Windows Mobile Forensics

You can use trial version Belkasoft http//belkasoft.com/get .

Analyzing Windows Phone 8.1 JTAG and UFED Dumps

Hi,

As part of our university research, we have been asked to look in to Windows Mobile OS forensics. Not Windows Phone.

Please define better "Windows Mobile", there are several versions of it
http//en.wikipedia.org/wiki/Windows_Mobile
all of them being more or less a "re-brand" of "Windows CE", and usually the "Windows CE" structures (and related "Windows CE" info, also related to forensics, are interchangeable with "Windows Mobile").

You can draw an approximate line with dates of results found typically anything 2010 or earlier is related to "Windows Mobile" and anything after is related to "Windows Phone".

Here is something that may interest you (considering that something like 80% or so of all devices were HTC)
http//digital-forensics.sans.org/blog/2009/08/12/acquiring-data-from-windows-mobile-devices/

jaclaz

Windows Mobile as in the successor to Windows CE, HTC devices. Pre Windows Phone. Runs on the old XDA/SPV/HTC phones.

Windows Mobile as in the successor to Windows CE, HTC devices. Pre Windows Phone. Runs on the old XDA/SPV/HTC phones.

Yep ) , I only tried (if needed) to "narrow the scope" HTC devices are known to be running at least
Windows Mobile 6
Windows Mobile 6.1
Windows Mobile 6.5

though they are very similar, there may be between them differences that are relevant in a forensic view of a disk image
http//en.wikipedia.org/wiki/Windows_Mobile_6.1
http//en.wikipedia.org/wiki/Windows_Mobile_6.5

And it is not really a "successor" of Windows CE, as it is essentially Windows CE (version 5/5.2).

jaclaz

Device Seizure supports all the Windows Mobile versions. You can get a free 30 day license here https://www.paraben.com/challenge.php