An open framework for smartphone evidence acquisition

Abstract

The forensic processes and procedures for performing a bit-for-bit copy of computer memory and media are well established and documented. However, most commercially-available tools for smartphone data acquisition and analysis have unspecified implementations and do not provide technical documentation about the acquisition process. A detailed understanding of the acquisition process is important in criminal cases because the technique that was used may be questioned in courtroom proceedings. To address the gap, this paper proposes an open framework for documenting and implementing the acquisition and analysis of digital evidence from smartphones. © 2012 IFIP International Federation for Information Processing.