of today with yesterday's tools and expect to be in business tomorrow. Fortunately, I found a very powerful yet easy to use productivity tool that has been working extremely well for me. Several months ago I started using ReQall as a replacement for both Jott and RTM. What exactly is ReQall? According to the marketing blurb on the ReQall website:

"ReQall is the best memory tool you may ever have, connecting all the ways you communicate in one easy-to-use reminder system. Use it on the web (no software to install!) or download it into your iPhone or BlackBerry smartphone. ... By integrating voice input, speech-to-text transcription, automatic organization and multi-platform reminders, ReQall goes beyond typical to-do and reminder applications."

I've been using ReQall to manage my tasks and shopping lists. From my experience ReQall does a much better job with speech-to-text conversions than with Jott. ReQall's web interface to manage tasks is simpler to use. I'm able to add tasks via the following; web (text), iphone app (text and voice), firefox plugin (text), phone (voice), and instant messaging (text). Plus, I appreciate now having a single solution (ReQall) to do what I had been doing with two (Jott and RTM).

ReQall also allows me to add meetings and schedule tasks for specific dates and times. For example, on my iPhone I can launch the ReQall app and say the following note:

"Meet with Mike on Friday at 3pm"

The above voice note gets converted to text by ReQall. Adding my ReQall meeting feed to my Google Calendar I then see a meeting on Friday at 3pm with Mike! I also synch my iCal with Google Calendar so that my schedule stays current and easily accessible no matter where I'm accessing it.

If I want to add an item to my shopping list, all I have to do is say "buy" and whatever it is I need to pick up at the market. Whoala, the item gets converted to text and shows up in my shopping list. My shopping list can be accessed and individual items checked off from my iPhone while at the store.

Though ReQall is currently a very useful productivity tool, there's room for improvement that will increase ReQall's value. Features I would like to see include:

• A ReQall desktop widget for Mac (RTM already has a desktop widget for Mac OS X)
• Ability to view all To-Do's and shopping list items via the Firefox extension
• Ability to check items off as completed via Firefox extension
• Ability to check items off as completed via the IM interface
  
• iPhone app: Have shared shopping list entries show up in my shopping list AS WELL as my recipient's shopping list
• iPhone app: Auto refresh when starting app, making changes to items, and at specified time intervals (e.g., every 15 mins)
• iPhone app: Ability to change user/pass from the ReQall app instead of having to go through the standard iPhone settings app

I look forward to seeing what ReQall will rollout throughout 2009!

“Computers are magnificent tools for the realization of our dreams, but no machine can replace the human spark of spirit, compassion, love, and understanding.” ~ Louis Gerstner

Note Taking, Journaling and Retrieval

Over the past six months I've been using Journler to record and search through my notes. Journler was great so long as I had my laptop next to me when I needed to retrieve notes. Ultimately, what I needed was a solution that would allow me to securely access my notes from my iPhone as well as from the web. I also wanted a productivity tool that would let me take photos with my iPhone, or other camera, of whiteboards at the conclusion of a work meeting and would place the photo into my notes and preferably convert the words on the whiteboard from the photo into searchable text (OCR).

Last month a co-worker of mine asked about Evernote. Simply put, Evernote is incredibly useful! According to the Evernote website:

"Evernote allows you to easily capture information in any environment using whatever device or platform you find most convenient, and makes this information accessible and searchable at any time, from anywhere."

I've now migrated all of my Journler entries into Evernote. It goes without saying, I don't store anything sensitive in Evernote unless PGP'd. I can access my notes from the web browser on my laptop, the Evernote application, and from my iPhone. Imagine I was in a meeting this morning and I took a picture of the whiteboard where the word "Monkey" was written. Evernote will convert the writing into text and make it searchable. Therefore, I can search my Evernotes for the word "Monkey" and the picture of the whiteboard will be a returned result. That's awesome!

Screenshot: Evernote iPhone App

Additional features I would like to see in Evernote include:

• Strong crypto that can be applied to specific notes requiring a separate password to encrypt/decrypt for enhanced security and privacy - see next bullet point regarding two-factor authentication;
• Two-factor authentication with support for one-time-passwords (see PayPal Security Key)

Overall, I see productivity tools finally getting to a point where there's a noticeable benefit in my productivity in using them. ReQall and Evernote are two such productivity tools.

“When you write down your ideas you automatically focus your full attention on them. Few if any of us can write one thought and think another at the same time. Thus a pencil and paper make excellent concentration tools.” ~ Michael Leboeuf

Steve

###