Forensic Profiling of an eBook Reader: an Example

Forensics profiling refers to the study and exploitation of traces in order to draw a profile relevant to the investigation about criminal or litigious activities. While traces may not be strictly dedicated to a court use, they may increase knowledge of the subject under investigation. In this context we will study the evidence found in a modern ebook reader, and we will explain how it could be used during an investigation to help understand the profile and the habits of its owner by building a reliable timeline of all the interactions between the user and the device. We use as an example a modern ebook reader, the Sony Touch PRS-650, of which we present a complete profiling made with custom software.