In the average home today there are many potential sources of digital evidence, from clear home computers and cell phones to the less common pen drives & PDA's. They all underwent a thorough examination of the persons involved in the legal process and academics, as their characteristics proved to be of criminal value. There is as yet very little evidence about investigating the forensic properties of modern gaming consoles, if we consider how to use them in expensive computers similar to personal computers & # 39; somehow, this is an area capable of providing valuable amounts of data Of evident value in criminal or civil court proceedings.

Computer forensics is a relatively new field that combines the elements of law and computer science to collect and analyze data from computer systems, networks, wireless communications, and storage devices in an acceptable manner as evidence in the courtroom. Game consoles now provide the type of data that can be subject to forensic analysis due to the addition of memory (internal and external) capable of storing 'data beyond just computer game information.

With the addition of storage capabilities beyond simple game data (i.e. hard drives capable of storing music, videos, photos, etc.), gaming boards are able to use the 'web' function and thus will likely create both ' Fixed '& Flips' data with forensic value. With the increase in the number of media functions, gaming gaming boards have become entertainment centers' within the middle family.

The devices most likely to provide usable forensic data are Xbox360 and PS3 and because they are popular in the home (UK sales figures are around six million units), these are machines where the usage pattern is similar to the most acceptable use pattern forensic data sources ( Any home computers).

Microsoft Xbox 360:

This game console can support external memory cards for game data and media storage, however it is frequently used due to its small size (both physically and in terms of data capacity). The most used Xbox360 memory comes in the form of a detachable hard drive that ranges in size from 20 gigabytes to two hundred and fifty gigabytes (which allows massive amounts of saved music, videos, photos, etc.) and is necessary in allowing online functionality on the device. On an unmodified device, this online functionality refers to & # 39; Xbox Live & # 39;, online multiplayer games and Microsoft-managed digital media delivery service. This service allows users to:

• Download content from Xbox Live
• Sign in and update social media and media services like Facebook, Twitter, Zune and Last.fm
• Add people to friends' lists for games and / or contacts
• Send (spam) text / image / voice messages to other users

Many of the functions performed on the console have a time and date attributable to the time the job was executed (or at least when the last time it was accessed or changed); this can provide confirmation of the defendant's location at a specific time. Possible connection through the use of the Xbox LIVE messaging system can provide evidence of illegal activity as messages are stored automatically for up to 30 days before deletion from the system, however all messages sent through Xbox Live are kept on Microsoft servers and can be recovered on any The controller has logged the user profile, so any mention of a crime in a text or voice message is likely to be retrieved by a skilled investigator.

Xbox360 functionality can be expanded by modifying the internal parts to allow illegal downloaded programs (piracy) to run or installing an operating system like Linux and allowing Xbox360 to access almost all computer functions (and associated data) activity logs.

• Full Internet access (just after Xbox Live)
• E-mail
• Chat logs
• Pirated games

One important detail to note is that at least from the outside, the modified console and the unadjusted console can look exactly the same. Although it is true that some members of the 'Modification' community choose to apply different status modifications to their keyboards, many of them do not, and therefore the console can be mistaken for a standard device.

Sony Playstation 3:

The PS3 system is similar to the Xbox360 in terms of potential forensic ability. Large amounts of digital media can be stored on their hard drive, and the PlayStation Network (similar to Xbox Live) allows users to send messages the same way that Xbox360 is used.

There are two main differences between these keys. First, the PS3 has full internet browsing capability & gt; even, unmodified PS3 may contain more usable data in terms of internet search history, downloads, etc. On both the hard drive and the data cache system & # 39;. Secondly, it was possible to install external operating systems on the PS3 without any modification of the system to enable it; this is currently in dispute in US courts where this feature has been removed by Sony to help prevent software piracy on the device. Regardless, a second OS (for any purpose) is still possible to install, and now requires some hard drive modifications to enable this functionality, giving PS3 almost all computer functionality.

Motion Control – Transmission and Kinect:

In the final months of 2010, new functions were added to the PS3 (Move) and Xbox360 (Kinect), 'motion control'. Using cameras and motion tracking software, the console is able to interpret the movement of the user’s body and its frequency in the game & # 39;. From a clear standpoint, this provides another type of data collected from the game console, and this practically extends the range of data stored on these usable devices. Cameras are actually used to record a motion control user's score on some game activity points that can be stored, can be misused and used to send underage videos or obscene videos via Xbox Live. Videos can also be used to apprehend suspects involved in criminal activity, with a date and time attached to the videos, and the analysis can locate a location, thereby proving or refuting the defendants ’claim to their location at the time of the crime.

Nintendo Wii:

Nintendo Wii currently boasts higher sales figures than Xbox360 and PS3 combined. It is seen as a gaming console for 'non-gamers' and has fewer technical specifications than its competitors, and is therefore less targeted for modification, although data with criminal characteristics can still be extracted. Nintendo Wii can use a third-party Opera-based web browser; bookmarks are preserved and may be worth noting. Wii also maintains a basic daily log of system usage, as well as a contact list of added friends, as well as messages sent by those friends. Note that the images may be sent via the operator's messaging system, which is then saved to the system flash volume or to an external SD memory card. As with most modern keyboards, different distributions of Linux have been distributed to the system (Wii Linux), which means that it can be used in the same way as any desktop PC and should be handled as such.

Sony PlayStation Portable (PSP):

The portable gaming device can be defined as a gaming system that is small enough to be carried outside the home and played on batteries. Although not as powerful as a console, handheld game consoles have made significant advances in power since the early days, and may now include similar functionality to PDA devices. PlayStation Portable can be used to access the Internet, store pictures and movies, and can be modified to run third-party operating systems, thus forensic data can be recovered from memory and data cache & # 39 ;.

Nintendo DS / DSi / 3DS:

All Nintendo DS units can create dedicated wireless connections to other units to use a player to play a chat program called Pictochat. Pictochat has been used in the past by predators to attract children to them. DSi includes an SD card reader, which can be used to hide illegal material. DSi also includes a 0.3MP camera that can store images on the internal RAM or SD card.

Forensic games and console in the real world:

For illustration purposes, there are a few real-world cases of crimes involving gaming consoles, and we hope to clarify the need to investigate gaming consoles just like traditional computer forensics goals.

An example of game consoles that are used in the same way as using personal computers and providing usable forensic data would be an accident that occurred in August 2010 in the United States of America where a direct user of a Florida-based Xbox discovered that he was searching for nude photos of 10 year old boy also using Xbox Live Message Service. The Xbox 360 respondents recovered two computers and a flash drive and discovered 16 child pornography of different people.

"Fathers must realize that gaming systems such as Xbox and PlayStation, when connected to the Internet, can be used as other technology, such as a computer or a phone; users can talk to each other, send text messages, send pictures," said Andrew Bates, Folsom Police investigator. This makes these systems another potential threat. "

Useful recoverable data from Xbox Live was found in a case when a man surrendered to the police after he threatened a witness against him in an ongoing criminal investigation, and was accused of manipulating a witness, intimidating a witness and two counts of the second. Degree of harassment.

There are documented instances of inappropriate, inappropriate images being sent via Xbox Live and PlayStation Network, and here a message was sent from an unknown user account, and upon opening it I discovered that it contained an inappropriate image of a young boy and immediately called the police. The investigation will be able to determine the time and date of receipt of this image and whether it has been requested or not by the user receiving the image by retrieving previous communications.

In another incident, the PS3 user persuaded an 11-year-old girl to email him nude photos (he later sent it to contacts in other US states). No other devices have been used to commit these crimes and it will likely be discovered in a regular investigation.

On another occasion, a man accused of preparing many young girls on Xbox Live this was revealed by the discovery of a mobile phone and the Xbox360 data recovery.

Considering the myriad of ways that gaming consoles can now provide investigators with usable forensic data it is important that the potential rewards for forensic investigation of gaming machines be fully understood, and, moreover, that attorneys – whether prosecution or defense – Find an expert witness with the skills needed to support their case. Types of crimes commonly associated with a computer can be committed on a game console and data of equal importance can be retrieved from the game console. Therefore, proper tuning and takeover of these devices should be of equal priority along with other digital storage and communication devices.


Leave a Reply