Mobile devices are becoming increasingly powerful and popular, and the average mobile phone will now hold considerable amounts of information. Their increasing capability provides more opportunity to store and disseminate information.
Some mobile devices allow photographs or videos to be taken. When a multimedia file is taken, some devices automatically embed the GPS location of the handset at that time. This allows the location of the user at that particular moment to be established at a later date.
Multiple communication protocols including Bluetooth, WiFi and 3G enable the free transfer of information across international boundaries. Users can browse the internet, send and receive e-mail with attached documents, or post entries onto a blog and, if that's not enough, removable media cards with huge storage capacities can be inserted into the device allowing information to be exchanged quickly and discretely.
Similar to computers, but with a greater diversity and arguably far more powerful in terms of capability, the evidential value of these items must not be overlooked. Whether the crucial evidence is stored on the handset or SIM card, CY4OR has the experience and expertise to extract and present this evidence.
CY4OR’s mobile devices team investigates hundreds of mobile phones each month. Our expert investigations include the production of call lists and contact information, the recovery of deleted SMS messages, a summary of mobile internet usage, and the production of photographs and videos.
Analysis of call data records
Call data records show calls made and received and provide the following data:
Date of call
Time of call
Call duration
Number making the call (originating)
Number receiving the call (terminating)
IMEI - International Mobile Equipment Identity
CI - Cell site identity number
These records can be invaluable in establishing relationships between defendants or determining wider locations such as in which town or city a call was made or received. It is also possible to be more accurate in determining geographical location through cell site analysis. When combined with other digital evidence such as CCTV or email, a conclusive argument can be constructed.
iPhone Investigations
Apple iPhone continues to proliferate despite the global recession. In the final quarter of 2009 sales figures were estimated at 11.3 million worldwide. Apple seem to have cornered the UK smartphone (a phone offering advanced, usually PC like functionality) market - with 76% of smartphone users having opted for iPhones. Not only can iPhones be used to make phone calls and send and recieve text messages, they can be used to access the Internet, access websites and send and receive emails - amongst a plethora of other functions. Apple’s iPhone is essentially a computer that fits into the palm of your hand.
Clearly the proliferation of iPhones causes complexities to those concerned with investigations where a user may have had access to such a device. Fortunately, CY4OR has developed forensic and data recovery techniques that facilitate the interrogation of iPhones and the recovery of deleted data. Using these techniques it is possible to investigate where an iPhone has previously been used and how it has been employed.
CY4OR has previously assisted clients with the interrogation of iPhones by recovering deleted voicemail messages, pictures, emails, calendar entries, address book entries and even text messages (amongst other data). Embedded data found within recovered photographs has even been examined to determine where the photograph was taken.
What data can be retrieved?
Depending on the case objectives of the client, it is possible to retrieve both live and deleted data from an iPhone. The following information can be ascertained:
SMS
Email
Call history & voicemail
Photos
Calendar events & alarms
Internet history & bookmarks
Address book contents
Typing cache
Additionally the following configuration information maybe ascertained:
iTunes history
Application installation history
Application preferences
GPS fix
Wifi history
iPhone configured email accounts