Practical Mobile Forensics - Second Edition

Chapter 12. Windows Phone Forensics

Windows phones are becoming more widely used, and they may be encountered during forensic investigations. These devices are the most affordable on the market, so understanding how to acquire, analyze, and decode data from Windows phones is important. Locating and interpreting digital evidence that is present on these devices requires a specialized knowledge of the Windows Phone operating system and may not always be possible. Commercial forensic and open source tools provide limited support to acquire user data from Windows devices. As Windows Phones do not occupy much of the mobile market space, most forensic practitioners are unfamiliar with the data formats, embedded databases used, and other artifacts that ...