Mobile phone forensics requires a level of examiner capability to conduct the examination. The key word 'capability', when analysis is made of what is involved in it, reveals that conducting data acquisition by simply connecting a data reader tool to the target device (mobile phone) today we have significantly moved on from early examination techniques.
The knowledge, skills and experience from my early days telecomms background still serves me well today. When I first started in telecomms type approvals (the procedural path to bringing a telecomms product up to the technical and legal requirements to permit it to connected to the PSTN) the technical standards were important. The technical standards, such as, BS6301 electrical safety, BS6305 network connection, BS6317 apparatus connection and BS6789 apparatus functional features etc provided the grounding to understand what was necessary to succeed. Those standards didn't control how the manufacturer designed to meet each standard's strictures, merely they required to reveal what the product did at the point of, generally speaking, safety, input/output, device specific requirements and functionality and how it met the parameters laid down.
Interestly, designing memory in a device, although seen today as a reference to data storage (ephemeral, tarried or permanent), and thus introduces the notion and prospects of evidence, back then memory was seen as a consumer-friendly feature to create a pyschological attachment between the user and the owned device. Coming from a white goods/brown goods background I had to acquire an understanding/knowledge of not merely the telecomms standards but also the approaches used by manufacturers to meet telecomms standards. Back in 1983 one of the first books I read was Radio Shack "Understanding Telephone Electronics". Electronics, by the way, covered a wide technology design range categorisation including, as a subset of it, computer and computation. Note also that microcomputer was often used in earlier days, to describe manufacturing size and purpose, in comparison today whereas the term 'micro' 'electronic', and 'computer' and used in the term microelectronic computer to describe e.g. a SIM/USIM Card. We also use the term 'smart card' today, as well, but that requires, for discussion at another time, as to what is intended to be communicated by the term 'smart'.
Below are some selected pages discussing ways to create memory storage and access to it from that book which provides, in a nutshell, a useful exemplar how data retention could be created and managed within early electronic telephones. It is worth reading because a mobile phone examiner will see familiar issues that are addressed when considering a methodology for acquiring data from (mobile) devices.
No comments:
Post a Comment