A comparison of forensic evidence recovery techniques for a windows mobile smart phone

Grispos, G., Storer, T. and Glisson, W.B. (2011) A comparison of forensic evidence recovery techniques for a windows mobile smart phone. Digital Investigation, 8(1), pp. 23-36. (doi: 10.1016/j.diin.2011.05.016)

Abstract

<p>Acquisition, decoding and presentation of information from mobile devices is complex and challenging. Device memory is usually integrated into the device, making isolation prior to recovery difficult. In addition, manufacturers have adopted a variety of file systems and formats complicating decoding and presentation.</p> <p>A variety of tools and methods have been developed (both commercially and in the open source community) to assist mobile forensics investigators. However, it is unclear to what extent these tools can present a complete view of the information held on a mobile device, or the extent the results produced by different tools are consistent.</p> <p>This paper investigates what information held on a Windows Mobile smart phone can be recovered using several different approaches to acquisition and decoding. The paper demonstrates that no one technique recovers all information of potential forensic interest from a Windows Mobile device; and that in some cases the information recovered is conflicting.</p>

• Item Type: Articles
• Status: Published
• Refereed: Yes
• Glasgow Author(s) Enlighten ID: Storer, Dr Tim and Glisson, Dr William
• Authors: Grispos, G., Storer, T., and Glisson, W.B.
• College/School: College of Arts & Humanities > School of Humanities > Information Studies; College of Science and Engineering > School of Computing Science
• Journal Name: Digital Investigation
• ISSN: 1742-2876
• ISSN (Online): 1873-202X
• Published Online: 01 July 2011
• Copyright Holders: Copyright © 2011 Elsevier Ltd.
• First Published: First published in Digital Investigation 8(1):23-26
• Publisher Policy: Reproduced in accordance with the copyright policy of the publisher