by Anwar Campbell

What is mobile forensics? A branch of digital forensics used to acquire and analyze digital evidence acquired from mobile devices in an investigation. The information obtained must be kept secured and must not be altered in order to be considered for use in case. Forensic evidence properly obtained from these devices can be used in both civil and criminal trials.

Digital forensic evidence acquisition process

Collecting evidence The guidelines for collecting and reporting data is set by the National Institute of Standards and Technology (NIST). The individuals that collect and preserve the data needs to stay abreast of all the latest technologies. The tools used to collect the evidence are not always compatible with across brands are models. Android devices uses a different tool than is used on iOS devices and tablets and phone can used different tools. SIM Card Call logs GPS Information Phone logs

Common tools used in mobile forensics? Faraday bags Jammer GSM-UMTS-LTE Santoku (software) USB Debugging (Android) Firmware version Cellebrite Access Data Oxygen forensics Blackbag technologies Magnetic forensics MSAB

The Cellebrite forensic tool is capable of analyzing over 3200 mobile devices. It is capable of extracting phonebook, call logs, SMS messages, pictures and file system data from the device. The physical Pro 2 tool is also able to acquire and decode information from the physical memory of the device.

In matters such as human trafficking, it is important that the data is extracted rapidly from these devices before the information is lost or the device is destroyed. Investigators can use both logical and physical means to collect information from a suspected device. Once the information has been lawfully obtained and stored it will then be able to be used in court. A physical collection includes physical possession of the phone and the investigator capture remnants of deleted data from the flash memory chips where the information is stored on these devices. Logical acquisition can be done using software such as iTunes.

Securing the scene and the device As an investigator you need to make sure that the scene and the device are secured before you begin your investigation. You should document the names of everyone who had access to the scene so that you can conduct a proper investigation. The devices you collect needs to be placed into evidence bags If the device was discovered on you need to make sure that the phone does not turn off The investigator needs to make sure that the device cannot be wiped remotely.