Kindle Fire HDX Forensics Research Conclusions

It has been a while since I have had a chance to update the blog about my research. I am considering publishing my research if I get the chance. This blog post is a chance for me to summarize some of the most interesting findings.

Why the Kindle Fire HDX?
•The purpose of my research into the Kindle Fire HDX is to find out where data is stored and what forensically pertinent data could be useful to an investigation.
•The Kindle Fire HDX is the newest Kindle brand e-book reader released by Amazon meaning there is little to no forensic research that has been done.
•You might be surprised how much the Kindle logs.

What Was Done?
•Normal user activity was performed and noted.
•A file system extraction was performed using a Cellebrite Touch Ultimate. The operating system, Fire OS 3, branched off from Android 4.2.2.
•The Kindle was rooted to provide root level access to the Kindle data areas not normally available to users.
•The media was examined using the UFED Physical Analyzer and SQLite Database Browser.

Where Did the Research Go?
•Databases contained valuable forensic artifacts.
•The most interesting artifacts came from Facebook, Silk Web Browser, Email, and the Amazon Cloud Drive.
•Information such as system logging and event logging kept track of nearly every user action, for example, turning the Kindle on or off, connecting to Wi-Fi, and search queries.

Kindle Fire HDX Research

So, what is the significance of these findings?

The digital forensic community could benefit from this research if analysis needed to be performed on a Kindle Fire HDX. The Kindle stores a lot of user activity and user data that could help investigators provide evidence. Artifacts pertinent to an investigation could help show that a suspect was at a crime scene at the time, no where near the crime when it happened, show patterns of behavior, show that a suspect had contraband on the Kindle, create a timeline, and show relationships between the suspect and accomplices through their communications.

Kindle users may be concerned to know how much information about themselves is actually stored on the Kindle itself and on the Amazon cloud. Users may not be aware how much of the activity they perform on the Kindle is logged, dated, and available in plain text. Hopefully the research into the Kindle will provide users with better insight and precautions when using their Kindle. People today have become much more aware of the information that can be recovered from their computers, but may not yet be as aware how much information can be recovered from their e-book readers. Additionally, awareness about the Kindle may provide incentive for Amazon to implement higher standards for security in the future.