At the Mobile Forensics Conference 25/26 November there will be presentations and training session modules on mobile phone examination and ways to examine them using tools.
What I wanted to know is how examiners cope when dealing with touch screen mobiles, like the Samsung S5600 and so on?
Annoying events I have found are
(i) where the user has set "keylock"
(ii) where another application is open to then have to hunt to get the keypad back on screen,
(iii) first touch doesn't generate a response and having to re-touch to activate instruction
(iv) the insane keys/buttons on one or both sides of the handset that accidently get pressed when holding the device (I now use a jig to hold certain devices to avoid those annoying unintended actions)
So how are you all coping?
Isolating touch screens from the network in farabay bags has been an issue in the past. With the fabric touching the screen and getting an undesired response.
I find that an analysis between two tools works better for the call records than one tool along with a full manual examination. Couple this with a limited manual check so as to avoid accidentally making calls on the device.
For the rest of the data held on the devices it is definitely frustrating to navigate them but at least there is limited chance of changing any of the data on the device.
One thing is for sure, when I know that I have a touch screen phone to examine, I don't have a smile on my face! twisted
Thank heavens I am not alone in thinking, with these phones, they are a touch complicated (sorry for the pun).