Document Type

Article

Publication Date

2011

Publication Title

Digital Investigation

Volume

8

Issue

1

First Page

23

Last Page

36

Abstract

Acquisition, decoding and presentation of information from mobile devices is complex and challenging. Device memory is usually integrated into the device, making isolation prior to recovery difficult. In addition, manufacturers have adopted a variety of file systems and formats complicating decoding and presentation.

A variety of tools and methods have been developed (both commercially and in the open source community) to assist mobile forensics investigators. However, it is unclear to what extent these tools can present a complete view of the information held on a mobile device, or the extent the results produced by different tools are consistent.

This paper investigates what information held on a Windows Mobile smart phone can be recovered using several different approaches to acquisition and decoding. The paper demonstrates that no one technique recovers all information of potential forensic interest from a Windows Mobile device; and that in some cases the information recovered is conflicting.

Comments

Copyright © 2011 Elsevier Ltd. All rights reserved.

The final, published version of the article can be found here: https://doi.org/10.1016/j.diin.2011.05.016

Download

Files over 3MB may be slow to open. For best results, right-click and select "save as..."

Share

COinS