Title: Forensics Lab: Phones
Course: CAP 2141 Digital Forensics II

Overview

Most recent cell phones support removable memory storage devices known as MicroSD and MiniSD flash devices, and these devices can store up to 32 GB of data. Recovering cell phone information can be challenging because no formal standards exist on operating systems, and the file systems vary greatly between manufacturers. In this lab, you will use FTK to process a forensically obtained image of a cell phone MicroSD storage device. We will add cell phone removable storage device images to FTK and identify cell phone forensic data. Cell phone imaging process requires both hardware and software tools to successfully connect a forensic recovery computer to the large variety of cell phone models in use. Special purpose USB adaptors provide the electrical connections that allow AccessData’s Mobile Phone Examiner (MPE) to read the stored data. MPE creates .ad1 formatted images and can be processed by FTK. In this lab, you will process the MPE image of a LG 6000 cell phone to look for potential evidence. We will add forensic cell phone data to FTK Imager and analyze a typical cell phone file format. We will add a forensically captured cell phone image to the FTK and look for SMS text messages.

Complete ONE of the following labs located at the end of Chapter 13 in the lab manual:

- 13.1 Examining Cell Phone Storage Devices
- 13.2 Using FTK Imager to View Extracted Phone Evidence
- 13.3 Analyzing Cell Phone Evidence Using the Forensic Toolkit

Be sure to carefully follow the directions for the project and include the full name and description of the project in your submission so that your instructor knows which project you chose.

Submission: To submit your file, choose the link above. Use the "Browse My Computer" button in the Attach File area to attach your document. Be sure to complete your submission by choosing the "Submit" button at the bottom of the screen. Make sure that you follow the due dates in the course calendar.

This lab will be graded using the Lab Assignment Rubric. Please use it as a guide toward successful completion of this lab.