The threat of mobile malware continues to increase as the number of mobile device users increases globally.  Consequently, mobile forensics has come to the forefront of modern digital forensic investigations. Malware artifacts can affect both criminal and civil investigations by complicating the forensic process during the extraction and analysis processes. For example, altering the functionality of operating systems can spoil forensic analysis efforts. Mobile devices such as smartphones have operating systems such as Android and iOS that allow for the installation of third-party applications that operate with restrictions of the operating system such as application isolation and other memory demands. This paper will explore the challenges of working with different operating systems while collecting evidence, and explain chipping off, live and postmortem mobile forensic analyses. 

The Process of Mobile Forensic Investigation

There are four primary steps of the forensic investigation process: Identification, Collection, Examination, and Documentation. First, potential evidence must be identified and secured using a process that has been approved by the courts. The mobile device, power supply cables, peripherals, docking cradle, and external memory cards should be collected following an extensive search for any memory cards and connected equipment. During the collection process, it is critically important for the investigator to collect all information, including volatile and dynamic data, as volatile data will not survive if a device has been turned off. Next, the investigator needs to recognize what device and operating system(s) he or she is working with. An exact image of the mobile....

Author

Rhonda Johnson

Latest Articles