Introduction to Mobile Forensics

There is no doubt that mobile devices have become part of our lives and have revolutionized the way we do most of our activities. As a result, a mobile device is now a huge repository that holds sensitive and personal information about its owner. This has, in turn, led to the rise of mobile device forensics, a branch of digital forensics that deals with retrieving data from a mobile device. This book will help you understand forensic techniques on three main platforms—Android, iOS, and Windows. We will go through various methods that can be used to collect evidence from different mobile devices.

In this chapter, we will cover the following topics:

• The need for mobile forensics
• Understanding mobile forensics
• Challenges in mobile forensics
• The mobile phone evidence extraction process
• Practical mobile forensic approaches
• Potential evidence...

The need for mobile forensics

According to Statista reports (statista.com), the number of mobile phone users in the world is expected to pass 5 billion by 2020. The world is witnessing technology and user migration from desktops to mobile phones. Most of the growth in the mobile market can be attributed to the continued demand for smartphones.

According to an Ericsson report, global mobile data traffic will reach 71 exabytes per month by 2022, from 8.8 exabytes in 2017, a compound annual growth rate of 42 percent. Smartphones of today, such as Apple's iPhone and the Samsung Galaxy series, are compact forms of computers with high performance, huge storage, and enhanced functionality. Mobile phones are the most personal electronic device that a user accesses. They are used to perform simple communication tasks, such as calling and texting, while still providing support for...

Understanding mobile forensics

Digital forensics is a branch of forensic science focusing on the recovery and investigation of raw data residing in electronic or digital devices. The goal of the process is to extract and recover any information from a digital device without altering the data present on the device. Over the years, digital forensics has grown along with the rapid growth of computers and various other digital devices. There are various branches of digital forensics based on the type of digital device involved, such as computer forensics, network forensics, and mobile forensics.

Mobile forensics is a branch of digital forensics that deals with the acquisition and recovery of evidence from mobile devices. Forensically sound is a term used extensively in the digital forensics community to qualify and justify the use of a particular forensic technology or methodology...

Challenges in mobile forensics

One of the biggest forensic challenges when it comes to the mobile platform is the fact that data can be accessed, stored, and synchronized across multiple devices. As data is volatile and can be quickly transformed or deleted remotely, more effort is required for the preservation of this data. Mobile forensics is different from computer forensics and presents unique challenges to forensic examiners.

Law enforcement and forensic examiners often struggle to obtain digital evidence from mobile devices. The following are some of the reasons for this:

• Hardware differences: The market is flooded with different models of mobile phones from different manufacturers. Forensic examiners may come across different types of mobile models that differ in size, hardware, features, and operating system. Also, with a short product development cycle, new models emerge...

The mobile phone evidence extraction process

Evidence extraction and the forensic examination of different mobile devices may differ based on various factors. However, following a consistent examination process will help the forensic examiner to ensure that the evidence gathered from each phone is well documented and that the results are reliable. There is no well-established standard process for mobile forensics.

However, the following diagram provides an overview of process considerations for the extraction of evidence from mobile devices. All methods used when extracting data from mobile devices should be tested, validated, and well documented:

Mobile phone evidence extraction process

A great resource for handling and processing mobile devices can be found at http://digital-forensics.sans.org/media/mobile-device-forensic-process-v3.pdf.

As shown in the preceding diagram, forensics...

Practical mobile forensic approaches

Similar to any forensic investigation, there are several approaches that can be used for the acquisition and examination/analysis of data from mobile phones. The type of mobile device, the operating system, and the security setting generally dictate the procedure to be followed in a forensic process. Every investigation is distinct with its own circumstances, so it is not possible to design a single definitive procedural approach for all cases. The following details outline the general approaches followed in extracting data from mobile devices.

Understanding mobile operating systems

One of the major factors in the data acquisition and examination/analysis of a mobile phone is the operating...

Potential evidence stored on mobile phones

The range of information that can be obtained from mobile phones is detailed in this section. Data on a mobile phone can be found in a number of locations—SIM card, external storage card, and phone memory, for example. In addition, the service provider also stores communication-related information. This book primarily focuses on data acquired from a phone's memory. Mobile device data extraction tools recover data from a phone's memory. Even though data recovered during forensic acquisition depends on the mobile model, in general, the following data is common across all models and useful as evidence. Note that most of the following artifacts contain timestamps:

• Address book: This contains contact names, phone numbers, email addresses, and so on.
• Call history: This contains dialed, received and missed calls and call duration...

Examination and analysis

This is the ultimate step of the investigation, and it aims to uncover data that is present on the device. Examination is done by applying well-tested and scientific methods to conclusively establish results. The analysis phase is focused on separating relevant data from the rest and probing for data that is of value to the underlying case. The examination process starts with a copy of the evidence acquired using some of the techniques described previously, which will be covered in detail in coming chapters. Examination and analysis using third-party tools is generally performed by importing the device's memory dump into a mobile forensics tool that will automatically retrieve the results. Understanding the case is also crucial to performing a targeted analysis of the data. For example, a case about child pornography may require focusing on all of...

Rules of evidence

Courtrooms rely more and more on the information inside a mobile phone as vital evidence. Prevailing evidence in court requires a good understanding of the rules of evidence. Mobile forensics is a relatively new discipline, and laws dictating the validity of evidence are not widely known, and they also differ from country to country. However, there are five general rules of evidence that apply to digital forensics and need to be followed in order for evidence to be useful. Ignoring these rules makes evidence inadmissible, and your case could be thrown out. These five rules are admissible, authentic, complete, reliable, and believable:

• Admissible: This is the most basic rule and a measure of evidence validity and importance. The evidence must be preserved and gathered in such a way that it can be used in court or elsewhere. Many errors can be made that could...

Good forensic practices

Good forensic practices apply to the collection and preservation of evidence. A lack of sound forensic practices may even render the evidence collected useless before a court of law. The modification of evidence, either intentional or accidental, can affect a case. So, understanding best practices is critical for forensic examiners.

Securing the evidence

With advanced smartphone features such as Find My iPhone and remote wipes, securing a mobile phone in a way such that it cannot be remotely wiped is of great importance. Also, when the phone is powered on and has service, it constantly receives new data. To secure the evidence, use the right equipment and techniques to isolate the phone from all networks...

Summary

Modern mobile devices store a wide range of information, such as SMS, call logs, browser history, chat messages, location details, and so on. Hence they are often a key factor in several criminal cases, reconstruction of events, corporate and legal cases, and more. Mobile device forensics also comes with its own challenges and concepts that fall outside the boundaries of traditional digital forensics. Extreme care should be taken while handling the device, right from the evidence intake phase to the archiving phase. Examiners responsible for mobile devices must understand the different acquisition methods and the complexities of handling data during analysis. Extracting data from a mobile device is half the battle. The operating system, security features, and type of smartphone will determine the amount of access you have to the data. It is important to follow sound forensic...