Smartphones are an important source of potential evidence in the types of investigations and litigation common in the digital world. From employment disputes to corporate fraud cases, these devices contain an abundance of information that can tip the scales in a case. As demands for smartphone data analysis continue to grow, legal and technology professionals must be well-versed in mobile device investigations.
The Growing Importance of Mobile Device Forensics
Why Smartphones Matter in Legal Cases
Smartphones are increasingly becoming central to various types of investigations:
- Employment matters
- Intellectual property theft
- Foreign Corrupt Practices Act violations
- Corporate fraud
As this trend continues, legal professionals must familiarize themselves with the processes and technologies used in smartphone investigations.
Investigation Types
Why Mobile Phones are So Complex to Investigate
More specialized knowledge and tools are required for mobile phone investigations due to:
- Device Complexity
- Device Diversity (iPhones, Androids, legacy devices, international)
- Different security measures (passwords, PINs, swipe patterns)
What Mobile Phone Investigations Usually Include
- Evidence Handling: The chain of custody must be maintained
- Data preservation: Specialized tools to extract the device data
- Examination: Examining that data with forensic software
Tools of the Trade: Cellebrite
Cellebrite is one of the most widely used forensic tools for mobile device investigations. It combines software and hardware capabilities to extract and analyze various types of data from smartphones.
Common Reports Generated by Cellebrite
Cellebrite produces several reports containing crucial information:
- Device Information:
- Device name, type, and version
- Serial number and phone number
- Associated accounts (e.g., Apple ID)
- Installed databases (e.g., GPS logging)
- Call History:
- Call logs
- Contact information
- Voicemail
- Gallery:
- Photos and videos, including location metadata
- Internet Activity:
- Browsing and search histories
- Social media activity
- Text Communications:
- SMS, MMS, iMessage
- Third-party messaging apps (e.g., Facebook Messenger, WhatsApp)
- Other Data:
- Installed apps
- Media files
- Downloaded documents
- Connected Wi-Fi networks
Limitations and Considerations
Device Dependent Extractions
The amount of data that can be extracted from a mobile device is dependent on several factors:
- OS & OS version
- Type of memory chip
- Applications installed
- Messaging platforms used
This lack of standardization can lead to complexities for investigators and legal teams.
The Critical Nature of Timing
It is essential to document the time and date that the extraction was performed because what can be accessed from the device will depend on what state the device was in at the time.
The Role of the Forensic Investigator
While Cellebrite reports provide valuable data, the forensic investigator plays a critical role in:
- Understanding the key issues of the case
- Providing context to the extracted information
- Building timelines by connecting data from various sources (chat messages, call logs, location data, image files)
- Comparing and linking information from multiple devices or reports
