Forensic Analysis of Mobile Phone Internal Memory

Mobile phones have become a very important tool for personal communication. It is therefore of great importance that forensic investigators have possibilities to extract evidence items from mobile phones. Modern mobile phones store evidence items on SIM-cards as well as internal memories. With the advent of modern functionality, such as camera and multimedia messaging, more and more of these items are stored in internal memory. Proper forensic examination of such memories, including recovery of deleted items, has not been possible until now. This paper presents two different methods of physical imaging of mobile phone memory units. The methods are applied to several popular modern mobile phones, and it is shown that the methods can be utilized in practice to recover important evidence such as deleted text messages. The discovery of mobile phone internal memory management functionality challenges the current mobile phone analysis paradigm.

• Type: Conference
• Year: 2005
• Where: IFIP
• Authors: Svein Willassen
• Keywords: Communications, Evidence Items, IFIP 2005, Mobile Phone, Modern Mobile Phones