Question

You have been assigned a case that needs mobile forensic analysis. A mobile is found from the suspect’s office, and it might have critical information related to the case.

a) Discuss the information that can be retrieved from this mobile’s SIM card.

b) Illustrate the general procedure to access the content on this mobile phone SIM card.

c) Explain measures to validate data on this mobile

Answer 1

Mobile devices are right in the middle of three booming technological trends: Internet of Things, Cloud Computing, and Big Data. The proliferation of mobile technology is perhaps the main reason, or at least one of the main reasons, for these trends to occur in the first place. In 2015, 377.9 million wireless subscriber connections of smartphones, tablets, and feature phones occurred in the United States.

Nowadays, mobile device use is as pervasive as it is helpful, especially in the context of digital forensics, because these small-sized machines amass huge quantities of data on a daily basis, which can be extracted to facilitate the investigation. Being something like a digital extension of ourselves, these machines allow digital forensic investigators to glean a lot of information.

What is the Mobile Forensics Process?

Crimes do not happen in isolation from technological tendencies; therefore, mobile device forensics has become a significant part of digital forensics.

Most people do not realize how complicated the mobile forensics process can be in reality. As the mobile devices increasingly continue to gravitate between professional and personal use, the streams of data pouring into them will continue to grow exponentially as well. Did you know that 33,500 reams of paper are the equivalent of 64 gigabytes if printed? Storage capacity of 64 GB is common for today’s smartphones.

The mobile forensics process aims to recover digital evidence or relevant data from a mobile device in a way that will preserve the evidence in a forensically sound condition. To achieve that, the mobile forensic process needs to set out precise rules that will seize, isolate, transport, store for analysis and proof digital evidence safely originating from mobile devices.

Examination & Analysis

Flasher box forensics. Using a UFS box to access mobile phone

As the first step of every digital investigation involving a mobile device(s), the forensic expert needs to identify:

• Type of the mobile device(s) – e.g., GPS, smartphone, tablet, etc.
• Type of network – GSM, CDMA, and TDMA
• Carrier
• Service provider (Reverse Lookup)

The examiner may need to use numerous forensic tools to acquire and analyze data residing in the machine. Due to the sheer diversity of mobile devices, there is no one-size-fits-all solution regarding mobile forensic tools. Consequently, it is advisable to use more than one tool for examination. AccessData, Sleuthkit, and EnCase are some popular forensic software products that have analytic capabilities. The most appropriate tool(s) is being chosen depending on the type and model of mobile device.

Timeline and link analysis available in many mobile forensic tools could tie each of the most significant events, from a forensic analyst’s point of view.

Intel Computer Stick imaged and analyzed

All of the information, evidence, and other findings extracted, analyzed, and documented throughout the investigation should be presented to any other forensic examiner or a court in a clear, concise, and complete manner.