How to perform cell phone forensics

Trying to solve a crime and all you have is a cell phone for evidence? I will show you where open source software is available to perform cell phone forensics and also where you can buy professional tools that law enforcement officials use.

Instructions

Difficulty: Challenging

Things You’ll Need:

• cell phone
• pc

1. This might be way over your head for most people, I can barely grasp it myself. But to put it in a nutshell, you can extract a lot of information from a cell phone.
   TULP2G is a .NET 2.0 based forensic software framework for extracting and decoding data stored in electronic devices. Along with the framework this version includes several plug-ins in the area of retrieving data from mobile phones and generating the accompanying reports.
   This is found on this web page:
   http://tulp2g.sourceforge.net/
   There is a bunch of reading on that page and includes links to download the software as well as support forums.
2. Giudelines for cell phone forensics
   http://csrc.nist.gov/publications/nistpubs/800-101/SP800-101.pdf
   
   PDA Forensics Tool Evaluation
   http://csrc.nist.gov/publications/nistir/nistir-7250.pdf
   
   Read through both of the PDF's above for more information.
3. If all else fails, there are hand held tools that can do all the work for you and quite quickly. This is what law enforcement folks use.
   http://www.guidancesoftware.com/products/neutrino.aspx
   
   Extracted mobile device data is stored in an EnCase® Logical Evidence File (LEF) and can be examined via EnCase v6 only. EnCase software provides access to some or all of the following information from supported mobile devices within the Records Tab:
   • Device Settings
   o serial number
   o manufacturer information
   o firmware/hardware information
   o IMSI#
   o IMEI#
   o cell tower location
   o ringer volume, etc
   
   • Contacts / Phone Book
   • Call Logs
   o received
   o dialed
   o missed calls
   o call duration
   
   • SMS and MMS messages
   • Calendar
   • Files stored on the device
   o images
   o sounds
   o documents
   o ring tones
   
   • File System
   o Java packages
   o games
   o programs
   o executables
   
   • Deleted content from unallocated space (available with SIM card and physical acquisitions only)

Tips & Warnings

• Accessing someones cell phone without their permission would be considered electronic theft unless you are a law enforcement official