Forensic Analysis of Mobile Phone Internal Memory

Mobile phones have become a very important tool for personal communication. It is therefore of great importance that forensic investigators have possibilities to extract evidence items from mobile phones. Modern mobile phones store evidence items on SIM-cards as well as internal memories. With the advent of modern functionality, such as camera and multimedia messaging, more and more of these items are stored in internal memory. Proper forensic examination of such memories, including recovery of deleted items, has not been possible until now. This paper presents two different methods of physical imaging of mobile phone memory units. The methods are applied to several popular modern mobile phones, and it is shown that the methods can be utilized in practice to recover important evidence such as deleted text messages. The discovery of mobile phone internal memory management functionality challenges the current mobile phone analysis paradigm. 1.0 Introduction It is clear that mobile phones contain information that may have value as evidence in investigations. The mobile phone has become the modern person’s primary tool for personal communication, and therefore frequently contains information about a person’s activities. Obtaining information on such activites is often a primary goal in an investigation. Analyzing the content of a mobile phone is therefore an invaluable tool for the forensic investigator. This paper first examines what evidence exists on mobile phone internal memory. Two different methods for imaging phone internal memory are then discussed. Further, memory content is examined for evidence items. 2.0 Evidence in Mobile Phones Mobile phones are digital media. In principle, this means that mobile phones have the same evidentiary possibilities as other digital media, such as hard drives. For example it is, as will be explored in this paper, possible to extract deleted information from a mobile phone, in the same way it is possible on a hard drive. However, mobile phones also suffer from the same evidentiary problems as other digital media. As with a computer, the content of a mobile phone is fragile and can easily be deleted and overwritten. Mobile phones should therefore be handled with great care and insight, just as any other digital media.