Cell Phone Forensics - Law

From person-to-person communication, to address book organization and on-the-go computing, cell phones are powerful, highly mobile devices. The set of features and capabilities can vary depending on the make and model of the phone. However, one aspect unifies all cell phone technologies. With the push of a button or the touch of a screen, digital trails are created, ripe for the picking by computer forensic investigators in litigation or internal investigations.

Recently, the Computer Security Resource Center of the U.S. National Institute of Standards and Technology (NIST) released a new piece of research entitled, "Guidelines on Cell Phone Forensics." This document outlines general principles and provides technical information intended to aid organizations evolve policies and procedures for preserving, acquiring, and examining digital evidence found on cell phones. These guidelines (available at /publications/drafts/Draft-SP800-101.pdf) are in draft form, and computer forensic specialists and members of the law enforcement community are encouraged to provide feedback.

As outlined in the NIST research, potential cell phone evidence may include:

Subscriber/Device Identifiers - These entries are helpful in identifying the owner of the phone, and other background information such as date/time/language settings, billing and usage information, and location tracking.

Phonebook Entries - Phonebook entries may contain more than just names and phone numbers, it also may include e-mail and postal addresses.

Call Logs - Phone logs capture recent calls attempted from the phone, received by the phone, and missed by the phone.

Message Entries - Message entries include voice, text, and e-mail received and sent by the phone. Undelivered messages also may be recoverable.

Calendar Items - Similar to a paper-based date-planner, electronic calendar entries may provide dates, times, and locations of scheduled events.

Photographs/Video - Many mobile phones have a built-in camera and video devices and can receive messages containing photos or videos.

Other File/Website Content - Some cell phones can navigate the Internet or display word processing documents, graphic files, spreadsheets, presentation slides, and other similar electronic documents.

If a cell phone might be a source of crucial evidence in your next case or investigation, seek the assistance of a qualified computer forensic expert, skilled in cell phone investigation best practices.

???????