Title: 1. Understanding Mobile Device Forensics
Course: IN 2005 Digital Forensics > Section: Module 13: Chapter 13-Cell Phone and Mobile Device Forensics & Report Writing for High-Tech Investigations

Understanding Mobile Device Forensics

1. People store a wealth of information on cell phones, but not many people think about securing their cell phones.
2. Some of the items that might be stored on cell phones, including:
  - Incoming, outgoing, and missed calls
  - Text and Short Message Service (SMS) messages
  - E-mail
  - Instant-messaging (IM) logs
  - Web pages
  - Pictures
  - Personal calendars
  - Address books
  - Music files
  - Voice recordings
3. Investigating cell phones and mobile devices is one of the most challenging tasks in digital forensics.

Mobile Phone Basics

1. Mobile phone technology is advancing rapidly.
2. Three generations of mobile phones:
  - Analog
  - Digital personal communications service (PCS)
  - Third-generation (3G), which offers increased bandwidth
3. Several digital networks are used in the mobile phone industry.  See Table 13-1 that describes the most important digital networks.
4. Three main components used for cell communication:
  - Base transceiver station (BTS)
  - Base station controller (BSC)
  - Mobile switching center (MSC)

Inside Mobile Devices

1. Mobile devices can range from simple phones to small computers, also called smart phones.
2. Cell phone hardware consists of a microprocessor, ROM, RAM, a digital signal processor, a radio module, a microphone and speaker, hardware interfaces and an LCD display.
3. Most basic phones have a proprietary OS, although smart phones use the same OSs as PCs.
4. Phones store system data in electronically erasable programmable read-only memory (EEPROM), which enables service providers to reprogram phones without having to physically access memory chips. The OS is stored in the ROM, which is nonvolatile memory.
5. Subscriber identity module (SIM) cards are found most commonly in GSM devices and consist of a microprocessor and from 16 KB to 4 MB of EEPROM.
6. GSM refers to mobile phones as “mobile stations” and divides a station into two parts: the SIM card and the mobile equipment (ME).
7. Additional SIM card purposes, including:
  - Identifies the subscriber to the network
  - Stores personal information
  - Stores address books and messages
  - Stores service-related information
8. SIM cards come in two sizes. Portability of information is what makes SIM cards so versatile.

Inside PDAs

1. Personal digital assistants (PDAs) can still be found as separate devices from mobile phones. Most users carry them instead of a laptop.
2. PDAs house a microprocessor, flash ROM, RAM and various hardware components. The amount of information on a PDA varies depending on the model.
3. Usually, you can retrieve a user’s calendar, address book, Web access, and other items.
4. Some of the peripheral memory cards used with PDAs, including:
  - Compact Flash (CF)
  - MultiMedia Card (MMC)
  - Secure Digital (SD)
5. Most PDAs are designed to synchronize with a computer, so they have built-in slots for that purpose.