Verification of Recovered Digital Evidence on the Amazon Kindle

Abstract

The Amazon Kindle is a popular e-book reader. This popularity will lead criminals to use the Kindle as an accessory to their crime. Very few Kindle publications in the digital forensics domain exist at the time of this writing. Various blogs on the Internet currently provide some of the foundation for Kindle forensics. For this research each fifth generation Kindle was populated with various types of files a typical user may introduce using one method, the USB interface. The Kindle was forensically imaged with AccessData’s Forensic Toolkit Imager before and after each Kindle was populated. Each file was deleted through the USB interface. Files were retrieved and recovered through the USB interface before and after file deletion. These two sets of files were compared to the original set of files. All files retrieved before deletion matched their original counterpart. Not all files recovered after deletion matched their original counterpart. These steps and procedures followed a similar adaptation of the NIST General Test Methodology for Computer Forensic Tools developed by Leshney (2008) for virtual machines