Mobile Phone Forensics

MOBILEPHONEFORENSICS · AGUIDEFORUKLAWYERS Mobile Phone Forensics Extraction Levels, Encryption, App Evidence, Deleted Data and the Honest Limits of the Most Personal Device in the Case COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the witness with a lock on its mouth 03 Extraction levels: what each route actually yields 04 Encryption and device state: the access question 05 App evidence: where it lives, how it dies 06 Deleted data on modern phones: the honest position 07 Preservation and handling: before anyone touches it 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : MOBILEEVIDENCEISGOVERNEDBYTHREEGATES : EXTRACTION LEVEL , ENCRYPTIONSTATE , ANDAPPARCHITECTURE : ANDSTRATEGYISSETBYWHICH GATESOPEN § 0 2 · FIRSTPRINCIPLES The problem in plain English: the witness with a lock on its mouth § 0 3 · GATEONE Extraction levels: what each route actually yields LEVEL WHAT IT YIELDS · WHAT IT MISSES § 0 4 · GATETWO Encryption and device state: the access question § 0 5 · GATETHREE App evidence: where it lives, how it dies § 0 6 · THEHONESTLINE Deleted data on modern phones: the honest position § 0 7 · BEFOREANYONETOUCHESIT Preservation and handling: before anyone touches it § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE HANDSET CLOUD COMPUTER COUNTERPART OPERATOR / DELETED / (BY LEVEL) ACCOUNT BACKUPS DEVICES PROVIDER RECOVERABLE § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THELEVELTHATCHANGEDTHEANSWER EXAMPLE2 · THEREBOOTTHATCLOSEDTHEGATE EXAMPLE3 · THEENSEMBLETHATOUTRANTHEWIPE § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · MOBILELIMBFORTHEPRESER VAT IONINSTRUCTION § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The mobile checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Can the laboratory get into a locked phone? Do we need the phone at all if everything syncs to the cloud? How long does mobile examination take and what does it cost? The other side's expert says deleted messages are unrecoverable. Do we accept that? What about the privacy of everything else on the phone? Company phone, personal phone, or both: what should the scope chase? § 1 4 · REFERENCE Glossary TRIM Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY