Having trouble viewing this email? View it as a Web page. |

TECHNICAL-ADVISORY-2021-003

FORENSIC POTENTIAL OF SAMSUNG TIZEN OS

SUMMARY

Smart home appliances, in-vehicle infotainment systems, and wearable electronic products can contain data typically found on smartphones and personal computers, such as multimedia and web browsing activities. These devices can also contain data that sheds light on the activities that took place at a given time and location. Samsung produces many such devices using the open-source Linux-based Tizen operating system (OS). Digital forensic practitioners require awareness of the opportunities and challenges presented by digital devices running Samsung TizenOS such as the Samsung Galaxy Watch 3 and the Samsung UN40NU6070 Smart TV.

TECHNICAL CHALLENGE

Samsung TizenOS-enabled devices are becoming more prevalent, creating new investigative opportunities, but are not supported by current available digital forensic tools. Obtaining digital evidence from such devices presents a technical challenge, requiring new methods to acquire the data and mount the file system for forensic examination. Digital forensic practitioners need to know where to find and how to interpret data and device configuration details on these devices.

DETAILS

Forensic treatment of TizenOS devices involves advanced data extraction techniques and specialized processing of the proprietary Vertically Deliberate File System (VDFS). Files are organized logically in “virtual roots” for images, videos, audio files, documents, downloads, and camera/DCIM. TizenOS typically maps each virtual root to a directory under /opt/usr/home/owner/content on TVs and /opt/usr/home/owner/media on smartwatches. Some files stored in these locations may have been transferred from another device, such as photographs from the DCIM directory on smartphone using the Samsung Galaxy Wearables app.

If a Smart TV is connected to a cloud account, the web browser may have the option to store browser bookmarks in the cloud, which can then be synchronized with a smartphone logged into the same account.

Widgets and their data are stored under separate virtual roots with a “wgt” prefix. Installed applications can be stored in /usr/apps, /opt/usr/apps, and /opt/usr/home/owner/apps_rw. System activity information is stored in SQLite databases to maintain an on-going record of user activity, application usage, system health, and communications activity. The /csa directory on Galaxy SmartWatch 3 is referred to as the Configuration Saved Area and contains device-specific details such as serial number, IMEI, and product and model codes.

TizenOS devices can control, monitor, and transferring data between other TizenOS devices in a Samsung SmartThings network. A smartphone can also be used as a centralized remote control for SmartThings functions, and can retain information about connected devices and associated activities.

SYNOPSIS

Samsung Tizen-OS based devices can be potentially rich sources of digital evidence. If the device is not supported by existing digital forensic tools, do not assume that it is inaccessible. Current available commercial tools do not support the file system structures on TizenOS devices, making it necessary to mount using open source or custom developed solutions.

Contributors Acknowledgements

Technical Advisories are a five-minute read to raise awareness among investigators, forensic practitioners, attorneys, and judges about an emerging trend in Digital/Multimedia Forensics.

• David Harris (DC3/TSD) and Kevin Westerman (DC3/CFL Forensic Examiner)
• DC3 Editorial Board (Curation, Review, & Publication)

For additional information and automated decryption capabilities please reach out to DC3 at hub@dc3.mil.

Relevant Forensic Artifacts

DC3 is building a crowdsourced catalog of forensic artifacts, created by practitioners for practitioners, to curate expertise across the digital forensic community, making it available as a user friendly, online knowledge management platform. In this context, a digital artifact is defined as a singular unit of interpretable data that can be extracted from a given data source.