±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 1
New Yesterday: 11
Overall: 27001
Visitors: 89

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Why bother using mobile forensic tools

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

Why bother using mobile forensic tools

Post Posted: Thu Oct 10, 2013 10:13 pm

I'm wondering why there is market for mobile forensic tools if the service providers store everything? The authorities can directly go to service providers for evidence in legal cases and sure enough they will get everything they want no matter whether the information is deleted or not on the suspect's phone.

Especially as the storage cost of digital information becomes cheaper and cheaper(eg: 1TB Seagate HDD drops to around $ 50),it is absolutely practical that service providers can store everything related to their users.Does anybody has any ideas about this?  

Georgefan
Member
 
 
  

Re: Why bother using mobile forensic tools

Post Posted: Fri Oct 11, 2013 12:22 am

- Georgefan
I'm wondering why there is market for mobile forensic tools if the service providers store everything? The authorities can directly go to service providers for evidence in legal cases and sure enough they will get everything they want no matter whether the information is deleted or not on the suspect's phone.

Especially as the storage cost of digital information becomes cheaper and cheaper(eg: 1TB Seagate HDD drops to around $ 50),it is absolutely practical that service providers can store everything related to their users.Does anybody has any ideas about this?


Because there is usually content recorded (phyiscally and logically) on a mobile device that is NOT stored with the operators.

Wireless and communications content stored on a device is used to identify elements in a case that can be used in the request for potential evidence that may be stored with the operator.

Wireless and communication content that is stored with an operator can be used to corroborate content found on a mobile device.

Importantly, personal or wireless and communication content on a mobile device can be used in the analysis and link to a particular person or persons and investigations to understand movement, location, association, intention/s (mens rea), action/s (actus reus) etc etc.

The issue of cost of processing data from a 1TB HDD and examination of a mobile phone are not really compared in the pursuit of investigation and evidence. A cost is considered when costing a case but not in the context you have framed your question.

It is down to the examination person or organisation which of the variety of charged and free tools out there will be included in the investigation arsenal of tools. No one tool does everything. This is another point to remember do not buy tools on the basis that they can create a production line approach of 'bang it on, bang it out' philosophy because its cheap. When you work in forensics it is about investigation and analysis and should not be about 'well we didn't get that content because our tool couldn't extract and harvest that data or we don't think its relevant because our tool didn't tell us to get the data.
_________________
Institute for Digital Forensics (IDF) - LinkedIn
Mobile Telephone Examination Board (MTEB) - LinkedIn
Mobile Telephone Evidence & Forensics trewmte.blogspot.com
ForensicMobex now MTEB Linkedin Subgroup 

trewmte
Senior Member
 
 
  

Re: Why bother using mobile forensic tools

Post Posted: Sat Oct 12, 2013 4:14 am

- trewmte

Because there is usually content recorded (phyiscally and logically) on a mobile device that is NOT stored with the operators.
The issue of cost of processing data from a 1TB HDD and examination of a mobile phone are not really compared in the pursuit of investigation and evidence. A cost is considered when costing a case but not in the context you have framed your question.

trewmte,thanks for the reply,I thinkg the process of accessing service provider's storage is easier because it only needs a database search ,difficult point is how to get authority to access the database.
I agree with you that maybe there is something on mobile device that is not stoead in the service provider such as contacts,especially as the smartphone's era comes,a lot of stuff on the external SD card is not going to be stored in the service provider'database.Also if applications on mobile device communicate with other using WIFI but not 3G/CDMA/GSM,then there is good reason to examine the phone.  

Georgefan
Member
 
 
  

Re: Why bother using mobile forensic tools

Post Posted: Sat Oct 12, 2013 12:09 pm

I would think that accessing the data stored on a device would be necessary to prove physical possession of certain "illegal" content.  

Astro
Member
 
 
  

Re: Why bother using mobile forensic tools

Post Posted: Sat Oct 12, 2013 10:17 pm

Some service providers don't retain certain data after 3 days, so it's not feasible to always rely on the service providers for evidence, especially if you get a late start and was not able to fire off a preservation letter.  

sward6
Member
 
 
  

Re: Why bother using mobile forensic tools

Post Posted: Sat Oct 12, 2013 10:53 pm

- Georgefan
I'm wondering why there is market for mobile forensic tools if the service providers store everything?


Your question is flawed in that cell service providers don't store everything. They actually record only very little. For instance, while they may store call logs for a year, they don't store any text messages (the main way people communicate now days). The ONLY place you will get text messages is via cell phone forensics.

On top of that, a service provider has no right, nor incentive, to store other things, such as facebook, twitter, kik messenger, text+, skype, and so on. You can only get at those via cell phone forensics.  

twjolson
Senior Member
 
 
  

Re: Why bother using mobile forensic tools

Post Posted: Sun Oct 13, 2013 4:33 am

they really only store what they need for billing

not to mention theres always the legal defense of "you got this on the server, and not my clients phone. what's to say someone spoofed his phone somehow and put it there"
and i dont want to deal with that...

if you have a call charge record that shows text messages sent from a to b
and the phone contains the messages sent from a to b you can infer that the messages were sent  

randomaccess
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 2
Go to page 1, 2  Next