The rapid advancement in semiconductor technologies and increase in computer power has increased the functionality of mobile phones. Mobile phones have become an integral part of every user. It is used to store and process the data. It is used in business organizations to do work. The data stored in mobile phones is also being used in civil and criminal case investigations. This article contains details of mobile forensics, the difference between mobile forensics and computer forensics, and lists some of the mobile forensic tools, and the challenges in mobile forensics.
Table of Contents
Mobile Forensic
There has been an increase in the usage of mobile applications for the past few years. Smartphones support desktop applications like word processors, spreadsheets, and database-based applications to store and view large documents, and messaging services are also enhanced to send multimedia messages, and emails can be opened on mobile phones and others. With the evolution of m-commerce, mobile phones are also used to do shopping and make online transactions with one click.
Millions of users are using mobile internet for web searches, to watch videos, and songs to communicate and to see the news. Today, smartphones have both personal and professional details of the users in them. Cyber attackers are targeting mobile phones to steal confidential information from users. To reduce the attacks and track the attackers, mobile forensic tools are used in the investigation process.
Mobile operating systems
Mobile phones have different operating systems and features that help the examiner to make effective decisions on investigations. Different operating systems require different analysis processes because of the different features and facilities they provide to the examiner. Some of the most popular operating systems of mobile are Google Android, Apple IOS, RIM Blackberry OS, and Windows phone.
- Android is Google’s source platform that has a Linux-based operating system. It is available free to manufacturers and developers to use online.
- IOS is an iPhone operating system developed and used by Apple Inc. It is a Unix-based operating system and allows the implementation of native applications.
- Windows Phone is developed by Microsoft. It uses the Windows operating system just like a desktop but is more flexible and customized.
- The Blackberry operating system is developed by Blackberry Ltd. It is only used in Blackberry smartphones that are used in corporate organizations.
Categories Of Mobile Forensic
Mobile forensics is one of the branches of forensic science that is used to recover digital evidence from mobile devices. Mobile forensics is divided into three categories.
- Seizure: forensic examiners face many challenges in seizing mobile phones at the crime spot. The mobile phones are placed in the Faraday bag that isolates the phone from the network. The phone must be switched off because the intruder can erase the data from the mobile remotely if the phone and its internet are on.
- Acquisition: in the acquisition process, the original pieces of evidence from the mobile phone are recovered using different mobile acquisition tools. Multiple methods are used to collect and recover data from the mobile.
- Examination: the examiner faces many challenges in examining the recovered digital pieces of evidence because different mobile types will require different tools and techniques to recover the data and examine its integrity. Then, a report is created explaining each piece of evidence, the tools used, and the reason for using the tools to collect the data and examine it. The report also contains the chain of custody forms and photographs.
Difference Between Mobile Forensics And Computer Forensic
Reproducibility of the evidence in case of dead forensic analysis is different in computer forensics and mobile forensics. In mobile phones, the information in the memory is constantly updated because of the change in the mobile clock. In mobile forensics, the memory produces different values every time when the forensic tool is applied to the memory. It is difficult to get a bit-wise copy of the data on mobile phones.
Live forensic analysis means to analyze the data or evidence either online or offline. Computers have built-in connectivity options to address both live and dead computer forensics, but mobile phones do not have built-in connectivity, and there is no live analysis developed in mobile forensics. Mobile phones have volatile memory, and computers have non-volatile memory, so in mobile forensics, if the power is not maintained in the mobile, the data will be lost.
Different mobiles have different versions of OS, which makes it difficult for examiners to examine the mobile phones. The percentage of targeting smartphones by attackers is increasing every year with the increase in usage of mobile phones for every work.
Challenges To Mobile Forensic
- The mobile data can be accessed and synchronized to multiple devices, and the memory is of volatile types that create challenges in preserving the evidence.
- There are various mobile phone models available in the market with different sizes, hardware, features, and OS. The product life cycle is also short, creating challenges for examiners to be updated with the latest mobile forensic techniques.
- Modern mobile phones have built-in security features to protect the privacy of the users. It uses encryption methods both on hardware and software layers that require examiners to break the encryption to collect the evidence.
- Anti-forensic tools like data forgery, data hiding techniques, secure wiping, and others make mobile forensics difficult.
- Lack of resources and tools is also one of the drawbacks of mobile forensics.
- The mobiles have a reset option that erases all the users’ data from the phone.
- The examiner should know all the criminal laws and regional laws before conducting mobile forensics because mobiles are connected to the network using a wireless network that can cross different country boundaries.
Mobile Forensic Tools
Mobile forensic tools help to uncover data like Meta data of the phone, SMS, GPS data, local storage files, and different application data. Some of the mobile forensic tools are
- AFLogical OSE is an open-source Android forensic app and framework used to extract data from mobile to external SD cards.
- Open-source Android Forensic is a framework that provides different tools to analyze applications of mobiles.
- Andriller is an application that supports the Windows operating system to collect information on social media and messaging programs.
- Android Data Extractor Lite is a tool used to get a forensic flowchart from the mobile database.
- LIME (Linux Memory Extractor) is a software used to get volatile memory data from mobile devices. It can also be used to extract data remotely.
- Cellebrite Touch is a paid tool that allows extracting complete evidence from the device. It is very simple to use for the examiners.
- Encase Forensic is the most used forensic tool used to identify and extract encrypted files from mobile devices.
Conclusion
Latest mobile phones are launched in the market every day because of this, attackers are shifting their interests from computer systems to mobile phones. Therefore, users need to secure their mobile phones by keeping all the applications updated.