Why is Mobile Forensics so important for the success of an investigation?

Mobile devices, together with Internet of Things, Cloud Computing and Big Data have been the booming technological trends in the last years. Smartphones provide a load of different features and allow users to perform almost every task previously done with computers.

On the following graph you can find the historical development of the distribution of mobile devices (smartphones, tablets) in comparison to desktop computers. Smartphones substitute desktop computers in nearly every way as they are portable and more convenient to use for most applications, ranging from private use to business, from taking photos to online banking.  As a result, smartphones carry valuable information for many investigations. They are providing recent chats, call logs, location data, pictures, etc., which helps the forensic investigator to identify the person and to learn about their recent activities. In most cases, they carry more personal information than a traditional PC used to do. Thus, analysing mobile phones has often become the main part of a forensic investigation.

But the trend of mobile devices also carries new challenges for forensic investigators: manufacturers spend more time in the development of new features, security mechanisms and hardware. Operating systems and 3rd party applications are updated much more frequently than we have seen with desktop systems. We summarized the main challenges of mobile forensics in a previous post:  http://www.t3k-forensics.com/allgemein-en/10-main-challenges-in-mobile-forensics2/

The recent developments in mobile forensics software greatly support investigators by extracting and visualizing the data found on smartphones, tablets and other devices. However, the fast changes in the mobile device market and the bulk of different devices and apps make it hard for those toolkit manufacturers to keep their solutions up-to-date, to secure that the maximum amount of data is extracted and correctly interpreted from each mobile device. While the task of supporting as many different devices and apps as possible is a challenge to the manpower of any R&D department, dealing with security features in order to be able to get any data at all from mobile devices is a constant cat-and-mouse game between mobile device manufacturers and forensic toolkit manufacturers, pushing the development of technologies to an unprecedented high level.

Conclusio:

As mentioned above, mobile devices carry a magnitude of valuable information in most cases, making them a central part in the forensic investigation process. But analysing mobile devices alone is often not the key to success anymore – investigators should also consider including the analysis of cloud data, computers or even network traffic. If you take all these points into account, you will maximise your chances for a successful investigation.

If you want to improve your knowledge in mobile forensics, we would be pleased to help you solve any problems, whether with our trainings or our expert witness services.

T3K-Trainings Information

Forschungs- und Förderungspartner: