An empirical comparison of data recovered from mobile forensic toolkits

Digital Investigation

Volumn 10, Issue 1, 2013, Pages 44-55

  Glisson, William Bradley ^a   Storer, Tim ^a   Buchanan Wollaston, Joe ^a  

^a UNIVERSITY OF GLASGOW   (United Kingdom)

Author keywords

Data recovery; Digital forensics; Empirical comparison; Mobile devices; Smartphones

Indexed keywords

COMPUTER CRIME; DIGITAL DEVICES; MOBILE DEVICES; RECOVERY; SMARTPHONES; SOFTWARE RELIABILITY;

CRIMINAL INVESTIGATION; DATA RECOVERY; DIGITAL EVIDENCE; EMPIRICAL - COMPARISONS; FORENSICS INVESTIGATORS; MOBILE FORENSICS; RECOVERY METHODS; SELECTION OF SOFTWARE;

DIGITAL FORENSICS;

EID: 84877837617     PISSN: 17422876     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.diin.2013.03.004     Document Type: Article

References (39)

1. T. Allen GSM mobile device and associated media tool test assertions and test plan 1st ed. January 2008 National Institute of Standards and Technology
2. J. Andrews Linux: kernel "back door" attempt November 2003 Kernel Trap Available at: http://kerneltrap.org/node/1584
3. C. Ball FTK 2.0: product review May 2008 Electronic Data Discovery Update Weblog http://commonscold.typepad.com/eddupdate/2008/05/ftk-20-product. html#more [accessed 10.11.11]
4. S. Bratus, A. Lembree, and A. Shubina Software on the witness stand: what should it take for us to trust it? A. Acquisti, S.W. Smith, A.-R. Sadeghi, TRUST'10 Proceedings of the 3rd international conference on trust and trustworthy computing Lecture Notes in Computer Science vol. 6101 June 2010 Springer Verlag Berlin, Germany 396 416
5. B. Carrier Open source digital forensic tools: the legal argument October 2002 White paper, @Stake
6. Cellebrite Universal forensic examiner's device product website 2011 Available at: http://www.cellebrite.com/forensic-products/forensic-products.html [accessed 18.11.11]
7. D. Childs, and P. Stephens An analysis of the accuracy and usefulness of Vinetto, Pasco and Mork.pl International Journal of Electronic Security and Digital Forensics 2 2 2009 182 198
8. Forensic Focus FTK 2-any verdicts yet? Discussion forum May 2008 Forensic Focus Community Website http://www.forensicfocus.com/index.php?name= Forums&file=viewtopic&t=2475 [accessed 10.11.11]
9. Forensic Focus Blog What happened to FTK2? Forensic Focus Blog May 2008 http://forensicfocus.blogspot.com/2008/05/what-happened-to-ftk-2.html [accessed 10.11.11]
10. S.L. Garfinkel, and A. Shelat Remembrance of data passed: a study of disk sanitization practices IEEE Security and Privacy 1 1 January/February 2003 17 27
11. R.L. Glass Software runaways: lessons learned from massive software project failures 1st ed. September 1997 Prentice Hall
12. W.B. Glisson, T. Storer, G. Mayall, I. Moug, and G. Grispos Electronic retention: what does your mobile phone reveal about you? International Journal of Information Security 10 6 2011 337 349
13. G. Grispos, T. Storer, and W.B. Glisson A comparison of forensic evidence recovery techniques for a windows mobile smart phone Digital Investigation 8 1 July 2011 23 36 URL: http://www.sciencedirect.com/science/article/pii/ S1742287611000417
14. Guidance Software EnCase Forensic product website 2011 http://www.guidancesoftware.com/forensic.htm [accessed 09.11.11]
15. J.W. Hengeveld Xda project - rapi tools June 2010 Available from: http://www.xs4all.nl/∼itsme/projects/xda/tools.html [accessed 24.11.11]
16. A. Hoog Android forensics: investigation, analysis and mobile security for Google Android 2011 Syngress 225 Wyman Street, Waltham, MA 02451, USA
17. R. Kuhn Non-GSM mobile device tool test assertions and test plan 1st ed. January 2009 National Institute of Standards and Technology
18. R. Kuhn Smart phone tool test assertions and test plan 1st ed. April 2010 National Institute of Standards and Technology
19. N.G. Leveson, and C.S. Turner An investigation of the Therac-25 accidents IEEE Computer 26 7 July 1993 18 41
20. R. Lock, T. Storer, N. Harvey, C. Hughes, and I. Sommerville Observations of the Scottish elections 2007 Transforming Government: People, Process and Policy 2 2 2008 104 118
21. D. Manson, A. Carlin, S. Ramos, A. Gyger, M. Kaufman, and J. Treichelt Is the open way a better way? Digital forensics using open source tools Proceedings of the 40th annual Hawaii international conference on system Sciences (HICSS'07) January 2007 IEEE Computer Society Big Island, Hawaii, USA
22. C.V. Marsico Computer evidence v. Daubert: the coming conflict Tech. Rep. 2005-17 March 2004 Center for Education and Research in Information Assurance and Security, Purdue University West Lafayette, Indiana, 47907-2086, USA
23. R. McKemmish When is digital evidence forensically sound? I. Ray, S. Shenoi, Advances in digital forensics IV IFIP advances in information and communication technology. Fourth annual IFIP WG 11.9 conference on digital forensics vol. 285 January 2008 Springer Kyoto, Japan 3 15
24. R.T. Mercuri Challenges in forensic computing Communications of the ACM 48 12 December 2005 17 21
25. R. Mercuri Criminal defense challenges in computer forensics S. Goel, Digital forensics and cyber crime. Proceedings of the first international ICST conference, ICDF2C 2009 Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering vol. 31 September/October 2010 Springer Albany, NY, USA 132 138
26. M. Meyers, and M. Rogers Digital forensics: meeting the challenges of scientific evidence M. Pollitt, S. Shenoi, Advances in digital forensics: IFIP international conference on digital forensics Vol. - of International federation for information processing February 2005 Springer, National Center for Forensic Science Orlando, Florida, USA
27. Microsystemation XRY forensic examiner's kit product website 2011 Available at: http://www.msab.com [accessed 21.11.11]
28. S.D. Nelson Craig Ball beats me to it: the disaster that is FTK 2.0 May 2008 Published online http://ridethelightning.senseient.com/2008/05/index.html [accessed 17.11.2011]
29. P.G. Neumann Illustrative risks to the public in the use of computer systems and related technology October 2011 Available at: http://www.csl.sri. com/users/neumann/illustrative.html [Last accessed 17.11.11]
30. S. Quinn Communications market report Research report August 2010 Office of Communciations (OfCom) UK
31. Radio Tactics Ltd. Aceso product website 2011 Available at: http://www.radio-tactics.com/products/aceso/ [accessed 21.11.11]
32. S. Radwanick 2010 mobile year in review February 2011 White paper, ComScore
33. M. Spreitzenbarth ADEL - Android Data Extractor Lite. Project web page 2012 Author's Forensics Blog Available at: http://forensics.spreitzenbarth.de/ adel/ [accessed 19.06.12]
34. K. Thompson Reflections on trusting trust Communications of the ACM 27 8 August 1984 761 763
35. TULP2G TULP2G product website 2007 Available at: http://tulp2g. sourceforge.net [accessed 17.11.11]
36. U.S. CFTC/SEC Findings regarding the market events of May 6, 2010. Report of the staffs of the CFTC and SEC to the joint advisory committee on emerging regulatory issues September 2010 U.S. Commodity Futures Trading Commission Three Lafayette Centre, 1155 21st Street, NW Washington, D.C. 20581. U.S. Securities & Exchange Commission 100 F Street, NE Washington, D.C. 20549
37. J. van den Bos, and R. van der Knijff TULP2G an open source forensic software framework for acquiring and decoding data stored in electronic devices International Journal of Digital Evidence 4 2 Fall 2005
38. Where is Your Data? Weblog Forensics: FTK 2. Where is your data? Weblog March 2009 Published online whereismydata.wordpress.com/2009/03/01/forensics- ftk-2/ [accessed 10.11.11]
39. S. Willassen Forensic analysis of mobile phone internal memory M. Pollitt, S. Shenoi, Advances in digital forensics IFIP international conference on digital forensics 2005 Springer Orlando, Florida, USA 191 204