Mobile Forensics Analysis
Multiple mobile phones may have the data where the cross-reference will create new leads. With the tools that we have at our disposal, complex analysis like combining multiple digital evidences sources can easily get connections, which stay hidden. Mobile Forensics services are divided into two categories:
Android Devices
- Phone is Lock:
We can easily get the data if the phone is locked by unlocking it using specific password breaking tool. Then, we will be able to produce Smartphone forensics evidence retrieved in complete clear and concise format.
- Rooting :
Rooting is a way, which permits to utilize Android OS code. It provides you with the privilege of transforming the software code on device or even installs other software, which the manufacturer would not allow normally.
- Rooted Device:
We can easily retrieve all the deleted data from the rooted device. All the data integrity is preserved in exact form after retrieving the data. Even, we can recover the data from application lock in its original form.
- Non-Rooting Device:
We can get back the data from non-rooting devices. In this, we get the data by doing two data extraction:
1. Logical Extraction
2. File System Extraction
iOS Devices
- Upgrade and Downgrade :
While upgrading or downgrading your iPhone version, many times the phone hangs up in DFU mode. Due to which, it is difficult to access the data and come out the DFU mode. Therefore, we give you complete service to get back your iPhone from DFU mode. We can even upgrade or downgrade iPhone devices.
Application Forensics (For Both iOS and Android)
- WhatsApp Data :
In application forensics, we recover the deleted WhatsApp chats in a way to get all the evidence. We extract all the deleted chats in its original form without doing any alteration to perform complete investigation. Not only this, we can extract the data from other social media applications such as Facebook Messenger, etc.
- App Lock (Android):
Many times, while uninstalling or deleting app lock; you lost all the data that is stored in vault. We can even retrieve all your personal data from the app lock in a way to carve out an evidence from it.
- SMS/iMessage:
While executing crime, many times the communication is done via SMS/iMessage and it is deleted afterwards. We even give you the complete service to recover all the deleted SMS/ iMessage in its exact form to trace the evidence.
Challenges With Mobile Forensics
There is no any denial in statement that the smartphones play a significant role in performing an investigation on any crime, which is done by using the device. However, it is very stimulating task accompanied with numerous tasks, as listed below:
In the process of mobile phone investigation, the beginning step is identification of smartphone. By keeping the entire essential thing in mind, which are several network carriers and manufacturers, identification of mobile by normal viewing is difficult. Even after knowing the fact that OS of almost all smartphone work in alike manner however, they differ in storage of data and security settings. Furthermore, models of Chinese phone may duplicate by look of several known brands but organizes diverse OS than the original one. Until, the phone battery is separated, the investigator will not distinguish the exact model.
Maintenance of existing mobile data is other step of mobile phone forensics investigation way. It is important to evade any new data, in form of message or even call, from received by acquired device. It arises that occasionally newly messages received may erase the earlier messages. Therefore, in way to prove data integrity it is recommended to place smartphone in remote or wireless environment. Several skills offer this kind of isolation to recollect the mobile devices far away from the radio regularities.
One of the most important challenge, which examiners come across is safeguarding of phone power. If it is saved in an operational manner for long period, its battery will eventually drain out that may lead to removal of instable data saved in mobile phone. Thus, results in evidence loss. Therefore, keeping check on mobile phone battery is important to safeguard data conservation. However, there exists no standard for the necessity of power in phones, as there is no level for cable connectors.
Let us think that an investigator does not trail any of mentioned challenges in precise case. However, there leftovers a barrier, which makes whole investigation of no usage. There does not occur a location standard or any format for storing an information in smartphone. The data can be stored at several places in different kinds of memories. Some evidence may be stored in SIM card while some may also in its RAM that is volatile memory. Moreover, some data is stored in ROM too. Information such as contacts, emails, SMS, etc. are stored in its default format that cannot be implicit without any tool.
Mobile Device Forensics Process
- Collection:
The very first stage is collection in which, it is important to use the appropriate techniques to guard handset from communicating with other devices that may be SMS, phone calls, Bluetooth, Wi-Fi Hotspot interferences, GPS, etc. It is essential to place the smartphone into Faraday bag. If it is possible then, add usage of jammer, to evade alteration of original state of device. Otherwise, put the phone in airplane mode.
- Evaluation:
In this phase of mobile phone forensics, investigator collects the digital evidence from the smartphone. In this stage, an examiner investigates the mobile model number, serial number, year, OS, etc. In a way to know from where they need to begin the investigation.
- Acquisition:
In Mobile Acquisition procedure, usually by write blocking device, a procedure mentioned as Imaging or Acquisition. The duplicate is made by using imaging tools. The original drive is then, resumed to protect storage to avoid tampering. The acquired image is tested by using SHA- 1 or MD5 hash functions. At serious points throughout analysis, the media is tested again, known as "hashing,” to confirm that evidence is still in its original state. The second phase is acquisition phase after preservation on device is done. This phase selects a right technique and approach for the analysis phase and phase begins when device is received at forensic lab. In this phase, the right tool for acquisition is chosen, as this is very difficult since there are numerous number of devices in market. It covers mainly three stages:
-
Being a fact, transactions are extremely vital for the corresponding database, because if needed they can be used for recreating the entire database in case of catastrophic conditions. Reading transaction logs is not that easy without the involvement of an external application as SQL Server is not in a practice of storing this particular set of information in a human readable form. However, it is not completely impossible to do so, as there are undocumented functions such as; fn_dblog() and more that enables a user to read transactions from a log file.
-
Although there is a way to read transactions of a log file by using undocumented functions mentioned above, but the implementation is way too lengthy to be applied every time a log file needs to be analyzed especially when it’s a matter of a few transactions executed on the DB. In addition, the function only enables access to the transaction log but does not decode it for the users therefore; usage of a commercial tool becomes necessary for examining the transactions or rebuilding database out of it, if needed.
- Logical Acquisition:
Logical Acquisition usually refers to extraction of complete file system from mobile phone. Even we can also say that logical acquisition is an ability to get specific data type or container (SMS, call history, video, pictures, ringtones, calendar, etc.) from mobile phone.
- File System:
It usually refers to extraction of complete file system from cellular phone however, it can also state to extraction of file system from the removable SD cards within device itself.
- Physical Acquisition:
In the analysis process, various stages cover up as mentioned:
- If there is a logical data then, the data is in readable form
- In the file system, while recovering application database are there. Then, we need to find an evidence.
- In physical, DD image is created and we can recover the deleted data easily.
- Report:
The consideration should be set during examination as the information extracted and documented from the smartphone device can be evidently shown to other investigator, and to court. In several cases, the receiver may wish to have extracted data in both paper as well as electronic format so that the call history or even any other data can be sorted or even imported into other software for any further analysis.
Chain of Custody
Chain of Custody is the Chronical Documentation for the indication in the specific case. It is significant with the data as there are probabilities of fake modification, creation, or deletion of data. In the Database Forensics, you require the widespread chain of custody report in manner to show the physical custody of an evidence and spectacle all the parties, which are used to say it as proof at any specified time. Acquire Forensics gives chain of custody reports for all the Database Forensic cases, and we recommend that keeping all these documents for any type of legal proceedings.
Acquire Forensics provides chain of custody reports for all the Computer Forensic cases, and we powerfully recommend keeping all these documents for all types for legal proceedings.
Frequently Asked Questions
Solution: No, we provide the service on all the brands of mobile phones.
Solution: Yes, we recover deleted iMessage and carve out the evidence from it.
Solution: Yes, we can easily recover all your personal data stored in App Lock.
Solution:
No, there is no any limitation in our Mobile Phone Forensics Service.
