Mobile forensics is a branch of digital forensics that recovers evidence from mobile phones. It is important because mobile phones are ubiquitous and can contain evidence of crimes. Mobile forensics follows steps including preservation of the device, acquisition of data, examination of data, analysis of findings, and reporting results. It is challenging due to various device types and conditions, but techniques like isolating devices and using forensic software can extract hidden or encrypted data for investigations.
2. Importance and motivation
In the recent years, mobile devices are spread widely. We can say
every person has a mobile device without considering to the type
and the model of this device.
sometimes, we must note that several people use mobile phones
to do evil purposes like the crimes. Therefore, these mobile
phones can act as main witnesses of these purposes. This leads to
the need to recover data from mobile phones for use it as evidence
of these crimes. Hence, the implementation of mobile forensic
becomes very important. And the research in this area is very
interesting.
3. 1.Mobile Forensics Background
Mobile forensics is a branch of digital forensics. Simply, it is a
science of recovering different kinds of evidence from mobile
phones. It helps investigators significantly to reach to the criminal.
1.1.What is Mobile Forensics?
4. -Contact numbers.
-Record of calls, SMS, MMS and details about them.
-Sounds.
-Photographs.
-Email messages.
-Notes.
-Calendar.
1.2.Data types that could be available
on mobile devices
1.Mobile Forensics Background
5. 4.Guidelines
Several procedures must be done when the scene of crime is
cordoned:
1-Make all people far from the crime scene.
2-Drawing or take photograph of the scene.
3-Record the status and location of each device exist in the
scene.
4-Avoid any activity that could affect the origin of the evidence.
5-The evidences in the crimes not only mobile devices, any
other forensics evidences should be collected such as
fingerprints or firearms, papers, PC, cables or any else.
6-The person who carrying any things related to the crime must
be guided by the officer in order to protect what he carried.
6. 2.Mobile Forensics Steps
2.1.The major steps of mobile
forensics?
1-Preservation.
2-Acquisition.
3-Examination.
4-Analysis.
5-Reporting.
7. This step is the first and includes cordon off the scene of
crime and seizing the devices of suspect without altering
the contents of it (i.e. securing the device).
2.1.1. Preservation
2. Mobile Forensics Steps
8. It means take all information about mobile devices existing
in this scene.
•Identification of the device.
•Selecting the tool that would be use.
2.1.2. Acquisition
2. Mobile Forensics Steps
9. This step is to get the digital evidence from mobile phones
whether the evidences are exist clearly or hidden by using
scientific methods.
2.1.3. Examination
2. Mobile Forensics Steps
10. The analysis process looks to the results of the previous
process (i.e. the results of examination process). Then
analysis them.
2.1.4. Analysis
2. Mobile Forensics Steps
11. It is the last step in the mobile forensics process. It is
summarized in the preparation of a report that contains all
results, procedures or steps that have been done.
2.1.5. Reporting
2. Mobile Forensics Steps
12. 3.1.Techniques used to insulating a mobile device from
communications:
When the mobile phone is seized, it should insulated from the
communication.
1-Isolate the entire crime scene from the network.
2-Use a shielded containers.
3-using substitute SIM: put another SIM rather than the
original to make the device outside the coverage.
3.Security of mobile devices
13. 3.Security of mobile devices
3.2.Procedures to ensure the security of mobile devices
when they transported to the laboratory:
When you do packaging and transfer of mobile phones to the
laboratory, you should put them is a hard containers to keep
them secure from damage in case the container facing the
collision. Also in order to preserve the possibility of non-
pressure buttons of the mobile phone.
14. 4.Challenges
Challenges related to mobile devices
1-Find mobile device as immersed in a liquid.
In this case, battery should be removed and put the
device in appropriate container.
2-Find mobile device in a damaged state.
This case may doesn’t prevent extraction data from the
device. The device should brings to the lab in order to
examine it carefully.
3-Devices which closed by the secret numbers.
Can solved by either investigative, Software or hardware
Methods.
15. 6.Recommendations to deal
with the Chinese mobile devices
Identification of Chinese phone is very difficult because the types of
them are not well known. In addition, they are don't have any label
which clarifying the manufacturer of these devices. Most of these
mobile phones are a clone of the current known cell phones such
as SCIPhone which is a clone of apple IPhone or the clone of Nokia
N95.
In order to make the investigator knows whether these mobile
devices are original or Chinese, Investigator can observe the
following:
●A clone may be thinner or fatter than the original phone.
●It may be doesn't have any label or manufacturer logo.
16. ●When the device looks like another known device existing in the
market; investigator could go to the internet then search about the
clone of the known device
●Remove the battery from the cavity of mobile phone to take the full
information about the device which written on the battery.
17. Conclusion
After the research in the field of mobile forensics, it is clear to me
the high importance of this science. I think it should be more work
to develop tools related to this science to be can cover all types of
mobile devices especially the newest of them.
18. Findings
I suggested that the responsible for the establishment of the tools
used in mobile forensic is an international institution. This institution
could force that the manufacturers should give it detailed file for
each new release of mobile device will be produce it in order to
studying this file and work on the development of the current tool to
be able to deal with this new version of mobile phone.
