Mobile forensics is an increasingly complex environment for investigators because of the rapid rate of innovation and adoption of new technologies, applications, and hardware. Smartphones are being used in so many ways that they have become a central focus in digital forensic investigations.
The mobile platform is a forensic challenge because of the number of third-party applications found on many devices, the rapidly evolving security measures employed by the device manufacturers and application developers, and the explosive growth in the use of mobile devices and options.
Mobile devices include cell phones, tablets, and wearables, with literally several thousand different devices, equipped with countless types of interfaces, operating systems, and connectivity options.
This type of environment has many implications for an incident responder. The number of devices makes it impossible to be well-versed in each one, complicating analysis. The sheer number of devices also makes it expensive to stay abreast of the major players in the market. Users tend to choose mobile devices based on their portability, number of communication interfaces and sensors (e.g., GPS), and easy wireless internet connectivity. The features that make these devices popular are the same features that make them a critical piece of a digital forensics investigation.
In the steps that comprise this project, you will examine mobile investigative challenges, as well as the techniques and technologies available to perform mobile forensic examinations.
First, familiarize yourself with the details of the case and the basics provided by the sheriff. Then, you will need to develop an investigation plan that describes the current state of mobile incident response and investigation.
As you proceed through Project 4, you will get hands-on practice using the forensic tool EnCase and complete a forensic report. The next component will be a comparative analysis, in which you will describe the features of companion mobile phone forensic tools and recommend tools and techniques to use in the current investigation. The final component is a comprehensive forensic investigation report that will synthesize the investigation plan, forensic report, and comparative analysis.
Now that you know what’s ahead of you, move on to the first step of the project.
Intructions:
With a forensic investigation focused on an iPhone, you plan to undertake a series of steps to develop the report for Sheriff Jamison. You’ll start with an investigation plan that describes the current state of mobile incident response and investigation. In this plan, you will discuss the types of mobile phone technologies, challenges presented, and investigative techniques.
The goal is to summarize the current state with mobile phone forensics, the guidelines for how examiners approach mobile phone evidence, the challenges posed by iPhones, limitations and constraints, and the expectations for forensic analysis of the iPhone.
Step 2: Write an Investigation Plan
As a preliminary step in the process, Sheriff Jamison asks you to write an investigation plan identifying how you, as the digital forensics investigator, can assist with the case by examining the missing girl’s iPhone for footprints, and by providing a description of the considerations and mobile investigative challenges associated with mobile forensics and mobile platforms, including third-party applications, security measures, communication interfaces, and sensors. As a reporting technique, this plan should include the following:
where mobile phone data may be extracted from
what types of mobile phone data might be present
how mobile phone data can be retrieved from an iPhone
how the data will be forensically preserved and analyzed
mobile phone applications that may hold useful information to this case
how the evidence will be handled in anticipation of court admissibility
Based on your experience and expertise, you know to include deep diving to locate deleted and locked data and timelines, as well as geographic information systems and bring your own device guidelines. As you prepare to scan for tools to use in this investigation, you will outline the need to look at the phone (SIM/USIM), and any additional memory (SD/memory cards), for call logs, text and SMS messages, contacts, graphics, web history, location information, Wi-Fi Connection logs, and application data.
The goal of this plan is to summarize current mobile phone forensics and mobile incident response and investigation, the guidelines for how examiners approach mobile phone evidence, the challenges posed by iPhones, limitations and constraints, and the expectations for forensic analysis of this device.
Construct an investigation plan that addresses the concerns listed above. An investigation plan would typically be four to six pages, not including images and references. Use APA format and submit the plan to Sheriff Jamison (your instructor) for review and feedback. You will include the investigation plan in your forensic investigation report. Now you are ready to begin your investigation.

Order Now