Mobile forensics
Mobile devices, such as Personal Digital Assistants (PDAs), Blackberry, iPhone and cell phones have become essential tools in our personal and professional lives. The capabilities of these devices are continually evolving, providing users with greater storage capacities, better Internet connectivity, and enhanced Personal Information Management (PIM) capabilities.
Over time, these devices accumulate a sizeable amount of information about the owner and the activities conducted with the device, which may be of value to law enforcement or other security officials as digital evidence.
Mobile phones can provide several different kinds of forensic evidence, such as:
- Call history
-
Contacts
-
SMS 'text message' history
-
Calendar information
-
Images
-
Video files
-
Audio files
-
Mobile Web browsing history
-
The SIM card's Location Information File can provide information about the last cells in which the phone was active
- GPS History
- File storage activity
There are different methods of retrieving the evidence, starting from simple screen captures over forensic software tools to bit-exact memory damps using JTAG.
Unfortunately there is no standard common operating system for mobile phones, like there is for computers with Windows, therefore there is no one perfect solution. The software tools differ in the supported models, connection types and cost. Another criterion is whether the evidence they recover can be accepted in court. The ideal solution is to have several different tools available to use.
At e.law we are continuously sourcing new forensic software to ensure we are kept up-to-date with the changes in mobile phone technology.