Mobile forensic is a set of scientific methodologies with the goal of extracting digital evidence (in general) in a legal context, extracting digital evidence means recovering, gathering and analyzing data stored in the internal memory of a mobile phone. Mobile forensic is a continuously evolving science which involves permanent evolving techniques and presents a real challenge to forensic community and law enforcement due to the fast and unstoppable change of technology.
- Manual Acquisition:
- A mobile device’s user interface is depended on in order to get through the investigation process.
- Images of each screen are taken or captured by the examiner while the device gets browsed. Although there is no need for any tools to be involved in such process, the manual acquisition has a great pitfall on the other hand. In addition to being a time-consuming process, not all the data could be visualized by the user and therefore not all the data could be recovered by this method in the first place.
- Physical Acquisition:
- A bit-by-bit copy of the whole file system is created.
- This seems so similar to physical acquisition process on standard digital forensics
- Data residing on a device plus unallocated space in addition to even deleted data are all copied through such demanding method.
- It is not possible to make use of such method when it comes to mobile forensics
- Logical Acquisition
- The application programming interface of an equipment manufacturer is depended on in this process.
- The phone’s contents get synchronized with a personal computer through such original interface.
- This method has a plenty of free software tools available.
- Neither deleted data nor unallocated space gets recovered through such method which fundamentally extracts these data accessible to the users of the device.