Title: 2. Understanding Acquisition Procedures for Cell Phones and Mobile Devices
Course: IN 2005 Digital Forensics > Section: Module 13: Chapter 13-Cell Phone and Mobile Device Forensics & Report Writing for High-Tech Investigations

Understanding Acquisition Procedures for Cell Phones and Mobile Devices

1. The main concerns with mobile devices are loss of power and synchronization with PCs.  All mobile devices have volatile memory.  Making sure they don’t lose power before you can retrieve RAM data is critical.
2. Any mobile device attached to a PC via a cable or cradle/docking station should be disconnected from the PC immediately.
3. Depending on the warrant or subpoena, the time of seizure might be relevant.
4. Messages might be received on the mobile device after seizure, so you must isolate the device from incoming signals with one of the following options:
  - Place the device in a paint can
  - Use the Paraben Wireless StrongHold Bag
  - Use eight layers of antistatic bags to block the signal
5. The drawback to using these isolating options is that the mobile device is put into roaming mode, which accelerates battery drainage.
6. Back in the forensics lab, you should check these four areas:
  - The internal memory
  - The SIM card
  - Any removable or external memory cards
  - The system server
7. Checking system servers requires a search warrant or subpoena.
8. The file system for a SIM card is a hierarchical structure.  Use Figure 13-1 to illustrate your explanation.
9. Information that can be retrieved falls into four categories:
  - Service-related data, such as identifiers for the SIM card and the subscriber
  - Call data, such as numbers dialed
  - Message information
  - Location information
10. If power has been lost, PINs or other access codes might be required to view files.

Mobile Forensics Equipment

1. Mobile forensics is a new science. The biggest challenge is dealing with constantly changing models of cell phones.
2. When you’re acquiring evidence, generally you’re performing two tasks:
  - Acting as though you’re a PC synchronizing with the device (to download data)
  - Reading the SIM card
3. The steps to analyze a mobile device. The first step is identifying the mobile device. Make sure you have installed the mobile device software on your forensic workstation. Next, attach the phone to its power supply and connect the correct cables. After you’ve connected the device, start the forensics program and begin downloading the available information.
4. A SIM card reader is a combination hardware/software device used to access the SIM card.
5. You need to be in a forensics lab equipped with appropriate antistatic devices.
6. The general procedure for accessing a SIM card as follows:
  - Remove the back panel of the device
  - Remove the battery
  - Under the battery, remove the SIM card from holder
  - Insert the SIM card into the card reader
7. A variety of SIM card readers are on the market. Some are forensically sound and some are not.
8. Documenting messages that haven’t been read yet is critical. Using a tool that takes pictures of each screen can be valuable in this situation.
9. Some of the mobile forensics tools, including:
  - Paraben Software Device Seizure Toolbox
  - BitPim
  - MOBILedit!
  - SIMCon (See Figures 13-2 and 13-3)
10. Software tools differ in the items they display and the level of detail.  See Figure 13-4.