UDER CONSTRUCTION

Smartphones and other handheld electronics have become integral to our daily lives, with rapidly evolving technology transforming them into significant sources of digital evidence. What were once simple telephones are now powerful multifunctional devices used for internet browsing, GPS navigation, photography and videography, music playback, banking, and even merchant payments.

Today, there are over 20,000 models of cell phones and smartphones operating on diverse networks and running a variety of operating systems, including Apple iOS, Android, Windows Mobile, and other proprietary platforms.

The process of obtaining digital evidence from these devices presents numerous challenges, particularly in maintaining forensic soundness within this ever-changing landscape. Successful investigations depend on the early identification of evidence sources, not only from the devices themselves but also from service providers, cloud storage, and backup files. Proactive and thorough preservation strategies are essential for securing critical digital evidence.

Common Mobile Device Forensics Scenarios:

• In criminal cases
• Theft of intellectual property such as customer lists or trade secrets
• Preservation orders/e-Discovery
• Employment issues
• Fraud or embezzlement
• Divorce
• Loss of data

Principles of Digital Evidence

1. Investigation and analysis of digital evidence must be done in accordance with governing industry standards.
2. Actions taken to secure or analyze the digital evidence should not change the integrity of the evidence.
3. Persons conducting an examination of digital evidence should be trained for that purpose.
4. Activity relating to the seizure, examination, storage or transfer of digital evidence should be documented, preserved and available for review.

Best Practices & Industry Standards

Cellular Network Overview

The cellular network is a complex system of communication infrastructure designed to facilitate wireless communication between mobile devices and the broader network. At its core, the network is made up of a network of cell sites or cell towers, which are strategically located antennas that transmit and receive two-way communication signals between mobile devices and the network infrastructure. Each cell site covers a specific geographic area known as a cell. These cells are interconnected, creating a seamless network that enables uninterrupted mobile service over large distances.

Mobile Device Memory Types

Mobile devices primarily store data using flash memory, an electronic storage medium. Unlike traditional magnetic hard drives used in older computers, flash memory in solid-state drives (SSDs) is faster, more durable, and consumes less power. Flash memory also actively manages storage by erasing deleted data to free up space for new information, a process that differs from magnetic memory, which retains deleted data until overwritten.

Data Recovery in Flash Memory
Flash memory erases old data by resetting entire allocation units to binary “zeros” before the space can be reused. When a file is deleted, the storage space is marked as available for reuse, but the actual data often remains intact until the operating system clears it during a process called “garbage collection.” During this window, forensic techniques can recover deleted data, offering a critical opportunity for investigators to retrieve valuable information before it is permanently erased.

Much of the user data on mobile devices is stored in database files (similar to an Excel spreadsheet).  A user could have hundreds of text messages currently on the device, which are stored in the database.  If the user deletes one or more of the messages, the deleted message(s) remain in the database, but it is marked deleted and the device does not display the message.  With most forensic extractions, these deleted messages are fully recoverable.

When the size of the database grows, the operating system will check if there is deleted information stored in the database.  If the size of the file can be reduced, the database will be copied without the deleted data to “clean” allocation units.  The original database may remain until the operating system cleans up the allocation units used by the original database file.  Data from the original database may be partially or fully recovered.

Backed Up Files

A backup of a mobile device can sometimes provide significant information that was on the device.  In the event the mobile device such as a cell phone is no longer available, the next option would be to determine if a backup copy exists either on a host computer or on the cloud.

Metadata

Riley v. California (2014) is a landmark case in United States constitutional law in which the Supreme Court unanimously held that law enforcement must obtain a warrant before searching the digital contents of a cell phone seized during an arrest. This decision significantly expanded Fourth Amendment protections in the digital age.

Types of Data from Mobile Devices

1. Device-Resident Data

This is the data physically stored on the mobile phone itself:

• User-Generated Content
  • Photos and videos (captured by the device or received via messages/apps).
  • Audio recordings and voice memos.
  • Notes and documents.
• Communication Data
  • Call logs (incoming, outgoing, missed calls).
  • Text messages (SMS, MMS).
  • Messaging app data (WhatsApp, Signal, Facebook Messenger, etc.).
  • Emails stored on the device.
• Application Data
  • App usage history.
  • Social media interactions (posts, likes, messages).
  • Dating apps (conversations, profiles, location history).
• Device Metadata
  • File timestamps (creation, modification, deletion dates).
  • Device logs and error reports.
• Location Data
  • GPS coordinates.
  • Location history stored in apps or the device.
• Media Metadata
  • EXIF data in photos (date, time, geolocation, and device settings at the time of capture).
• Browser Data
  • Browsing history.
  • Bookmarks.
  • Cached files and cookies.
• System Data
  • Contact lists and address books.
  • Calendar entries.
  • Saved passwords and autofill data.

2. Network-Related Data

Data generated through the device’s interaction with cellular networks and Wi-Fi:

• Cell Tower Records
  • Information on the cell towers the device connected to, revealing movement patterns.
• Wi-Fi Connections
  • Lists of previously connected Wi-Fi networks.
• Bluetooth Pairing Records
  • Devices previously paired with the phone.

3. Cloud-Synced Data

Data stored on external servers or synced with cloud services:

• Cloud Backups
  • iCloud, Google Drive, or other backup services may contain a mirror of the phone’s data.
• Synchronized Data
  • Documents, photos, and other files synced with services like Dropbox or OneDrive.
• Email and Messaging Logs
  • Emails, chat logs, and attachments synced to the cloud.

4. Deleted or Hidden Data

Using forensic tools, investigators may recover or uncover:

• Deleted Data
  • Recoverable text messages, photos, call logs, and files.
  • Deleted app data (partially or fully retrievable).
• Encrypted or Hidden Files
  • Hidden data in secure folders or encrypted applications.

5. Sensor and System Logs

Advanced forensic tools can extract data from the device’s sensors and logs:

• Accelerometer and Gyroscope Logs
  • Detect patterns of movement.
• Power Logs
  • Information about battery usage and charging history.
• System Logs
  • Detailed operational data about the device’s software and hardware activities.

Challenges in Mobile Forensics

• Encryption and secure folders.
• Remote wiping by users or malware.
• Fragmented operating systems and diverse device models.

Evidence Seizure Protocol for Mobile Devices

If a mobile device is powered on, individuals without proper training should avoid attempting to search the device to prevent compromising its data integrity. Instead, follow these steps:

Immediate Actions

• Document the Screen: Photograph any contents displayed on the screen at the time of seizure.
• Record Information: Gather and document the following details from the mobile device user, if possible:
  • Phone number and service provider.
  • Any passcodes, pattern locks, or PINs.
  • Availability of a charger, cables, or user manual.

Handling the Mobile Device

• If Immediate Processing Is Not Possible:
  • Power off the device.
  • Remove the battery, if feasible.
  • Avoid turning the device back on under any circumstances.

Benefits of Turning Off the Device:

1. Preserves call logs and last cell site location information (LOCI).
2. Prevents the overwriting of deleted data.
3. Blocks data destruction commands or signals.
4. Reduces the risk of improper handling, such as making calls, sending messages, taking photos, or deleting files.

Risks of Turning Off the Device:

• Activation of authentication mechanisms (e.g., passwords, PINs, biometric locks) that may hinder access during later examination.

If the Mobile Device Must Remain On:

• Isolate the Device from Networks: Prevent communication with external networks while maintaining power.
  • Radio Frequency (RF) Shielding: Use RF shielding (e.g., Faraday bags or enclosures) to block cellular, Wi-Fi, and Bluetooth signals.
  • Airplane Mode: If access is possible, place the device in airplane mode to limit network connections (note that emergency calls like 911 may still be possible).
  • Disable Other Connections: Turn off Wi-Fi, Bluetooth, and RFID communications, if practical and accessible.

Evidence Packaging & Transport

Every piece of evidence must be safeguarded against damage or alteration, properly labeled, and accompanied by a meticulously maintained chain of custody in accordance with organizational policy. Special precautions are essential when transporting digital evidence to prevent physical damage, vibration, exposure to magnetic fields, electrostatic discharge, and significant fluctuations in temperature or humidity.

Forensic Data Acquisition

The investigation of digital evidence begins with its preservation through the forensic acquisition process. This process involves creating a verified forensic copy of the electronic data to be examined. The methods used for acquiring evidence must be forensically sound, verifiable, and capable of maintaining the integrity of the data. Any deviations from standard procedures must be thoroughly documented.

Acquisition Types

• Physical
• Logical
• Live
• Targeted File(s)

Acquisition Documentation should include

• Examiner’s name.
• Acquisition date.
• Acquisition details (e.g., type of acquisition, imaging tool and version number).
• Physical condition of the evidence and unique identifiers (e.g., serial number, description, make and model).
• Original and verification hash values.
• Photographs and/or sketches.
• Any additional documentation as required by the examiner’s organization.

Examination Documentation

The secondary objective is to perform a forensic examination and search for evidence. Documentation of the examination must be case-specific and detailed enough to enable another forensic examiner with similar expertise to understand the procedures performed and independently replicate the findings.

Report of Finding

• Information should be presented in a format that may be read and understood by non technical individuals.
• Examiners should be able to explain all information contained within the report.
• Should include any relevant information contained within the acquisition and/or evidence handling documentation.
• Reports issued by the examiner should address the requestor’s needs.
• Document the scope and/or purpose of the examination.
• Give a detailed description of the media examined (e.g., hard disk, optical media or flash drive).
• Include any supplemental reports related to the examination.
• Provide the examiner’s name and date of exam.
• Be reviewed according to organizational policy.

Standards

NIJ Investigations Involving the Internet and Computer Networks

2024-03-15 SWGDE Core Competencies for Digital Forensics (23-F-007-1.1)

2018-07-11 SWGDE Best Practices for Digital Evidence Collection

2024-08-05 Considerations for Required Minimization of Digital Evidence Seizure (16-F-002-2.1)

2016-10-08 SWGDE Comments on Forced Minimization Requirements for the Seizure of Digital Evidence

2014-09-05 SWGDE Focused Collection and Examination of Digital Evidence

2023-06-15 SWGDE Best Practices for Computer Forensic Acquisitions (17-F-002-2.0)

2012-09-13 SWGDE Model SOP for Computer Forensics v3

ISO/IEC 17025:2017 General requirements for the competence of testing and calibration laboratories

ISO/IEC 27037:2012 Guidelines for identification, collection, acquisition and preservation of digital evidence

A weak or ineffective defense is the leading contributing factor in all wrongful convictions

A strong defense doesn’t happen by accident, you have to be prepared. Harness the power of knowledge!

These resources are intended to strengthen the defense at the system level to ensure a more fair and equitable representation in today’s criminal justice system and to help prevent and overturn wrongful convictions in cases involving digital evidence.

For more information about wrongful convictions in cases involving digital evidence, the need for a nationwide post-conviction review and the recommended review criteria, go to www.digitalinnocence.com.