Challenges of smartphone forensics


1. Acquiring Smartphone Images

As security features like memory encryption are being introduced for iOS and Android, they limit the acquisition methods and amount of data that can be extracted from smartphones.


2. Recovering & Analyzing Smartphone Internet and App Data

Traditional mobile forensics tools don't dig deep enough into smartphone internet and App data to enable complete forensics analysis of all the user activity in popular chat apps, browsers, social networking apps, email apps, etc.


3. Integrated Analysis of Digital Evidence from Computer and Smartphones

Cases often require examination of combined user activity on computers, smartphones and tablets. Because this requires the use of specialized computer and mobile forensic tools, it can be difficult to get an integrated view of all the evidence collected.

Smartphone user behavior has quickly shifted away from calling and text messaging towards Internet apps for chatting, browsing, social networking, emailing, etc. Naturally recovering and analyzing data from these apps has become an important aspect of your smartphone examinations.
 
Top 5 Problems Recovering Smartphone Internet & App Data

1. New apps emerge and rise in popularity every few months

2. Established or popular apps are constantly being updated and changed

3. Multiple browsers may have been installed on the device. How do you know if you found all the data?

4. The important evidence might reside in data from an obscure app you've never even heard of

5. Your current mobile forensics tools aren't focused on supporting for the recovery app data
 
We understand that digital forensics is a means to end, and that your real mission is much bigger: Fighting crime. Preventing the misuse of company assets. Protecting national security.
 

Based on the direction Apple and Google are headed with recent and forthcoming versions of their operations systems, encryption of memory on smartphones is going to become a standard security feature.

This means that physical images will become increasingly challenging to acquire. Across the board, logical acquisition methods that use documented OS backup processes and commands are becoming the most viable and consistent options for extracting data from smartphones.