Mobile forensics is a branch of digital forensics that involves recovering evidence from mobile phones. It helps investigators by providing data like contact lists, call logs, text and multimedia messages, photos, notes, and other application data. When collecting evidence at a crime scene, all non-essential people should be kept away and photographs taken to document the state and location of devices. Key steps in mobile device forensics include preservation of the evidence, acquisition of data from the device, examination of the data, analysis of findings, and reporting results. Proper techniques like isolating devices from networks and using shielded containers are important to preserve evidence integrity during collection and transport to a lab for further analysis. The growing use of mobile
1.1 What isMobile Forensics ?
• Mobile forensics is a branch of digital forensics
simply, it is a science of recovering different kinds
of evidence from mobile phones . It helps
investigators significantly to reach to the criminal.
3.
1.2 Data typesthat could be available
on Mobile Devices ..
• Contact Numbers
• Record of calls, sms, mms,and details about them.
• Sounds
• E-mail messages
• Notes
• Calendar
4.
1.3 Several proceduresmust be done
when the scene of crime is cordoned
• Make all people far away from crine scene .
• Drawing or take photographs of the scene
• Record the status and location of each device exist in
the scene.
• Avoid any activity that could affect the origin of the
evidence.
• The evidences in the crime not only mobile any other
forensics evidences should be collected .
5.
2.1 The majorsteps of Mobile
Forensics
• Preservation
• Acquisition
• Examintaion
• Analysis
• Reporting
6.
2.1.1 PRESERVATION
• Thisstep is the first and includes cordon off the
scene of crime and seizing the devices of suspect
without altering the contents of it .
7.
2.1.2 ACQUISITION
• Itmeans take all information about mobile devices
existing in the scene -
• Identication of the device.
• Selecting the tool that would be use.
8.
2.1.3 EXAMINATION
• Thisstep is to get the digital evidences from mobile
phones whether the evidences are exist clearly or
hidden by using scientific methods.
9.
2.1.4 ANALYSIS
• Theanalysis process looks to the results of the
previous process. Then analysis them.
10.
2.1.5 REPORTING
• Thisis the last step in the forensics process. It is
summarized in the preparation of a report that
contains all results ,procedures or steps that have
been done .
11.
3.1 Techniques usedto insulating a
mobile from communications:
• Isolate the entire crime scene from the network .
• Use a shielded containers .
• Using substitute SIM: put another SIM rather than
the original to make the device outside the
coverage.
12.
3.2 Procedure toensure of Mobile
devices: when they transported to
the laboratory
• You should put them in a hard containers to keep
them secure from damage in the case containers
facing the colloision .
• Also to preserve the possibility of non-pressure
buttons of the mobile phones.
13.
4.1 Challenges relatedto mobile
devices.
• Find mobile device as immersed in a liquid- In this case
,battery should be removed and put the device in
appropriate container.
• Find mobile device in a damaged state-This case may
doesn't present extraction data from the device . This
should brings to the lab in order to examine it carefully.
• Devices which closedby the secret numbers-can solved
by either investigative ,software or hardware methods .
14.
5.1 Importance andMotivation
• In the recent years , mobile devices are spread widely ,we can say
every person had a mobile device without considering to the type
and the model of the crime.
• Sometimes ,we must note the several people use mobile phones
to do purpose like the crimes . Therefore, these mobile phones
can act as main witnesses of these purposes.
• This leads to the need to recover data from mobile phones for
use it as evidences of these crimes .
• Hence,the implememtation of mobile forensic becomes very
impotant ,and the research in this area is very intresting .