Table of Contents for

System Forensics, Investigation, and Response, 3rd Edition

A cell phone, or tablet, can be a treasure trove of forensic information. This is one area of digital forensics that definitely extends well beyond the scope of computer crimes. With mobile devices, the evidence found can be relevant to any crime.

Items you should attempt to recover from a mobile device include the following:

• Call history

• Emails, texts, and/or other messages

• Photos and video

• Phone information

• Global positioning system (GPS) information

• Network information

The call history lets you know who the user has spoken to and for how long. Yes, this is easily erasable, but many users don’t erase their call history. Or perhaps the suspect intended to delete this data and simply did not get to it yet. In either case, call history does not provide direct evidence of a crime—with the exception of cyberstalking cases. In a cyberstalking case, the call history can show a pattern of contact with the victim. However, in other cases, it provides only circumstantial evidence. For example, if John Smith is suspected of drug dealing and his call history shows a pattern of regular calls to a known drug supplier, by itself this is not adequate evidence of any crime. However, it aids the investigators in getting an accurate picture of the entire situation.

Most phones allow sending and receiving emails and messages in SMS or other formats. Gathering this evidence from a mobile device can be very important. Both the parties that the suspect is communicating with and the actual content of the communications are very important.

Photos and video can provide direct evidence of a crime. In the case of child pornography cases, the relevance is obvious. However, it may surprise you to know that it is not uncommon for some criminals to actually photograph or videotape themselves committing serious crimes. This is particularly true of young criminals conducting unplanned crimes or conducting crimes under the influence of drugs or alcohol.

Information about the phone should be one of the first things you document in your investigation. This will include model number, serial number of the SIM card, operating system, and other similar information. The more detailed, descriptive information you can document, the better.

Global positioning system information has become increasingly important in a variety of cases. So many individuals have devices with GPS enabled, it would seem negligent for a forensic analyst not to retrieve this information. GPS information has begun to play a significant role in contentious divorces, for instance. If someone suspects a spouse of being unfaithful, determining that the spouse’s phone and his or her car were at a specific motel when he or she claimed to be at work can be important.

It should be noted that until recently, many cell phones did not provide true GPS. Rather than use GPS satellites to determine location (which is the most reliable method) they instead would use triangulation of signal strength with various cell towers. This could lead to inaccuracies of up to 50 to 100 feet. However, this situation has changed. Many modern phones and/or the apps on the phone use true GPS for much more accurate data.

The use of Wi-Fi along with GPS will improve the accuracy of GPS. The reason for this is that various organizations, including Google, track the Basic Service Set Identifier (BSSID) used by wireless routers, and correlate this with physical addresses. The BSSID is a unique address that identifies the access point/router that creates the wireless network. The access point’s MAC address is used. This means that if your phone connects to a wireless access point, then even with no other data, the phone’s location can be pinpointed to within 100 yards or so of that access point.

Network information is also important. What Wi-Fi networks does the phone recognize? This might give you an indication of where the phone has been. For example, if the phone belongs to someone suspected of stalking a victim, and the suspect’s phone network records show he or she has frequently been using Wi-Fi networks in close proximity to the victim’s home, this can be important evidence.