Cell Phone Data And Records: Hidden Digital Forensics

Summary

This video discusses the extraction of data from mobile devices in digital forensics. It covers various types of mobile devices, including phones, tablets, and connected devices like vehicles. The video explains the two main types of records: data records (such as contacts, SMS, call logs, and application data) and device records (including cloud-stored information and hidden files). The process also involves retrieving deleted files and hidden apps. The goal is to understand device usage, communications, and other activities through digital forensic analysis.

Takeaways

• 📱 Mobile devices include not only cell phones but also tablets, Kindles, and devices with Wi-Fi or 5G connections.
• 🛠️ Even damaged or non-powered devices can be analyzed through digital forensics.
• 🔗 Mobile devices often share data with other connected devices like laptops, Wi-Fi routers, and vehicles, which can also be analyzed.
• 🚗 Information shared between mobile devices and vehicle infotainment systems can include location, speed, Bluetooth data, and more.
• 📇 Data records extracted from devices can include contacts, SMS, emails, voicemails, and multimedia files.
• 📅 Calendar entries, appointments, and reservations from apps like Google Calendar can provide key evidence.
• 🖼️ Even deleted files like photos, videos, and emails can often still be recovered from a mobile device.
• 🌐 Browser history and cookies provide insights into websites visited, including locations, reservations, and more.
• 📂 Application data contains records within individual apps, including settings and possibly hidden apps or accounts.
• ☁️ Device records may sync with cloud services, revealing additional data not present on the physical device.

Q & A

What types of devices are included in mobile data digital forensics?

Mobile data digital forensics includes not only cell phones but also tablets, larger mobile devices like Kindle Fires or Amazon Fires, and even damaged or non-functioning devices that may still hold extractable data.

What kind of information can a mobile device share with other connected devices?

Mobile devices can share information with devices they connect to, such as laptops, Wi-Fi routers, or vehicles. For example, when a mobile device connects to a vehicle's infotainment system, it can exchange data like vehicle speed, location, Bluetooth details, and even radio channels or door events.

What are the two main types of records analyzed in mobile forensics?

The two main types of records analyzed in mobile forensics are data records and device records. Data records include contacts, SMS, call logs, and more, while device records delve deeper into the phone's underlying data, including cloud backups and deleted information.

What are some examples of data records that can be extracted from a mobile device?

Examples of data records include contacts (phone numbers and email addresses), SMS and text messages, emails, voicemails, call logs, calendar events, and multimedia files like photos and videos, including their metadata such as GPS location.

How can deleted records be retrieved from a mobile device?

Even after deletion, records such as photos, messages, or emails may still remain on the device for some time. Digital forensics can recover these deleted files as part of the data extraction process.

What kind of information can be extracted from the call logs on a mobile device?

Call logs provide details such as the numbers involved in a call, whether the call was inbound or outbound, the call duration, and the date and time the call took place.

Why is browser history important in digital forensics?

Browser history can reveal websites visited, reservations made, locations searched, or other web activities. It may also contain cookies, showing past interactions with those websites, which can help establish a timeline or intent.

What can be found in the application data during a mobile forensic analysis?

Application data can include user settings, configurations, and records held within individual apps, such as social media apps, communication tools, or even hidden apps without visible icons, like WhatsApp or Tinder.

How are cloud services relevant in mobile forensics?

Cloud services may store backups of data such as contacts, messages, call logs, and photos. Even if data is deleted from the phone, it may still be available in the associated cloud account.

What insights can be gained from analyzing the file system of a mobile device?

Analyzing the file system can reveal hidden or deleted files, gaps where data once existed, and the presence of blank spaces. This helps in understanding how the device was used and what information might have been removed.