I know this a very broad question with many effecting factors.. hardware/software etc etc, but in general, what turnaround time is it per phone investigation?
Were looking at moving that way, just need a approximate idea as at the moment we only work with computer forensics mainly.
Regards
Phones don't have much memory, so a lot can be done in an hour or two. Even with expansion cards, you're still only looking at a few gigabytes. An image usually takes between 10 - 30 minutes and SIM cards can be imaged in less time than that. What tends to slow the process down a bit is the uniqeness of each phone and how they store data.
…and the fact that you should have an appropriate audit trail, paperwork and potentially be able to write a suitable S9 statement and stand up in court explaining everything you did and why.
I'd add a little more time 😉
Phone investigation time increasingly depends on the software you use and the way you receive examined data.
Using Oxygen Forensic Suite 2 it will take several minutes to read all data and then to examine it inside the program or just print it to report which can be used in court.
Last time I looked, Oxygen only supports a very narrow set of phones. Has that changed?
Last time I looked, Oxygen only supports a very narrow set of phones. Has that changed?
The latest Oxygen Forensic Suite 2 version works with more than 1050 mobile devices Nokia mobile phones and smartphones, Sony Ericsson mobile phones and smartphones, Windows Mobile 5/6 smartphones and communicators (ActiveSync not required), BlackBerry, Motorola and Samsung smartphones. The list of supported models is constantly growing.
The people I use can turn it around in day and I understand that it takes 2 hours of their time which would include audit trail, imaging, extraction of all data and report (which I believe is automated).
The people I use can turn it around in day and I understand that it takes 2 hours of their time which would include audit trail, imaging, extraction of all data and report (which I believe is automated).
I would imagine this would only be a Logical read of the device assuming they had software that supported the handset being examined. In other words, if their software/hardware didn't support the handset there would be an increase in time due to research, purchacing etc.
Also if you required historic/deleted data I'm sure this time would be greatly increased.
My turnaround time is from around 1 to 2 hours for a standard exam and can go up to as much as a couple of days (depending on supported applications/hardware).
lmlewis, the quoted times of 2-3 hours are abstract. In reality what examiners are doing is to round up a general time that is palatable to both parties. Some jobs may take less than an 2 hour (rarely) and some jobs may take longer (very common). It's swings and roundabouts, so that is a way to possibly look at the matter.
However, the high spec smart/mobile phones that are increasingly in use are taking longer and if you can push more than 3 of these out within 12-hours day (and doing the job properly) then one might start to question the accuracy of your work and exactly what data has been extracted.
A further problem mentioned by others in the discussion thread is having the right hardware/software, which is a good one and then add to that
- getting the right power supplies (takes time)
- pin/password locked phone/SIM (takes time)
- broken mobile phones (takes time)
- poor examination instructions (takes time)
- deleted data (takes time)
- etc
- etc
So if you go for an attendance time, don't be disappointed if you do not do the work in the time you thought you could.
I am preparing a 1-day knowledge-base course for beginners in mobile phone and SIM card practices and procedures (not dealing with software) including examples of written procedures goods inwards, contemporaneous note taking, requests right through to quaratine and returning goods.