Practical Mobile Forensics - Fourth Edition

Windows Phone applications

Applications found on Windows Phones are no different from those found on iOS and Android devices. SQLite is the most common format used for data storage. However, not all devices allow for SQLite files to be stored internally on the phone. For these devices, all application data will be found on the SD card. Some may view this as lucky because it saves us from having to examine several locations on the device, but the SD card and the applications themselves may be encrypted.

Where possible, it is best to remove the SD card and acquire it using a forensic tool. When this is not possible, the next best method would be to try to acquire the SD card through the phone using a forensic tool. Again, this will often result ...