Temporal analysis of an iMessage communication exchange

Michelle Govan

Research output: Contribution to conferencePaper

Abstract

Within forensic analysis temporal data can be essential when attempting to correlate, sequence and accurately reconstruct events, but irregularities and inconsistencies with some temporal data can introduce errors or yield contrasting portrayals of events. This paper models em-bedded temporal data associated with message exchanges within Apple's iMessage and explains discrepancies that occur, together with methods of identification, to ensure valid results are established. The forensic impact of multiple iOS enabled devices sharing a single Apple ID is also explored, including the identification of the device on which a message originated.
Original languageEnglish
Publication statusPublished - 10 Jun 2013
Externally publishedYes
EventThe 3rd International Conference on Cybercrime, Security and Digital Forensics - University of Cardiff, Cardiff, United Kingdom
Duration: 10 Jun 201311 Jun 2013
https://personal.cis.strath.ac.uk/george.weir/cyfor/index.htm

Conference

ConferenceThe 3rd International Conference on Cybercrime, Security and Digital Forensics
CountryUnited Kingdom
CityCardiff
Period10/06/1311/06/13
Internet address

Fingerprint

temporal analysis
communication

Cite this

Govan, M. (2013). Temporal analysis of an iMessage communication exchange. Paper presented at The 3rd International Conference on Cybercrime, Security and Digital Forensics, Cardiff, United Kingdom.
Govan, Michelle. / Temporal analysis of an iMessage communication exchange. Paper presented at The 3rd International Conference on Cybercrime, Security and Digital Forensics, Cardiff, United Kingdom.
@conference{64685be5bec64d52b9953fb0bd12282b,
title = "Temporal analysis of an iMessage communication exchange",
abstract = "Within forensic analysis temporal data can be essential when attempting to correlate, sequence and accurately reconstruct events, but irregularities and inconsistencies with some temporal data can introduce errors or yield contrasting portrayals of events. This paper models em-bedded temporal data associated with message exchanges within Apple's iMessage and explains discrepancies that occur, together with methods of identification, to ensure valid results are established. The forensic impact of multiple iOS enabled devices sharing a single Apple ID is also explored, including the identification of the device on which a message originated.",
author = "Michelle Govan",
year = "2013",
month = "6",
day = "10",
language = "English",
note = "The 3rd International Conference on Cybercrime, Security and Digital Forensics ; Conference date: 10-06-2013 Through 11-06-2013",
url = "https://personal.cis.strath.ac.uk/george.weir/cyfor/index.htm",

}

Govan, M 2013, 'Temporal analysis of an iMessage communication exchange' Paper presented at The 3rd International Conference on Cybercrime, Security and Digital Forensics, Cardiff, United Kingdom, 10/06/13 - 11/06/13, .

Temporal analysis of an iMessage communication exchange. / Govan, Michelle.

2013. Paper presented at The 3rd International Conference on Cybercrime, Security and Digital Forensics, Cardiff, United Kingdom.

Research output: Contribution to conferencePaper

TY - CONF

T1 - Temporal analysis of an iMessage communication exchange

AU - Govan, Michelle

PY - 2013/6/10

Y1 - 2013/6/10

N2 - Within forensic analysis temporal data can be essential when attempting to correlate, sequence and accurately reconstruct events, but irregularities and inconsistencies with some temporal data can introduce errors or yield contrasting portrayals of events. This paper models em-bedded temporal data associated with message exchanges within Apple's iMessage and explains discrepancies that occur, together with methods of identification, to ensure valid results are established. The forensic impact of multiple iOS enabled devices sharing a single Apple ID is also explored, including the identification of the device on which a message originated.

AB - Within forensic analysis temporal data can be essential when attempting to correlate, sequence and accurately reconstruct events, but irregularities and inconsistencies with some temporal data can introduce errors or yield contrasting portrayals of events. This paper models em-bedded temporal data associated with message exchanges within Apple's iMessage and explains discrepancies that occur, together with methods of identification, to ensure valid results are established. The forensic impact of multiple iOS enabled devices sharing a single Apple ID is also explored, including the identification of the device on which a message originated.

M3 - Paper

ER -

Govan M. Temporal analysis of an iMessage communication exchange. 2013. Paper presented at The 3rd International Conference on Cybercrime, Security and Digital Forensics, Cardiff, United Kingdom.