The Ever-Increasing Importance of Mobile Forensics
Mobile devices have become an integral part of our daily lives, and they contain a wealth of digital evidence relevant to forensic investigations. However, the challenges involved in mobile forensics have also increased in parallel with the proliferation of smartphone usage. Investigators must be well-versed in mobile forensic techniques to help meet these challenges adequately.
Carving unallocated space, analyzing the file system, and recovering deleted data are standard forensic techniques for mobile devices. These forensic techniques are similar to computer forensics, but the sometimes-jumbled present-day technology means that recent updates to the operating system create additional challenges to investigate.
In recent years, digital forensics experts have embraced emerging techniques such as mobile device emulation (MDE), which provides emulation capabilities for the mobile device’s data acquisition. MDE creates a virtual environment to enable access to write-blocked and secure systems while preserving the evidence. The investigator can also use MDE to bypass traditional forensic obstacles when investigating locked devices, particularly when searching for evidence in jail-broken phones.
The increased adoption of cloud-based storage services such as iCloud and Google Drive has also driven changes to mobile device forensic techniques. Investigators must now ensure that data in cloud storage services is preserved and collected during a forensic investigation. These storage services store information such as contacts, notes, and photos from mobile devices and present further forensic challenges.
Mobile forensics is no longer just the practice of recovering SMS or call logs, but a challenging and evolving subfield of digital forensics. It requires industry-expert investigators capable of maintaining up-to-date knowledge of new mobile devices, operating systems, and backup solutions.
