Investigators playing i-spy

Forensics researchers  have known since at least last year that the iPhone has a hidden file on...
Forensics researchers have known since at least last year that the iPhone has a hidden file on it that tracks its movements. Photo from <i>ODT</i> files.
That iPhones and other Apple handheld gadgets keep track of their users' moves may have been news to most users when it was publicly disclosed late last week.

But it wasn't news to investigators, particularly in the United States, who examine cellphones and other electronic devices for clues in criminal and other legal cases.

Those investigators - and the software developers who make applications they use in their work - have known since at least last year that the iPhone has a hidden file on it that tracks its movements. Data gleaned from the file has been used in investigations since forensics experts discovered it, those experts say.

"I've analysed so many iPhones I've lost track," said Christopher Vance, a digital forensics specialist at Marshall University's Forensics Science Centre, which works with law enforcement officials investigating crimes in its home state of West Virginia.

Using the iPhone's tracking file "is part of the standard analysis for me".

Privacy advocates warned that the file - and its use - has profound implications for owners of Apple handheld products.

"Apple has unwittingly or knowingly become complicit in a wide range of mobile surveillance," Jeff Chester, executive director of the Centre for Digital Democracy, a consumer privacy advocacy group, said.

The tracking file came to the attention of the general public on Thursday, when two researchers at the Where 2.0 conference in Santa Clara announced their discovery of it. The file, which can be found on all Apple devices running the latest version of its mobile iOS operating system, contains the latitude and longitude of cellphone towers and Wi-Fi access points with which those devices have interacted.

Apple has yet to offer an explanation for the file and did not return calls seeking comment. Sean Morrissey, chief executive of Katana Forensics, said he discovered early last year that Apple devices running iOS 3, the then-current version of the operating system, were logging their locations over time.

With iOS 4, which came out last summer, Apple moved, renamed and reformatted the log file and began backing it up on to users' computers, he said. The changes made the tracking file more accessible to forensics researchers.

Katana has developed an application called Lantern that it offers to companies and law enforcement agencies "from the federal to the local level" for use in gleaning data from iOS devices, Morrissey said. As early as May or June, Katana had developed a software tool that it used internally to access the iOS tracking file for clients for which it consulted, he said. The company included a version of that tool with the new version of Lantern it released in January.

Katana consults on about a dozen cases a month and regularly uses the location tool in Lantern to find out where particular iOS devices have been, Morrissey said. Cases the company has consulted include missing person cases and custodial kidnappings, he said.

Likewise, Access Data, which offers similar software for examining cell phones, has been gleaning data from the iPhone's tracking file "for quite some time", Lee Reiber, the company's director of mobile forensics, said.

The data gleaned from cellphone towers doesn't give a precise location of where an iOS device was at any one point, but it often will say what side of a tower the device was connected to, which can help investigators zero in on a device's co-ordinates, he said.

 

Add a Comment