Challenges in Mobile Forensic Technologies - Essay Example

Mobile Forensics Mobile Forensics Challenges in Mobile Forensic Technologies There are various challenges that mobile forensicsare faced with, mostly surrounding the different operating systems the market has to offer, differences in the necessary connections and data acquisition processes, the specific functionalities of acquisition tools, and differences in software tools used for data extraction. The operating systems that exist currently in the market come from the three main vendors, including MS Windows, OS X (Apple), and Linux OS. One would think that this presents the user with a wide variety to choose from and some flexibility to enjoy in conducting digital forensics (Ahmed and Dharaskar 2014). However, the OS’s differ in many ways on the way they function and the different ways by which one can access or even protect data in them. For instance, MS Windows has Windows Mobile and Windows Phone, which, regardless of coming from the same vendor, have clear differences in functionality. These differences bring about technical difficulties mobile forensics. Another aspect of these challenges is the difficulty in connections. A forensic expert would have to choose the correct model from numerous ones in order to connect a phone, with just a few software tools that make selection easier. Only those with Windows OS’s are easy to connect via USB, which is not always possible. The interactivity between different OS’s, therefore, becomes quite difficult (Nelson, Phillips and Steuart 2015). Another problem, which comes with data extraction, is the use of logical and physical extraction processes. While the physical extraction process allows one extract all the data on the phone, the analytical process is complex and often expensive because of the expensive equipment involved. With regard to the logical process, data is easily readable but is limited because the API that comes with the phone was not designed for that purpose, which is why it has these limitations. The last challenge with mobile forensics is that there is not one specific software tools that are used in data extraction. There are numerous ones that one has to choose from, the efficiencies of which are difficult to determine while others are not compatible with some OS’s. At the same time, it is difficult to obtain support from the software vendors. Besides problems in carrying out investigations on mobile devices, there are problems that have been associated with the general digital forensics. The acquisition and presentation of electronic evidence from desktop or laptop computers is surrounded with more technology oriented difficulties than traditional forensics, which used to be based on paper. For instance, it is much easier, with modern technology, to corrupt evidence that exists on a laptop computer, or even make allegations that such evidence is corrupted, hence inadmissible in court, because it is technologically possible. Modern computers are accessible through numerous means, including Bluetooth, Wi-Fi, and infrared among other technologies. These are means that can be used to access digital evidence, even in the most secure computers and computer networks. Traditional computers, such as those as old as 30 years ago, would be easier to shield from such means of unauthorized access, making it difficult to corrupt. Take the example of the case of Bernard Madoff. Madoff stored the data of those he scammed on an old IBM computer that was made in the 1980s, which if in compatible with some of the aforementioned technologies. Not many forensic investigators would have the experience to access evidence from a computer that was made about 25 years ago. This computer, however, has its advantaged because it is not easy to access via some of the most modern connections, such as those with modern laptops, tablets, and mobile phones, which are easy to hack into and corrupt evidence, even though Madoff was smart enough to use the old computer to his advantage. Methodology for Mobile Technology Forensic Examination The process of examining mobile forensics involves a series of steps, with the first one being evidence intake. In this stage, requests for examinations are processed and details are provided on the objectives of the examiner. The details that are most important in this step include the chain of custody of the devices, information on the owner of the device, and the kind of investigation that needs to be conducted, based on the kind of incident it was involved in. This is followed by the identification phase, which involves the identification of various aspects of the mobile device, including the model, the data on it, related sources of additional evidence, and the legal authority that binds the owner and the examiner to the examination. The identification phase also involves details such as the serial number of the device, the ID of the equipment, and the international Mobile Equipment Identifier (IMEI) for GSM mobile phones among other details used to identify the device. The preparation phase follows, which involves research to examine the specific mobile device and to make sure that all necessary tools needed for the examination are in place. This is followed by the isolation phase. The preparation phase also involves a very important step. It involves the research process that the examiner has to embark on in an effort to find out the specific tools and means that can be used for data extraction. The research process, therefore, is a very important role of the examiner in this stage. This is followed by the isolation process. This involves isolation of the mobile device to all the networks over which it is designed to communicate, including telecommunication networks and Wi-Fi among others (Nelson, Phillips and Steuart 2015). This process helps in that the data in the device cannot be accessed, meaning that it cannot be changed through calls of messages or any form of remote access. It is, therefore, kept in safe custody. After isolation there is the processing phase, which involves the actual processing of the data. Removable and non-removable data sources are connected to the processing tools. Devices such as memory cards and any other form of data storage media are processed separately to prevent them from altering data stored in them. This is followed by the verification stage, for which it is necessary to confirm the accuracy of the data before it is documented. During the verification stage, consistency is of essence. As such, various approaches can be used, including the comparison of the extracted data to the device by marching the data with what the device displays, verification of the underlying hex, and comparison of results from different tools. This is followed by the documentation and reporting stage, in which the filling of all necessary information in the examination sheets, such as date, condition of the mobile device, and the tools used among other details. After this there is the presentation phase, in which the information can be presented to an investigator or court, usually, in both paper and electronic formats. Finally, the data is archived for future use, where it is important to make sure that the data is still usable. Training and Expenses in Mobile Technology Forensic Examination Mobile forensic investigators face elevated expenses in training processes and as they seek to acquire different tools for use in the examination process. One of the major expenses they incur is for the training process. It is understood that the tools used in forensic examinations are complex and diverse. It is not easy for an investigator to find a hardware to software tools that he is completely familiar with because there are many in the market, many of which many examiners have not used before. As such, they have to incur some costs as they are trained on how to use these tools. The training costs can be as high as $1000. For instance, in the North East Forensic Data Recovery, a course that takes just two days, known as Introduction to Digital Forensics, costs $1000 while Windows Forensics or Introduction to Mac costs $1500 and lasts only three days. The tools necessary are also not always accessible. Expensive tools have to be used as data is being accessed, isolated, and analyzed from the mobile devices (Nelson, Phillips and Steuart 2015). The tools have to be purchased and, as has been noted earlier, this is an additional major expense. In some instances, costs can be extremely high, owing to the big research and development budgets resources that are expended to mobile forensics. References Ahmed, Rizwan, and Rajiv Dharaskar. "International Journal of Advanced Research in Computer Science, Special Issue, Vol. 5 Issue 4." orensic Presevation of Digital Evidence on Mobile Devices from the Perspective of Efficient Generalized Forensics Framework for Mobile Devices (EGFFMD), 2014: 214-218. Nelson, Bill, ‎Amelia Phillips, and Christopher Steuart. Guide to computer forensics and investigations. New York: Cengage Learning, 2015. Read More