•  
  •  
 

Prior Publisher

The Association of Digital Forensics, Security and Law (ADFSL)

Abstract

The Amazon Kindle is a popular e-book reader. This popularity will lead criminals to use the Kindle as an accessory to their crime. Very few Kindle publications in the digital forensics domain exist at the time of this writing. Various blogs on the Internet currently provide some of the foundation for Kindle forensics. For this research each fifth generation Kindle was populated with various types of files a typical user may introduce using one method, the USB interface. The Kindle was forensically imaged with AccessData’s Forensic Toolkit Imager before and after each Kindle was populated. Each file was deleted through the USB interface. Files were retrieved and recovered through the USB interface before and after file deletion. These two sets of files were compared to the original set of files. All files retrieved before deletion matched their original counterpart. Not all files recovered after deletion matched their original counterpart. These steps and procedures followed a similar adaptation of the NIST General Test Methodology for Computer Forensic Tools developed by Leshney (2008) for virtual machines.

References

AccessData. (2013, November 12). Forensic Toolkit user guide (v 5.1). Retrieved from http://marketing.accessdata.com/acton/attachment/4390/f-0542/1/-/-/-/-/FTK_UG.pdf

Amazon.com. (2012, July). Amazon.com timeline. Retrieved from http://phx.corporate-ir.net/External.File?item=UGFyZW50SUQ9MTQ2MzQ4fENoaWxkSUQ9LTF8VHlwZT0z&t=1

Amazon.com. (2011). Amazon Kindle user’s guide. Retrieved from http://kindle.s3.amazonaws.com/Kindle_User's_Guide_English.pdf

Amazon.com. (2007). Kindle: Amazon’s original wireless reading device (1st generation). Retrieved from http://www.amazon.com/dp/B000FI73MA

Amazon.com. (2007, November 19). Introducing Amazon Kindle. Retrieved from http://phx.corporate-ir.net/phoenix.zhtml?c=176060&p=irol-newsArticle&ID=1079388&highlight=

Amazon.com. (2009, February 9). Introducing Amazon Kindle 2. Retrieved from http://phx.corporate-ir.net/phoenix.zhtml?c=176060&p=irol-newsArticle&ID=1254544&highlight=

Amazon.com. (2009, May 6). Introducing Kindle DX – Amazon’s large screen addition to the Kindle Family of wireless reading devices. Retrieved from http://phx.corporate-ir.net/phoenix.zhtml?c=176060&p=irol-newsArticle&ID=1285140&highlight=

Amazon.com. (2009, December 26). Amazon Kindle is the most gifted item ever on Amazon.com. Retrieved from http://phx.corporate-ir.net/phoenix.zhtml?c=176060&p=irol-newsArticle&ID=1369429&highlight=

Amazon.com. (2010, June 15). Kindle – Amazon’s most wished for and most gifted product – now with free shipping for Father’s Day. Retrieved from http://phx.corporate-ir.net/phoenix.zhtml?c=176060&p=irol-newsArticle&ID=1438278&highlight=

Amazon.com. (2011, April 11). Amazon introduces new Kindle family member: Kindle with Special Offers for $114. Retrieved from http://phx.corporate-ir.net/phoenix.zhtml?c=176060&p=irol-newsArticle&ID=1549144&highlight=

Amazon.com. (2011, May 19). Amazon.com now selling more Kindle books than print books. Retrieved from http://phx.corporate-ir.net/phoenix.zhtml?c=176060&p=irol-newsArticle&ID=1565581&highlight=

Amazon.com. (2012, September 6). Amazon takes on the high-end – introducing the new Kindle Fire HD family. Retrieved from http://phx.corporate-ir.net/phoenix.zhtml?c=176060&p=irol-newsArticle&ID=1732546&highlight=

Amazon.com. (2012, September 6). Introducing the new Kindle Paperwhite, the most advanced e-reader ever constructed. Retrieved from http://phx.corporate-ir.net/phoenix.zhtml?c=176060&p=irol-newsArticle&ID=1732545&highlight=

Amazon.com. (2012, October 25). Introducing “Kindle for Windows 8.” Retrieved from http://phx.corporate-ir.net/phoenix.zhtml?c=176060&p=irol-newsArticle&ID=1750157&highlight=

Amazon.com. (n.d.). Connecting your Kindle Keyboard wirelessly. Retrieved from http://www.amazon.com/gp/help/customer/display.html?nodeId=200505540

Amazon.com. (n.d.). Free Kindle reading apps. Retrieved from http://www.amazon.com/gp/feature.html?ie=UTF8&docId=1000493771

Amazon.com. (n.d.) Getting started. Retrieved from http://www.amazon.com/gp/help/customer/display.html/ref=hp_kbbland_stcomp?nodeId=200439170

Amazon.com. (n.d.) Getting started. Retrieved from http://www.amazon.com/gp/help/customer/display.html?nodeId=200590080

Amazon.com. (n.d.) Getting started with Kindle Cloud Reader. Retrieved from http://www.amazon.com/gp/help/customer/display.html/ref=hp_cloudland_start?nodeId=200732260

Amazon.com. (n.d.) Getting started with Kindle for Mac. Retrieved from www.amazon.com/gp/help/customer/display.html/ref=hp_macland_stcomp?nodeId=200443820

Amazon.com. (n.d.). Getting started with Kindle for PC. Retrieved from http://www.amazon.com/gp/help/customer/display.html/ref=hp_left_cn?ie=UTF8&nodeId=200450200

Amazon.com. (n.d.). Getting started with Kindle for webOS. Retrieved from http://www.amazon.com/gp/help/customer/display.html/ref=hp_webosland_started?nodeId=200717410

Amazon.com. (n.d.). Getting started with the Kindle app. Retrieved from http://www.amazon.com/gp/help/customer/display.html/ref=hp_ipland_stcomp?nodeId=200438220

Amazon.com. (n.d.). Kindle active content. Retrieved from http://www.amazon.com/gp/help/customer/display.html/ref=hp_left_sib?ie=UTF8&nodeId=200505220

Amazon.com. (n.d.). Kindle Cloud Reader. Retrieved from https://read.amazon.com/about

Amazon.com. (n.d.). Kindle Development Kit for active content. Retrieved from http://www.amazon.com/kdk/

Amazon.com. (n.d.). Kindle for the web beta. Retrieved from http://www.amazon.com/gp/help/customer/display.html?ie=UTF8&nodeId=200528580

Amazon.com. (n.d.). Kindle Owners’ Lending Library for Amazon Prime members. Retrieved from https://www.amazon.com/gp/help/customer/display.html/ref=lp_mem_help?ie=UTF8&nodeId=200757120

Amazon.com. (n.d.). Kindle Paperwhite 3G. Retrieved from http://www.amazon.com/gp/product/B008UB7DU6/

Amazon.com. (n.d.). Kindle Personal Documents Service. Retrieved from http://www.amazon.com/gp/help/customer/display.html/?nodeId=200767340

Amazon.com. (n.d.) Kindle for Android phones. Retrieved from http://www.amazon.com/gp/help/customer/display.html/ref=hp_left_sib?ie=UTF8&nodeId=200495330

Amazon.com. (n.d.) Kindle for Android tablets. Retrieved from www.amazon.com/gp/help/customer/display.html/ref=hp_left_sib?ie=UTF8&nodeId=200683130

Amazon.com. (n.d.). Kindle wireless reading device, Wi-Fi, graphite, 6" display with new E Ink Pearl technology. Retrieved from http://www.amazon.com/dp/B002Y27P3M/ref=btech_kindle_wifi

Amazon.com. (n.d.). Kindle wireless reading device, free 3G, 6” display, white - 2nd generation. Retrieved from http://www.amazon.com/dp/B0015T963C

Amazon.com. (n.d.). Lending Kindle books. Retrieved from http://www.amazon.com/gp/help/customer/display.html/ref=amb_link_357435222_6?ie=UTF8&nodeId=200549320

Amazon.com. (n.d.). Organizing your Kindle content. Retrieved from http://www.amazon.com/gp/help/customer/display.html?nodeId=200375850

Amazon.com. (n.d.). Public library books for Kindle. Retrieved from http://www.amazon.com/gp/help/customer/display.html/ref=hp_200527380_library?&nodeId=200747550

Amazon.com. (n.d.). Renting Kindle books. Retrieved from http://www.amazon.com/gp/help/customer/display.html/ref=hp_left_sib?ie=UTF8&nodeId=200690040

Amazon.com. (n.d.). Transferring, downloading, and sending files to Kindle Keyboard. Retrieved from http://www.amazon.com/gp/help/customer/display.html?nodeId=200505520

Amazon.com. (n.d.). Wireless, Whispernet and Whispersync. Retrieved from http://www.amazon.com/gp/help/customer/display.html?nodeId=200375890

Amazon.com. (n.d.). Your Kindle content. Retrieved from http://www.amazon.com/gp/help/customer/display.html/?nodeId=200386160Apple. (n.d.). Kindle – read books, eBooks, magazines, newspapers & textbooks. Retrieved from https://itunes.apple.com/us/app/id302584613

Beebe, N., & Clark, J. (2005). Dealing with terabyte data sets in digital investigations. International Federation for Information Processing, 2005(194), 3-16. doi:10.1007/0-387-31163-7_1

Bezos, J. (2010). Interview by C. Rose [Video recording]. Jeff Bezos, Founder & CEO, Amazon.com. Retrieved from http://www.charlierose.com/view/interview/11138

Bishop, M., Hay, B., & Nance, K. (2009). Digital forensics: Defining a research agenda. Proceedings of the 42nd Hawaii International Conference on System Sciences. doi: 10.1109/HICSS.2009.673

Burchett, J. (2005). Computer forensic data unit layer testing. Unpublished master's thesis, Purdue University, West Lafayette, IN

Carrier, B. (2003). Defining digital forensic examination and analysis tools using abstraction layers. International Journal of Digital Evidence, 1(4), 1-12.

Carrier, B. (2005). File system forensic analysis. Boston: Addison Wesley

Casey, E. (2004). Digital Evidence and Computer Crime, Second Edition. San Diego California: Academic Press.

Craiger, P. (2005). Recovering digital evidence from linux systems. International Federation for Information Processing, 194, 233-244. doi: 10.1007/0-387-31163-7_19

Creswell, J. (2009). Research Design. Thousand Oaks, CA: SAGE Publications, Inc.

Daniel, L., & Daniel, L. (2011) Digital Forensics for Legal Professionals: Understanding Digital Evidence from the Warrant to the Courtroom [Kindle Version]. Retrieved from Amazon.com

Garfinkel, S. L. (2006). Forensic feature extraction and cross-drive analysis. Digital Investigation, 3(1), 71-81. doi:10.1016/j.diin.2006.06.007

Garfinkel, S. (2010). Digital forensics research: The next 10 years. Digital Investigation, 7 (August 2010), S64-S73. doi:10.1016/j.diin.2010.05.009

Horrocks, M., Coulson, S., & Walsh, K. (1998). Forensic palynology: Variation in the pollen content of soil surface samples. Journal or Forensic Sciences, 43(2), 320-323.

Leshney, S. (2008). Digital evidence from virtual machines: An exploratory study. (Master’s thesis). Retrieved from ProQuest Diessertation and Theses database. (VMI No. 1469702).

Marsico, C., & Rogers, M. (2005). iPod forensics. International Journal of Digital Evidence. 4(2). 1-12.

Microsoft. (n.d.). Amazon Kindle | Windows Phone Apps+Games Store (United States). Retrieved from http://www.windowsphone.com/en-us/store/app/amazon-kindle/48195fb4-ee0e-e011-9264-00237de2db9e

National Institute of Standards and Technology. (November 7, 2001). General test methodology for computer forensic tools version 1.9 (Vol. 2008) (No. June 20 2008).

Slovenski, T. (2012). Cellular Forensics for First Responders [Kindle Version]. Retrieved from Amazon.com

Willassen, S. (2005). Advances in digital forensics. International Federation for Information Processing (Ed.), Forensic analysis of mobile phone internal memory. (pp. 191-204). Boston, MA: Springer. doi: 10.1007/0-387-31163-7_16

Download

Share

COinS
 
 

To view the content in your browser, please download Adobe Reader or, alternately,
you may Download the file to your hard drive.

NOTE: The latest versions of Adobe Reader do not support viewing PDF files within Firefox on Mac OS and if you are using a modern (Intel) Mac, there is no official plugin for viewing PDF files within the browser window.