Mobile Forensics: Beyond data acquisition

By Mike Dickinson

Imagine a scenario where you are using a mobile forensic tool to generate a report for presentation in court, only to discover that your evidence is about to be challenged.

Digital evidence can be just as powerful and effective as physical evidence, but at the same time it requires examiners and investigators to be able to defend their findings – and their tools and methods – in court. Preserving the integrity of digital evidence in order to defend any challenges in court is of paramount importance.

Digital evidence can be used quite simply to place people and events within a time or space to establish causality for criminal incidents. However, mobile evidence has a wider scope, it can be personally sensitive, document user activity, chats, photos and even health data. It requires significant training to maximize the full potential of the tools and data made available.

Plus, there’s more to mobile forensics than just extracting the data. Decoding and presenting the extracted data so it can be used as evidence is also critical. Unless you are a digital forensic expert who reads hex code and binary data natively, you will probably rely on the tools to do your work for you. Nevertheless, in court you still might need to be able to explain how the tools work.

In order to solve this in a sustainable way for the long term, organizations need to spend as much money training staff as they do investing in mobile forensic tools, to ensure cases progress successfully in court.

We’ve written a white paper about the importance of preserving the integrity of digital evidence, with the purpose of encouraging mobile forensic practitioners to consider a wider number of critical factors surrounding their choice and use of mobile forensic tools.

Read more here: Four Critical Success Factors in Mobile Forensics.