Mobile phone forensics is the branch of forensic investigation dealing with the acquiring all digital data stored on a mobile device using forensically sound methods. This includes all types of mobile device which stores digital data, including tablets, PDA’s and GPS devices.
For many of us the use of our mobile devices is an everyday part of life, which contain a large amount of our personal information, such as contacts, calendars, notes and message data. Most modern mobile devices can be used for access our data remotely, such as using email, web browsing, photos, gps location data and using social media.
Need for Mobile Phone Forensics
Some people no longer maintain a home computer, instead using a mobile device for all their internet activity such as social media, messaging systems and mobile banking. This makes the need for forensic analysis essential for several reasons:
- Mobile phones and devices transmit can store personal and business data
- Mobile devices are often used for mobile banking services
- Mobile phones can use apps allowing cardless payments to be made in some stores
Types of Evidence
There are three types of storage device which are commonly used on mobile devices. All devices have an internal memory on which the operating system is installed and can be used to store apps and user data. Flash memory is often used allowing apps and user data to be moved away from the internal storage, usually being the default storage area if installed. Many devices also allow external memory to be added, which can include a USB memory stick attached using a converter.
While technically not part of mobile forensics, the Service Provider logs can be an important tool when used with the evidence gathered from all the memory devices. Service Provider logs will usually contain detailed information about all calls and in some cases text messages are stored. Only an appropriate law enforcement agency can place a request for the Service Provider logs to be released.
Mobile Forensics Process
The first process is to secure all data from stored on any memory used by the memory device in question. The acquired data will then be processed and analysed by our forensic investigator, who will then create a clear and concise report detailing all their findings, which can be used as admissible evidence in court. If requested by a law enforcement agency, the Service Providers logs will be used as part of this evidence. Our investigator will be available as an expert witness if required.