Mobile forensics: Beyond traditional sources of digital evidence

Abstract

Mobility is the future and people of the 21st century are continuously witnessing the fast-paced growth of mobile technology. The ever-increasing storage capacity of mobile devices allows for the capturing of the user activities in digital format. Traditionally, such digital data include contacts, text and instant messages, call history, electronic mail, web browsing history, documents and geographical data. These rich sources of digital data present on mobile devices become increasingly important when mobile devices are linked to civil or criminal digital investigations. However, these sheer quantities of traditional digital data available on mobile devices often cause other forms of noteworthy digital data to go unnoticed. This paper investigates and identifies other available sources of digital data present on mobile devices that can be of value to digital forensic investigations. The study focuses exclusively on the Android operating system and presents an extensive evaluation of Android¿s file system. Furthermore, the study aims to locate, extract and utilise non-traditional or contemporary sources of digital data, such as log files, usage statistics and event data, as potential digital evidence in civil or criminal digital investigations. The outcome of the study leads to the construction of the new Pre-Analysed Device Snapshot (PADS) model, which provides a summary of the current state of the mobile device at the time of acquiring the device.