Electronic Discovery Unit 2 IP, Essay Example

Introduction

The key to solving any crime is the collection of evidence. Any criminal investigation is comprised of a primary and secondary crime scene. Typically, the primary crime scene is the actual location of the crime. The secondary crime scene refers to the location where the victim was abducted (in the case of a violent crime), or the place where clothes or other evidence were discarded. Computers and other digital devices are treated as secondary crime scenes (Casey, 2011). In this day and age, digital devices are prime sources to be considered when gathering evidence for a crime. Digital media include computers, cell phones, personal digital assistants, and GPS devices. Digital investigators can use specific hardware and software tools to track the digit footprint of a suspected offender. Cell phones are particularly helpful in crime scene investigations as it gives an accurate record of communications between the suspect and the victim. It often contains video and voice recordings that may be helpful in targeting the suspect and solving the case (Casey, 2011). Furthermore, many modern cell phones contain built-in GPS devices that can provide the location of the suspect and the victim at a certain time.

This report will examine the hardware and software tools that must be used to search a smartphone device. It will also examine the various locations that must be searched and type of data that may be retrieved and subsequently analyzed for evidence.

Tools Used to Search a Smartphone

Proper forensic and procedural principles apply when conducting a digital investigation. First, the investigator should be properly trained to conduct a thorough and successful investigation. Second, the investigator should ensure that all collected digital evidence should be secured in a manner that does not compromise the integrity of that evidence. For instance, all collected evidence should be stored in anti-static containers. Last, all collection, storage, and examination procedures involved during the investigation should be documented and be available for review (U.S. Department of Justice, 2004, p. 12). Once the digital device has been seized, the investigator should make a copy of the original device and conduct the investigation on the copied version. Because digital evidence in fragile and can be easily compromised, this method will ensure that integrity of the evidence is maintained.

Digital investigations of cell phones differ from computer investigations because mobile devices have integrated communication systems. In other words, the investigator will focus on simple data, such as call records, text messages, and email (Casey, 2011). After the initial steps of securing the evidence, the investigator should ensure that all further communication to and from the device is blocked. Smartphones are equipped with wireless and Bluetooth capabilities, which mean that information stored on the device may be compromised, even if the device is in an off state. Prior to conducting the investigation, the device should be connected to a reliable power source. Memory acquisition is the first step of the investigation. A variety of forensic tools exists to assist in the data retrieval process from a cell phone.

Cell Seizure

This is a forensic software toolkit used to examine cell phones that operate over CDMA (Code Division Multiple Access), GSM (Global System for Mobile communication), and TDMA (Time Division Multiple Access) networks (Ramabhadran, 2006). It connects to the phone through a compatible cable and enables the investigator to retrieve text message history, phonebook details, call logs, calendar entries, and WAP settings from the cell phone.

MOBILedit!

This forensic software toolkit connects to a cellphone through an Infrared port and allows investigators to retrieve data from the phone, such as its model number and serial number. The toolkit can retrieve missed calls from the phone, as well as the last number dialed and photos stored on the device. Once data is retrieved, the toolkit transports the information from the phone to the toolkit in a .med file format (Akkaladevi, Keesara, & Luo, 2007).

Forensicsim

This toolkit can effectively retrieve and analyze data from a cell phone. Data is retrieved from the phone’s SIM (Subscriber Identity Module) card and can be stored on a disk, or printed. All retrieved data is read-only (Akkaladevi, Keesara, & Luo, 2007).

Forensic Card Reader (FCR)

This toolkit connects to the phone through a USB port and allows the investigator to retrieve data from the SIM card. The investigator can choose which data it wants to retrieve and can add the report number, case number, and examiner information on the retrieved data. This information can be merged to data to present a comprehensive report, which is stored in an XML format.

Smartphone Locations to be Searched

Smartphone investigations include a search of the phone’s memory which is stored on the phone’s registered operating system, removable media, or SIM card. Most cell phones operate on platforms like Research in Motion or Palm OS. SIM cards are removable which means that the cell phone owner can remove it from the phone and insert it into another device without making any major changes to the new device. A digital investigation can retrieve information originally stored on the SIM card, even if the suspect removed it from the phone. Furthermore, digital investigations can accurately identify the last number dialed from the phone, as well as the location of the phone during its last use (Akkaladevi, Keesara, & Luo, 2007). In addition, smart phone searches can determine which web-pages the user access from the phone, as well retrieve emails written by the user. Also, forensic tools used during a digital device investigation can obtain personal information management data, instant messaging information, and SIM card content (Akkaladevi, Keesara, & Luo, 2007).

Summary

A digital investigation relies on a combination of forensic tools to retrieve data from cell phones or computers. Often, the information retrieved from these devices contains evidence that may be incriminating to criminal suspects. Any data retrieved from a cell phone during a criminal investigation may be used to determine if a suspect is guilty of a crime. Data collected through the use of forensic tools include call history, message history, and url history of the phone user. It can also identify the location of the phone at the time when the crime was committed.

Works Cited

Akkaladevi, S., Keesara, H., & Luo, X. (2007). Efficient Forensic Tools for Handheld Devices: A comprehensive perspective. Virginia: Department of Computer Information Systems Virginia State University.

Casey, E. (2011). Digital Evidence and Computer Crime, Third Edition . New York: Academic Press.

Ramabhadran, A. (2006). Forensic Investigation Process Model for Window Mobile Devices. Security Group – Tata Elxsi, 1-16.

U.S. Department of Justice. (2004). Forensic Examination of Digital Evidence: A Guide for Law Enforcement. Washington, DC: National Institute of Justice.