Digital Forensics for Tablets

Do you have a tablet that may house important evidence?

Since 2010, tablet devices have proliferated, spreading through homes, businesses, hospitals, and schools, fulfilling a wide range of functions and storing many kinds of data. Tablets come in just about as many shapes and sizes as smartphones; like smartphones, they can contain a treasure trove of valuable data when they turn up in forensic investigations. If you are in need of tablet forensics services, Gillware can assist you with your investigation for all types and brands of tablets, including the Microsoft Tablet PC and Surface Pro, Samsung Galaxy Note, and iPad.

Tablet Forensics

With the convenience of a smartphone and the features of a laptop, it’s not hard to see why tablets have caught on. People use tablets everywhere—in their homes as well as their businesses. Employees will frequently use tablets to easily communicate and share information during conferences, presentations, and trade shows, and iPads in particular see particularly widespread use in the fields of education and healthcare. With such wide-reaching appeal, tablets can show up as evidence in all kinds of situations.

In terms of hardware and software, tablets have a lot in common with smartphones. Crack open a Samsung Galaxy Note tablet and a Samsung Galaxy S4 smartphone and you’ll find very similar components, from the components on the system-on-chip (SoC) motherboard to the onboard flash memory storage chips. You’ll find similar software as well—and just the same wide variety of file system and operating system architectures.

Just like smartphones, there are two major camps of tablet devices. In one camp, you have Apple with its iPad, which follows Apple’s closed design philosophy. In the other, you have every other manufacturer, and within this group there are a wide range of different models of tablet, many aimed at different demographics and boasting different strengths and weaknesses, using different kinds of flash memory chips, different file systems, and different mobile operating systems.

Many tablets run on Android. Forensic investigation of these devices generally differs very little from Android device forensics. Other tablets, like Microsoft’s Surface tablets, will rely on the same type of filesystem architecture as laptop and desktop PCs and will run Windows 8 or 10. Still other tablets may use modifications of the open-source Linux O/S, such as Firefox OS.

Broken device forensics

iPad Forensics

Just as with computers and smartphones, Apple’s iPad differs wildly in its hardware and software architecture from other tablets. Like the iPhone, the iPad differs from its non-Apple cousins in that it lacks support for removable data storage devices such as microSD cards. On one hand, there is no way to expand an iPad’s storage capacity. On the other hand, this means that for forensic investigators, there is one less location on the device for valuable data to live in.

Also like the iPhone, the iPad uses the HFS+ file system, runs iOS, and its software environment is a strictly controlled “gated community” in which users can only download and run Apple-approved apps. The iPad is a closed-off environment which discourages user customizability in favor of a unified and user-friendly design. However, users can “jailbreak” their iPads, voiding their warranties, but granting them the ability to install unofficial or pirated apps.

Because the iPad shares so many features with its smaller sibling, the iPhone, the same methods and techniques which apply to iPhone forensics apply just as well to iPad forensics. Forensic investigators of iPads, as with other iOS devices, must be mindful of robust data encryption Apple uses, especially on the latest models of iPad.

Gillware Tablet Forensics Services

There is no “one size fits all” approach to tablet forensics. The tools and techniques used to acquire the contents of these devices vary in effectiveness depending on the manufacturer, model, O/S version, and circumstances. The wide variety of tablet devices out there, with dozens of new models being released every year, means that forensic investigation techniques must constantly evolve to keep up with the times. A skilled digital forensics expert is well-versed in all of the tools and tricks of the trade. With years of digital forensics experience, we are well-equipped to deal with the ever-changing face of tablet forensics.

Gillware is just what you need for tablet forensics. Leveraging the tools and expertise of data recovery’s engineers, our forensic experts can even recover and analyze data from broken or destroyed tablets. By applying the tools and skills from both fields, the experts at Gillware can acquire data from tablets using a wide variety of methods, from software tools like Cellebrite UFED and UFS Explorer to acquisition methods such as JTAG and chip-off forensics.

Gillware Digital Forensics can also assist you beyond our forensic assessment and analysis. If needed, we also provide expert testimony on our findings in court. When it comes to digital forensics, especially for mobile devices such as tablets, making sure the results are communicated clearly and accurately is paramount for the success of your case.

Still have questions about our digital forensics services for tablets?