Tablet Forensics


Since 2010, tablet devices have proliferated, spreading through homes, businesses, hospitals, and schools, fulfilling a wide range of functions and storing many kinds of data. Tablets come in just about as many shapes and sizes as smartphones; like smartphones, they can contain a treasure trove of valuable data when they turn up in forensic investigations. If you are in need of tablet forensics services, Gillware Digital Forensics can assist you with your investigation for all types and brands of tablets, including the Microsoft Tablet PC and Surface Pro, Samsung Galaxy Note, and iPad.


What Is a Tablet?

Touchscreen tablets have long been a dream of science fiction, with several writers throughout the twentieth century, including Isaac Asimov and Arthur C. Clarke, including their own takes on thin, portable touch-screen computers in their bodies of work. In a case of life imitating art, the European Union’s NewsPad project, an early attempt to further develop touchscreen and tablet computing in 1994, was named as a reference to the tablet device used by characters in Stanley Kubrick’s 1968 film 2001: A Space Odyssey (based on a short story by Arthur C. Clarke).

Many manufacturers tried their hands at developing touch based devices throughout the late 1990s and 2000s, producing gadgets such as the PalmPilot PDA and Microsoft’s Pocket PC 2000, but very few of these proto-tablets made a big splash in the consumer market and society at large. Much like with smartwatches, the technology for tablets as we know them today (or as sci-fi writers of yesterday imagined them) simply wasn’t there yet. Tablets did not take off until 2010 with the debut of Apple’s iPad, which brought the idea of the tablet as a viable technology into the public eye. Afterward, the tablet market exploded, with other manufacturers developing competing products of their own.

Tablet forensics

Tablets like the Microsoft Surface Pro blur the line between tablet and PC, while tablets like the Samsung Galaxy Note blur the line between phone and tablet.

Tablets occupy a murky gray area in between mobile phones and full-featured laptop and notebook computers. These devices can range from slightly larger than a smartphone (sometimes referred to as “phablet”, a portmanteau of “phone” and “tablet”), such as the Samsung Galaxy Note line, to around the size of a laptop or notebook PC’s screen. While a Samsung Galaxy Note “phablet” occupies one end of the scale, 2-in-1 tablets such as the Microsoft Surface Pro occupy the other extreme, often including detachable physical keyboards. In between these two poles you can find hundreds of models of tablets by dozens of manufacturers, most of whom also manufacture smartphones and PCs.

A tablet can do just about everything a smartphone can do—except make phone calls. Many tablets can use a cellular data connection and mobile broadband as well as Wi-Fi to connect to the Internet, but cannot make and take calls or send and receive SMS messages like a phone can without the use of third-party apps. Still, the contents of these devices can be very similar to what a forensic investigator can find on a smartphone, and in some situations, call data can end up on these devices.


Tablet Forensics

With the convenience of a smartphone and the features of a laptop, it’s not hard to see why tablets have caught on. People use tablets everywhere—in their homes as well as their businesses. Employees will frequently use tablets to easily communicate and share information during conferences, presentations, and trade shows, and iPads in particular see particularly widespread use in the fields of education and healthcare. With such wide-reaching appeal, tablets can show up as evidence in all kinds of situations.

In terms of hardware and software, tablets have a lot in common with smartphones. Crack open a Samsung Galaxy Note tablet and a Samsung Galaxy S4 smartphone and you’ll find very similar components, from the components on the system-on-chip (SoC) motherboard to the onboard flash memory storage chips. You’ll find similar software as well—and just the same wide variety of file system and operating system architectures.

Just like smartphones, there are two major camps of tablet devices. In one camp, you have Apple with its iPad, which follows Apple’s closed design philosophy. In the other, you have every other manufacturer, and within this group there are a wide range of different models of tablet, many aimed at different demographics and boasting different strengths and weaknesses, using different kinds of flash memory chips, different file systems, and different mobile operating systems.

Many tablets run on Android. Forensic investigation of these devices generally differs very little from Android device forensics. Other tablets, like Microsoft’s Surface tablets, will rely on the same type of filesystem architecture as laptop and desktop PCs and will run Windows 8 or 10. Still other tablets may use modifications of the open-source Linux O/S, such as Firefox OS.

iPad Forensics

Just as with computers and smartphones, Apple’s iPad differs wildly in its hardware and software architecture from other tablets. Like the iPhone, the iPad differs from its non-Apple cousins in that it lacks support for removable data storage devices such as microSD cards. On one hand, there is no way to expand an iPad’s storage capacity. On the other hand, this means that for forensic investigators, there is one less location on the device for valuable data to live in.

Also like the iPhone, the iPad uses the HFS+ file system, runs iOS, and its software environment is a strictly controlled “gated community” in which users can only download and run Apple-approved apps. The iPad is a closed-off environment which discourages user customizability in favor of a unified and user-friendly design. However, users can “jailbreak” their iPads, voiding their warranties, but granting them the ability to install unofficial or pirated apps.

Because the iPad shares so many features with its smaller sibling, the iPhone, the same methods and techniques which apply to iPhone forensics apply just as well to iPad forensics. Forensic investigators of iPads, as with other iOS devices, must be mindful of robust data encryption Apple uses, especially on the latest models of iPad.


Gillware Digital Forensics Offers Tablet Forensics Services

iPad Forensics

Even severely damaged and broken tablets can still have valuable data for a forensic investigator living within them. The forensic data recovery experts at Gillware can salvage this data from broken devices.

There is no “one size fits all” approach to tablet forensics. The tools and techniques used to acquire the contents of these devices vary in effectiveness depending on the manufacturer, model, O/S version, and circumstances. The wide variety of tablet devices out there, with dozens of new models being released every year, means that forensic investigation techniques must constantly evolve to keep up with the times. A skilled digital forensics expert is well-versed in all of the tools and tricks of the trade. With years of digital forensics experience, the experts at Gillware Digital Forensics are well-equipped to deal with the ever-changing face of tablet forensics.

Gillware Digital Forensics is just what you need for tablet forensics. Leveraging the tools and expertise of Gillware Data Recovery’s engineers, our forensic experts can even recover and analyze data from broken or destroyed tablets. By applying the tools and skills from both fields, the experts at Gillware Digital Forensics can acquire data from tablets using a wide variety of methods, from software tools like Cellebrite UFED and UFS Explorer to acquisition methods such as JTAG and chip-off forensics.

Gillware Digital Forensics can also assist you beyond our forensic assessment and analysis. If needed, we also provide expert testimony on our findings in court. When it comes to digital forensics, especially for mobile devices such as tablets, making sure the results are communicated clearly and accurately is paramount for the success of your case.



To get started on a case, follow the link below to request an initial consultation with Gillware Digital Forensics.