Mobile device forensics: isolation, acquisition and the challenge of encryption

Why phones are different

A smartphone holds messages, photos, location history, health data and access to dozens of cloud accounts. That makes it valuable evidence, but also hard to examine. Modern phones encrypt their storage by default, link encryption keys to the passcode and the device hardware, receive updates that close forensic access methods, and can be locked or wiped remotely. Mobile forensics is the branch that deals with these problems while keeping to the usual principles.

Securing the device

Photograph the phone and its screen as found, including notifications. Then isolate it from networks so it cannot receive a remote wipe or new data: use a signal-blocking (Faraday) bag or box, or flight mode if your procedures allow touching the device. Many examiners keep the phone powered and charging if it is already on, because a phone that has been unlocked since start-up is often in a state where more data can be extracted than after a restart. Record every action, including the time and battery level.

Levels of acquisition

• Manual: photographing what is on screen. Simple, but limited and changes the device by navigating it.
• Logical: copying data the operating system makes available, similar to a backup. Quick, but misses much app data and deleted content.
• Full file system: copying the file system, including app databases. Usually needs specialist forensic tools and may depend on the phone model, software version and lock state.
• Physical: a bit-for-bit copy of storage. Common on older phones, but full-disk and file-based encryption make it rarely useful on modern devices.

Commercial mobile forensic tools are updated constantly to keep up with new phones. Whatever tool you use, record its version and validate results where you can, for example by checking a sample of messages against screenshots.

Locked phones and passcodes

A locked phone is the most common obstacle. In workplace cases, company policy may require staff to provide passcodes for company devices, and MDM can sometimes help. In criminal cases, the law sets out when a person can be required to give a passcode; in the UK, for example, the Regulation of Investigatory Powers Act 2000 includes such a power. Specialist tools can sometimes bypass locks on particular models and versions, but this changes over time and should never be assumed.

What phones reveal

Key artefacts include messaging app databases, call logs, contacts, photos with their metadata, location records, Wi-Fi networks joined, app usage and account tokens. Much of this also exists in cloud backups and accounts. With proper legal authority, investigators can obtain data from providers or, in workplace cases, from managed device and account logs. For company devices, mobile device management (MDM) records can show which apps were installed and when a device was wiped.

Tip: privacy matters. Phones hold far more personal information than most cases need, so collect and review only what is relevant and authorised.

Real-world example: a delivery van and an alibi

A fictional courier firm is told that one of its vans was used in a robbery while the driver claims he was at home. With police involvement, the company-issued phone is collected and placed in a Faraday bag at once. The police examiner carries out a full file system extraction. Location records and Wi-Fi connections show the phone stayed at the driver's home address all evening, while the company's vehicle telematics show the van moving. Combined with CCTV, this points to a stolen spare key rather than the driver. The phone evidence protected an innocent employee.