Toward a new tool to extract the evidence from a memory card of mobile phones

Today, a mobile phone is not just a "phone" but it is a computer that you can also use for calling someone. Besides, in criminal investigations the importance of evidence from the mobile phone is increasing as more and more phones are seized at the Digital Forensic Department of the police. Indeed, the amount of memory cards of these mobile phones that need to be investigated separately is also increasing. Possible reasons are that the mobile phone investigation software does not support the specific mobile phone or the specific, for that investigation, artefacts. Sometimes the software investigates just the internal memory of the mobile phone and not the data which is written on the memory card. Fact is also that although the mobile phone was investigated by the dedicated software, the possibility that the associated memory card contains additional important information is evident. The current procedure to get all of the usable information from a memory card of a mobile phone is very time-consuming process and not user friendly. In this paper, we present a new single tool to simplify the investigation of a memory card from a mobile phone. We also test our tool with WhatsApp application installed on the memory card from different mobile phones.

I. Introduction

One of the tasks of a Digital Forensic Investigator is examining a mobile phone. Today a mobile phone is not just for calling, it is more and more expanding towards a little portable computer. The owner of the mobile phone carries a lot of private information in his pocket and in a lot of criminal investigations this private information could be the key to solving the crime. Besides, in the market and literature there are many forensic software that the digital investigators can use in acquisition forensic artefacts from mobile phones. Depending on the brand and type of the mobile phone, relevant information will be extracted. For the digital investigator it is impossible to know for each specific mobile phone which software is the best to investigate.