Forensics on a Kindle Fire HDX?

Many people's first impression when they hear "Kindle" is an e-book reader. This is a deceptive first impression as one may think a simple e-book reader cannot store much information on it. The purpose of my research into the Kindle Fire HDX is to find out where data is stored and what forensically pertinent data could be useful to an investigation.

I have already started working on my research project into the Kindle Fire HDX and am starting to formulate more ideas with the direction I want to go with my research. Previous students at Champlain have done work on older models of Kindles which has helped me validate and guide the direction I initially wanted to take this project. One student ran into problems rooting their kindle and gaining access to the data area. I don't believe this will be a problem for me as I have already found two guides on how to root the Kindle Fire HDX linked to in my first blog post.

Important information I would like to learn more about at the moment are:

• The web history and online data stored on the kindle
• The calender
• The cloud drive
• Apps including social media such as Facebook
• The Kindle Fire HDX's capacity to act as a cell phone by sending and receiving phone calls, texts, or media
• Where downloads are stored for different file types
• Email services especially deleted messages
• How passwords are stored for the kindle, online web sites, and apps
• What if any encryption can be used on the Kindle Fire HDX
• Wifi Settings
• Deleting Files
• Settings and how they effect how the Kindle Fire HDX works

Other goals I have are to create a hash set of the databases, videos, pictures, texts; also known as a Known File Filter (KFF) in Forensics Tool Kit (FTK). This should allow me to easily compare basic information found on the Kindle Fire HDX to new user initiated data, thus eliminating some of the "noise".

Another goal I had was to look into MAC times on the Kindle Fire HDX. Forensics Expert Dan Farmer blogs about the importance and risks with using MAC times in forensics analysis in "What Are MACtimes?". MAC times are meta data about a file that helps keep track of when the file was created, moved, cut, copied, or used and is usually in the form of LastWriteTime, LastAccessTime, and CreationTime. This type of information can help determine a timeline of events and help investigators come to different conclusions about what users were doing.