Mobile Phone Forensics
Live and Deleted Data Recovery
Mobile Phone Forensics is the examination of SIM cards and mobile phone handsets (including smart phones, iPhones, Blackberrys and PDAs for the presence of data created by the device's owner/user during day to day use.
The data is extracted and complied into a standardised report using automated software tools and manual methods all of which are validated to ensure they present the data exactly as it was stored on the device.
The data available is defined broadly into 4 areas:
1. SIM Card data including any deleted data.
2. BASELINE Mobile Handset data: This is called 'baseline' data because it is present in some form on nearly every mobile device irrespective of make or model. It therefore represents an evidential baseline for all devices. This includes the following data sets:
- User Phonebook / Contacts
- Call Registers (Calls made / received / missed)
- SMS Content and registers (sent / received / saved)
- Calendar and Tasks -ToDo Lists
3. ENHANCED Handset data: This includes all forms data storage and user created data associated with more advanced handset functions. Typical data sets include:
- Video Clips
- Audio recordings
- Web & WAP browsing history
- E-mail usage and content
- Bluetooth connectivity
- Documents and spreadsheets.
- All other enhanced data contents
4. DELETED Handset data: In many cases it is possible to retrieve baseline and enhanced data that appears deleted to the user. This specialist technique extracts and decodes all data directly from the device's memory.