Mobile Forensics

Data extracted from devices during the mobile forensics process can provide investigators and attorneys with the information they need to crack a case wide open. Mobile devices go everywhere the users goes which means they can tell a story about who the user is communicating with, what they are communicating about, and where the user has been.

What digital forensics artifacts can you find on a mobile phone?

As of 2016, there were 395.9 million wireless subscriber connections of smartphones, feature phones, and tablets in the United States, roughly 120% of the population. Mobile forensics is the service through which examiners extract and evaluate the data stored within a mobile device. Modern smartphones contain a plethora of information that could potentially be of evidentiary value including:

  • Incoming, outgoing, missed call history
  • Phone book or contact lists
  • SMS text, application-based, and multimedia messaging content
  • Pictures, videos, audio files, and sometimes voicemail messages
  • Internet browsing history, content, cookies, search history, analytics information
  • To-do lists, notes, calendar entries, ringtones
  • Documents, spreadsheets, presentation files and other user-created data
  • Passwords, passcodes, swipe codes, user account credentials
  • Historical geolocation data, cell phone location data, Wi-Fi connection information
  • User dictionary content
  • Data from various installed apps
  • System files, usage logs, error messages
  • Deleted data from all of the above

Helpful Articles and Information about Mobile Forensics

MobileSMS.plist and the Joy of Testing – My Favorite Artifacts, Part Two
Forensic Case Files: Samsung Galaxy S7 from a Fatal Motorcycle Crash
Smartphone User Dictionary Files – My Favorite Artifacts, Part One
Forensics Case Files: Chip On, Chip Off, The Chipper!