Practical Mobile Forensics - Fourth Edition

SD card data extraction methods

Windows Phones may contain removable SD cards. These cards may be secured with a key that prevents the SD card from being removed and used, or accessed via other devices (phones, cameras, computers, and more). This is different from the key that is created if the user encrypts the SD card. Brute-force and dictionary attacks can be run on user-encrypted SD cards in an attempt to access the data. When examining a Windows Phone, it is best to research the device to see whether SD card security will be a factor when acquiring data from the device. If so, simply follow the preceding steps and acquire the SD card data through the phone during forensic extraction. Please refer to the following chart.

For devices where ...