Mobile Phone Analysis: Risks Associated With Tablet Forensics

By Author: Nathan Wilson
Total Articles: 8
Comment this article

Mobile phone forensics is a new and growing field involving techniques for computer investigation and analysis of mobile phones and tablet computers, to establish legal evidence.

Experts in computer forensics and mobile phone analysis play a key role investigating and fighting crime. Picture this scene in CSI: 06:37: The Lieutenant sits in his black Chevrolet, across the road from a seedy café in central Miami. Gazing through his shades, the Lieutenant watches as his suspect - one of these smartly dressed executive-types, fitting in perfectly with the early morning commuters - walks into the café, sits down, takes out his tablet computer and starts to work.

The Lieutenant gets on the walkie-talkie to his lead officer who is waiting just around the corner: ‘He’s in the café. We’ve been onto this guy for months, he’s made over $1 million from his counterfeit goods scam – we know he’s the guy behind this, we just need to get the evidence. Another transaction has just gone into the bank account! Storm the café!’

The officer and three of his team charge into the small café sending tables, chairs ...
... and crockery crashing to the floor. Pinning the suspect to the ground, they handcuff him and grab his tablet computer. One of the officers starts looking through the device: ‘I can’t find anything obvious on here boss, let’s take it back to the lab’.

Back at the glass-partitioned lab, the tanned Technical Specialist plugs the tablet into his computer and watches as various files and documents appear on the large wall-mounted monitor – neatly ordered into emails, documents, bank transactions, etc. The Technical Specialist effortlessly moves them around the screen by swipes of his hand, zooming in on potential evidence…

So, how does this compare to the reality of the forensic analysis of tablet computers? Rather unsurprisingly, the analysis of a tablet computer is not quite this simple.

One crucial mistake our friends in Miami made in the story above was looking through and not switching off the device as soon as they got hold of it. By leaving the device on, there is the potential for it to remain connected to a network and continue receiving new data, which could potentially overwrite any useful or incriminating evidence.

In addition, if the suspect is particularly tech-savvy, he or one of his accomplices could remotely wipe the memory of the device if it is still connected to the network, deleting all data, including anything incriminating. Therefore, before any kind of investigation can be carried out on the device, even before switching it back on, it needs to be placed into a Faraday box. Switching the device on within a Faraday box prevents the device from connecting to a network and enables analysis to begin.

For more information on computer forensics and mobile phone analysis, please call us on 01789 261200 or email contact@cclgroupltd.com, or check out http://www.cclgroupltd.com/digital-forensics/law-enforcement/mobile-phone-forensics.

Author:
Nathan is a digital forensics specialist at CCL Group - the UK’s leading supplier of digital forensics, including: computer forensics, mobile phone forensics and cell site analysis services, for more information visit www.cclgroupltd.com