Mobile Phone Forensics

Mobile phones are now one of the most widely used personal accessories available today. Most modern phones have built-in cameras, the ability to record video, voice and sound. They can perform the download of e-mail and web pages and the storage of documents. These fundamental tools, have, however, led to inappropriate use of mobile phones, which is now becoming extremely widespread.

Mobile phone forensics can be broadly broken down into two main categories; handsets and cell site analysis.

Handset

This involves examination of the data contained in a user's handset. Data of evidential value can be found in three areas of a mobile phone handset; on the SIM card, in the integral memory and on any removable media fitted in the phone. This is a relatively new area of forensics and as such software and hardware solutions are being developed on a daily basis, and none of which provide a solution in all cases.

A very new and exciting area in handset forensics is hex dump analysis, this is akin to more traditional computer forensics whereby a low level byte for byte copy of the memory of the phone is acquired, and this memory dump (referred to as a hex dump) is examined for call logs, SMS messages etc. In particular these areas of the phones memory can contain deleted data not found using other techniques. Sanderson Forensics are actively researching and developing software to help examine these areas of a telephone.

Cell Site Analysis

Cell site analysis can be used to determine the likely geographic area in which a mobile telephone was used when a call was made or received. Logs are maintained by the telephone companies that record various information regarding a cell phone call, this information includes the location of the mast(s) used to service a call along with the antenna which can help determine the approximate direction from the mast of the telephone during the call. An examination of these records along with a cell site survey can be used to prove or disprove a particular alibi. More information on our services in this area can be found on our Cell Site Analysis web page.