Practical Mobile Forensics - Fourth Edition

Potential evidence stored on mobile phones

The range of information that can be obtained from mobile phones is detailed in this section. Data on a mobile phone can be found in a number of locations—SIM card, external storage card, and phone memory, for example. In addition, the service provider also stores communication-related information. This book primarily focuses on data acquired from a phone's memory. Mobile device data extraction tools recover data from a phone's memory. Even though data recovered during forensic acquisition depends on the mobile model, in general, the following data is common across all models and useful as evidence. Note that most of the following artifacts contain timestamps:

• Address book: This contains contact ...