Windows mobile advanced forensics: An alternative to existing tools

Digital Investigation

Volumn 7, Issue 1-2, 2010, Pages 38-47

  Rehault, Frederick ^a  

^a INSTITUT GÉOGRAPHIQUE NATIONAL   (France)

Author keywords

Bootloader; CEDB format; Cemail.vol; Flash memory; Windows CE; Windows mobile

Indexed keywords

COMPUTER FORENSICS; REMOTE CONTROL; SECURITY OF DATA; SMARTPHONES;

BOOT LOADERS; CEDB FORMAT; CEMAIL.VOL; WINDOWS CE; WINDOWS MOBILES;

FLASH MEMORY;

EID: 78449255925     PISSN: 17422876     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.diin.2010.08.003     Document Type: Article

References (12)

1. M. Breeuwsma, M. de Jongh, C. Klaver, R. van der Knijff, and M. Roeloffs Forensic data recovery from flash memory Small Scale Digital Forensics Journal 1 1 2007
2. E. Casey Introduction to windows mobile forensics Journal of Digital Investigation 2010
3. xda developers.com, xda developers wiki: The hermes bootloader http://www.http://wiki.xda-developers.com/index.php?pagename=Hermes-BootLoader 2008 [On line]
4. Gartner Gartner says worldwide smartphone sales reached its lowest growth rate with 3.7 per cent increase in fourth quarter of 2008 http://www.gartner. com/it/page.jsp?id=910112l 2009 [On line]
5. W. Hengeveld dumprom http://www.xs4all.nl/̃itsme/projects/xda/ dumprom.html 2009 [On line]
6. C. Klaver Windows mobile advanced forensics Journal of Digital Investigation 2010
7. S. Loh Windows ce base team blog: Dumping registry hives and cedb database volume http://www.blogs.msdn.com/ce-base/archive/2006/01/30/Dumping- Registry-Hives-and-CEDB-Database-Volumes.aspx 2006 [On line]
8. MSDN, Cepropval http://www.msdn.microsoft.com/en-us/library/aa917573.aspx 2010 [On line]
9. MSDN Hive-based registry startup sequence http://www.msdn.microsoft.com/ en-us/library/ms885475.aspx 2010 [On line]
10. MSDN, Registry types http://www.msdn.microsoft.com/en-us/library/ ms886080.aspx 2010 [On line]
11. MSDN, Tfat overview http://www.msdn.microsoft.com/en-us/library/aa915463. aspx 2010 [On line]
12. J. Murray Inside Microsoft Windows CE 1998 Microsoft Press