
handle: 11572/67390 , 11577/2580646 , 11590/134666
More and more often, smartphones are relevant targets of civil and criminal investigations. Currently, there are several tools available to acquire forensic evidence from smartphones. Unfortunately, most of these tools require to connect the smartphone under investigation through a cable to an external device, like a computer or a multimeter. Some tools even require to disassemble the chips from the smartphone board. In this paper, we propose LiveSD Forensics, an on-device live data acquisition solution, to acquire evidence from both the Random-Access Memory (RAM) and the Electronically Erasable Programmable Read Only Memory (EEPROM) of Windows Mobile Devices. To the best of our knowledge, LiveSD Forensics is the only tool that performs on-device live data acquisition of the RAM and the EEPROM of Windows Mobile Devices. LiveSD Forensics uses a standard SD-Card equipped with tailored code to perform the data acquisition. Compared to other existing tools, LiveSD also generates the smallest memory alteration. Finally, to assess the effectiveness of the proposed methodology, we test LiveSD in a practical scenario, that is retrieving from the RAM the cryptographic key used by a known on-the-fly encryption tool. Results support the quality and effectiveness of our proposal.
Data acquisition; Mobile device forensics; PocketPC forensics; Window CE forensics; Windows Mobile Forensics;
Data acquisition; Mobile device forensics; PocketPC forensics; Window CE forensics; Windows Mobile Forensics;
| selected citations These citations are derived from selected sources. This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | 15 | |
| popularity This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network. | Average | |
| influence This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | Top 10% | |
| impulse This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network. | Top 10% |
