On the planet of digital forensics, mobile phone investigations are growing exponentially. The quantity of cell phones investigated every year has risen nearly tenfold in the last decade. Courtrooms are relying increasingly more on the information in the mobile phone as vital evidence in the event of all. Despite that, the concept of mobile phone forensics continues to be in the relative infancy. Many digital investigators are a novice to the area and are looking for a “Phone Forensics for Dummies.” Unfortunately, that book isn’t available yet, so investigators have to look elsewhere for information on how to best tackle cell phone analysis. This post should by no means act as an academic guide. However, it can be used like a starting point to acquire understanding in the area.
First, it’s vital that you know the way we got to where our company is today. In 2005, there were two billion cellular phones worldwide. Today, you will find over 5 billion which number is predicted to cultivate nearly another billion by 2012. Consequently just about any human being on Earth posesses a mobile phone. These phones are not just a means to make and receive calls, but instead a resource to keep information in one’s life. Each time a cellular phone is obtained as an element of a criminal investigation, an investigator will be able to tell a substantial amount regarding the owner. In lots of ways, the info found in a phone is a lot more important compared to a fingerprint in that it gives a lot more than identification. Using forensic software, digital investigators have the ability to begin to see the call list, texts, pictures, videos, and a lot more all to serve as evidence either convicting or vindicating the suspect.
Lee Reiber, lead instructor and owner of mobile phone data recovery atlanta., breaks in the investigation into three parts-seizure, isolation, and documentation. The seizure component primarily requires the legal ramifications. “If there is no need a legitimate ability to examine these devices or its contents then you may very well have evidence suppressed no matter how hard you have worked,” says Reiber. The isolation component is the most important “because the cellular phone’s data might be changed, altered, and deleted on the air (OTA). Not merely is definitely the carrier able to perform this, but the user can employ applications to remotely ‘wipe’ the information from your device.” The documentation process involves photographing the cell phone in the course of seizure. Reiber says the photos should show time settings, state of device, and characteristics.
Right after the phone is delivered to the digital forensics investigator, these devices ought to be examined with a professional tool. Investigating phones manually is actually a final option. Manual investigation should simply be used if no tool on the market has the capacity to support the device. Modern mobile devices are like miniature computers that require a sophisticated applications for comprehensive analysis.
When examining a cellular phone, you should protect it from remote access and network signals. As cellphone jammers are illegal in the usa and a lot of Europe, Reiber recommends “using a metallic mesh to wrap these devices securely after which placing the telephone into standby mode or airplane mode for transportation, photographing, and then placing the device in a state to become examined.”
Steve Bunting, Senior Forensic Consultant at Forward Discovery, lays the process flow as follows.
Achieve and keep network isolation (Faraday bag, RF-shielded box, and RF-shielded room).
Thoroughly document these devices, noting information available. Use photography to assist this documentation.
If a SIM card is at place, remove, read, and image the SIM card.
Clone the SIM card.
With all the cloned SIM card installed, conduct a logical extraction from the cell device using a tool. If analyzing a non-SIM device, start here.
Examine the extracted data from the logical examination.
If backed up by the model as well as the tool, perform a physical extraction from the cell device.
View parsed data from physical extraction, which can vary greatly depending on the make/type of the mobile phone along with the tool used.
Carve raw image for many different file types or strings of data.
Report your findings.
There are 2 things an investigator can do to achieve credibility from the courtroom. The first is cross-validation in the tools used. It is vastly essential that investigators usually do not depend upon just one tool when investigating a mobile phone. Both Reiber and Bunting adamantly recommend using multiple tools for cross-validation purposes. “By crosschecking data between tools, one might validate one tool while using other,” says Bunting. Doing so adds significant credibility on the evidence.
The 2nd method to add credibility is to make sure the investigator features a solid comprehension of evidence and exactly how it had been gathered. A lot of the investigations tools are simple to use and require a couple clicks to produce an in depth report. Reiber warns against becoming a “point and click” investigator given that the instruments are so easy to use. If the investigator takes the stand and is not able to speak intelligently regarding the technology accustomed to gather the evidence, his credibility are usually in question. Steve Bunting puts it this way, “The more knowledge one has from the tool’s function as well as the data 68dexmpky and function present in any cell device, the more credibility you might have as being a witness.”
For those who have zero experience and suddenly find yourself called upon to handle phone examinations for your personal organization, don’t panic. I speak to individuals over a weekly basis in the similar situation looking for direction. My advice is definitely exactly the same; sign up for a training course, become certified, seek the counsel of veterans, participate in online digital forensics communities and forums, and speak with representatives of software companies making investigation tools. By taking these steps, it is possible to go from novice to expert in the short amount of time.