Smartphone Forensic Analysis

The provided content is a collection of articles and research papers focused on forensic analysis and investigation techniques for mobile devices. The articles cover topics such as forensic data extraction from Android and Windows phones, volatile memory acquisition, malware forensics, digital evidence gathering, and the challenges faced by computer forensic investigators in obtaining information from mobile devices. Additionally, there are online resources including reports, presentations, and guides that provide insights into mobile device forensics, including the importance of preserving digital evidence and the role of mobile technology in criminal investigations.

Digital Forensics

TABLE OF CONTENTS
INTRODUCTION...........................................................................................................................1
Evaluating current forensic practice............................................................................................1
Potential impact of forensic investigation on the social and commercial environments.............3
Examined the impact of motivation, data manipulation and malware........................................4
Criminal activity associated with chosen case.............................................................................5
Discussing the principles of evidence gathering.........................................................................6
Evaluating current evidence gathering practices and assess their impacts................................10
New legislations and communication technologies to deal new area of crime:........................11
CONCLUSION..............................................................................................................................12
REFERENCES..............................................................................................................................13

LIST OF FIGURES
Figure 1: Social impact of mobile phones.......................................................................................3
Figure 2: Malware and chargeware rates in UK.............................................................................5
Figure 3: Smartphone Forensic Investigation Process Model.........................................................7
LIST OF TABLE
Table 1: Models used for Smartphone investigation.....................................................................10

INTRODUCTION
In digital era, due to several reasons need for mobile forensics are increasing
continuously such as use of smartphones to data storage, online transactions, law enforcement,
and increases use of mobile phone devices for criminal purpose etc. Digital forensic which is the
branch is of forensic science has considered in the context of recovery and investigation of
material found in digital devices in relation to computer crime. As per the present case scenario,
Mobile device forensics topic has been taken to understand the impact of digital forensics on the
social and commercial environments. Furthermore, report also discussed the potential impact of
forensic investigation on individuals and influence of motivation, data manipulation and malware
on environments. At the end, report provides detail about current evidence and assessing their
impact on organizations and customers with help of case study.
Evaluating current forensic practice
Today’s breakneck mobile device market, mobile devices such as cell phones,
BlackBerrys, Androids, iPads are available everywhere. For different purposes such as send texts
and email, photographs, update Facebook, search the web and consult maps etc. users are using
these devices. Besides that, advance mobile device forensics provide facilities of recover deleted
data, detect malware, bypass locks and detect data stored in Third-Party Applications (Fang and
et.al., 2012). However, along with several benefits the process of obtaining mobile device
evidence, associated laws and technologies used in devices itself are the major challenges which
are creating issues for mobile users and forensics experts across the world.
 Evidence: Over the past few years, mobile devices forensics has expanded significantly.
The term digital evidence can be defined in term of information of probative value that is
stored and transmitted in binary form. It is explored as the process of recovering digital
evidence from a mobile device by effective utilization of acceptable methods (Lee and
Hong, 2011). In mobile era, generally information can be retrieved from various sources
such as Internet browsing history, information regarding mobile apps, geo-location
information, map histories and records of access to wireless networks etc. Smartphones
are replacing the needs of personal computers and it becomes a main source of digital
evidence. By using this, individual movements can be traced. All of this information
could be useful in many cases. For example, through accessing the Google map, a
criminal suspect’s mobile device can be traced. It also provides facility of investigate the
1

time of the crime and distance from the scene of the crime (Chun and Park, 2012).
 Operating systems: BlackBerry OS, Nokia’s Symbian OS, HP’s web OS Apple’s iOS,
Google’s Android and many others operating systems are widely‐used throughout the
world by people. Presence of diverse software is creating challenges for developers of
forensic software to deal with such kind of issues. In the context of extracting digital
evidence from smartphones, organizations are offering different types of technologies for
mobile forensics (Rodríguez-Domínguez and et.al., 2013). From a hardware and
software perspective, personal computers may differ from mobile devices so forensic
software tools for mobile devices are considered different.
 Data storage methods: For personal communication, Mobile phones have become a very
important tool and it provides facility of data storage in SIM-cards and internal
memories. By default, data is stored in internal memory of mobile which is also called
RAM (Random Access Memory) and its ROM (Read Only Memory). For the purpose of
temporary data storage, RAM is the memory space used by smartphones. But when
power is off then temporarily store information in RAM is generally lost. Besides that, in
mobile devices, data can also be stored in SIM (Subscriber Identity Module) cards and
memory cards (Chen, Yang and Liu, 2011). For the general purpose of data storage
including photographs, music, videos, and the like, memory card is also used. Despite of
these two methods, mobile users can store information on the various other machines and
devices that may be service providers, personal computers and email servers.
 Purpose of forensic analysis: For the purpose of mobile device examination, different
types of software which include forensic tools as well as non-forensic tools are available.
They are mainly use for device management, testing, and diagnostics purposes (Glisson
and et.al., 2011). In modern smartphones, a long range of evidence items such as images,
sound, email, web browser history, calendar items and contacts are found. Different
methods of physical imaging of mobile phone memory units can be used in order to
recover important evidence such as deleted text messages (Al-Mutawa, Baggili and
Marrington, 2012). In order to forensically analyze mobile devices different types of
techniques such as videotaping, simply manipulating the phone data and backup or
syncing application etc. are also employed. Among these techniques, backup or syncing
application is most suitable in term of preserve and effective use of user created data.
2

Besides that, Holy Grail of mobile device forensic technique can also be applied for
creating full physical copy of the entire memory store data.
Potential impact of forensic investigation on the social and commercial environments
Social impact: Throughout the daily lives of people worldwide, contemporary mobile devices
are used for different purposes. In order to access sensitive data and personally identifiable
information (PII) such as electronic transaction of health records and medical history,
smartphones devices play an important role (Kubi, Saleem and Popov, 2011) Along with several
benefits of mobile devices, a genuine security and privacy threats to mobile device and mobile
apps are also increasing day by day. In such kind of situation, mobile forensic may be beneficial
because it provides facility of crime investigation during retention of data on the device. The
other major impact of mobile forensic on an individual and entire community can be understood
with help of below figure.
Figure 1: Social impact of mobile phones
(Source: Deloitee access economics, 2013)
For example, if data of an individual will use unethical manner then it directly affects their
personality and perception about use of digital evidence. However, loss of confidence and loss of
access are the major negative impact of forensic investigation on an individual in the absence of
better policies. Sometimes, financial loss to customers, security lapse in network and malicious
activities can also create negative image of forensic investigation in the mind of community.
Commercial impact: Positive impact of mobile forensic can be seen in term of financial
implication and build corporate image of enterprises in the canvas of the minds of their
customers and entire community throughout the world. It can also enhance confidence of
3

customers by providing the remedial action in order to harden the present security system
(Aquilina, Casey and Malin, 2008). However, along with this, data protection and management,
privacy issues and legislation related issues are also associated with the use of mobile forensics.
If any organizations or investigators has decided to collect data then they should be consider
legal guidelines related to collect and preserve data, privacy and reliability. Besides that, they
must be emphasized on usage policies and privacy warnings associated with the use of mobile
devices. It is necessary that smartphones evidence should be analyzed in a defensible and reliable
manner (Grispos, Storer and Glisson, 2011). In European countries strict laws such a labour and
data protect act etc. have been framed for the purpose of preventing people to view other private
information in a corporate network and their day to day life. In this appropriate use of particular
forensic tools are required to enhance the validity and reliability of entire investigation process.
Examined the impact of motivation, data manipulation and malware
With the use of mobile devices increases, privacy, data manipulation and motivation
related issues also occurred. Due to large storage capacity and a wide range of applications,
spyware and worm related issues are raised which affects mobile users throughout the world.
Besides that, there is no standard method available for analyzing mobile phone internal memory.
Presently, data is extracted from smartphone by utilizing a cable, infrared or Bluetooth
connection. In this regard, standard command is set for the extraction of certain evidence and it is
vary from manufacturer to manufacturer or even from model to model (Brickell and Li, 2009).
Despite of that, AT-commands, GSM specifications, Cell-Seizure, TULP, Oxygen Phone
Manager and many more types of software packages are available for extracting information
from the phone.
In all these methods, information is extracted through using the operating system of
phones but the main issue of these types of techniques is that deleted information cannot be
extracted. These kinds of software’s are unable to provide facility of imaging and analysis of
internal memory of mobile phone so that data manipulation related task cannot be achieved in a
significant manner. Besides that, many devices that are cheaply manufactured in China and they
have no International Mobile Equipment Identity (IMEI) (Goel, Tyagi and Agarwal, 2012). Due
to absence of this identity, criminals and terrorists who often utilize the Chinese cell phones for
conducting activities because, it is impossible for forensics department to track these mobile
devices in the absence of IMEI number (Lookout, 2015). Figure shows that UK was able to
4

control over malware kind of attacks and it occurrence rate was decreased by 2% in 2014.
Figure 2: Malware and chargeware rates in UK
(Source: Lookout, 2015)
Besides that, different types of malware such as Loozfon and FinFisher etc. are attacking
Android operating systems and steals contact details from the user’s address book. As well as
they are performing financial fraud activity and negatively affects performance of mobile
devices. FinFisher is one kind of spyware and used to remotely controlled and monitored mobile
devices (Gonzalez and Hung, 2011). Other kinds of threats such as viruses, Trojans, worms,
spyware and ransomware are different types of malwares and negatively influence performance
of system and helps criminals to steal information of customers.
Criminal activity associated with chosen case
The main aim behind considering mobile forensic techniques is to store and transmit
personal and corporate information and effective use of mobile smartphones in online
transactions (Aquilina, Casey and Malin, 2008). Other purpose behind adopting forensic
technique is to meet needs of law enforcement and solving criminal cases in a significant manner
(Moshe, 2013). Banaz Mahmod, a 20-year-old Kurdish woman from London in 2006 was killed
by her father and uncle due to her illegal affair. In this criminal case, the use of mobile forensic
analysis was occurred as the turning point. Cellebrite’s UFED Link Analysis technique was used
and it helped investigator to extract and analysis of mobile data of criminals. From the text
message researcher team was able to know about the relationship between the suspect and their
family. This tool was also helped in identifying situation when and where the suspect was at the
time of the crime.
5

Along with this, it is essential for forensic team to follow legal authorities both
international and local records during collection of digital data from electronic devices. For
agencies in their fight against cartels, mobile and other digital evidence are becoming an
increasingly powerful tool. By accessing digital files or programs, investigators can access to a
new source of information (Bennett, 2011). For digital evidence gathering as an investigative
tool, enterprises are required staff, IT-staff / Forensic Analysts and co-operation with other public
agencies.
Discussing the principles of evidence gathering
In digital era, more and more electronic information is being generated, stored and
distributed by mobile phone devices. Forensic department is used digital information as evidence
in many cases. Mainly, information is gathered by the tapping or monitoring of network traffic,
confiscation of the storage media and making of digital copies such as forensic images and file
copies etc. Mobile forensic which is also known as the name of investigative and analytical
techniques can be employed in order to conform that evidentiary standards used in or appropriate
for a court of law (EnCase Forensic, 2013). In many circumstances and jurisdictions including
raids or inspections, searches and compelled discovery, digital information is collected.
Laws governing forensic science
The European anti-fraud office (OLAF) was framed by Association chief police officers
(ACPO) for the purpose of identification, collection and preservation of digital evidence. The
Criminal Procedure Rules (CRPR), The Criminal Procedure and Investigations Act, 1996 and
Contracts, criminal law and the adversarial system related legislation were framed for forensic
service providers to solve criminal cases in more appropriate manner. The United Kingdom’s
Association of Chief Police Officers (ACPOL) had defined the following instruction for forensic
experts while handling of mobile phones are processes that can be enlisted as follow.
Principle of evidence gathering
 Principle 1: Law enforcement agencies should not take any action on storage media
because it may subsequently be relied upon in court (Goel, Tyagi and Agarwal, 2012).
 Principle 2: Person must be competent to access original data held on a storage medium
or mobile phones. At this stage, forensic team experts decides that if any other evidence
is required from the phone before handling such as DNA, fingerprints, drugs and
accelerants etc.
6

 Principle 3: For creating and preserving electronic data, an audit trail or other record of
all processes are required so that third part can easily examine those processes and
achieve the same result in same circumstance (Cartel working group, 2010).
 Principle 4: It is responsibility of investigation officer to ensure that the law and these
principles are adhered to.
Smartphone Forensic Investigation Process Model
In order to overcome the major limitations of the existing digital forensic models, the
Windows mobile device forensic process model was proposed by Goel and their colleagues and
it can be helpful for forensic team in future.
Figure 3: Smartphone Forensic Investigation Process Model
(Source: Goel, Tyagi and Agarwal, 2012)
 Phase 1- Preparation: In this phase, investigator deals with minimizes the risks
7

associated with an investigation and enhance the quality of electronic evidence. Further,
nature of the crime and activities are conducted prior to the occurrence of actual
investigation.
 Phase 2- Securing the Scene: Ensuring systematic and secure custody at the crime spot
and contamination and corruption of evidences are the main concerns of this stage.
Investigators are responsible for the control of scene and ensured safety of all the people
at the scene (John, 2012).
 Phase 3- Documenting the Scene: Adequate documentation is required for the purpose
of maintaining a proper chain of custody. At this stage, all profs including Photographs,
sketches, crime-scene mapping, classification of people (witnesses, victims, suspects and
other assisting personnel) and recreating the crime scene are merged together into a
single documentation.
 Phase 4- PDA Mode: This phase determines devices are active or inactive mode. It is
advisable never to change the state of device while it is working (Gonzalez and Hung,
2011).
 Phase 5- Communication Shielding: It concentrates on to block the further
communication options on the devices and ensures that no overwriting of the existing
information on the devices is done (Goel, Tyagi and Agarwal, 2012). For example, if
mobile devices in off but some communication feature like wireless or Bluetooth may be
enabled and it can affect result.
 Phase 6- Volatile Evidence Collection: Timely collection and management is required in
case of mobile devices because they are in volatile nature. For example, the device is
running out of battery power then information can be loss.
 Phase 7– Non-volatile Evidence Collection: Evidences from mobile and other handheld
devices such as MMC card, memory sticks and secure digital (SD) cards etc. are
extracted at this stage. Electric and non-electric nature evidences are also looked along
with applying hash algorithm to ensure that the integrity and authenticity has been
followed. As well as considering admissibility of evidences as per the court of law
criteria is also considered at this stage (Willassen, 2012).
 Phase 8- Off-set: In order to increase capability of potential search evidence, cloud
computing and other offset storage techniques can be used by companies. These kinds of
8

new technology advancement provides facility of accessing data from anywhere anytime
from any device in an appropriate manner.
 Phase 9- Cell Site Analysis: In the context of identifying a specific position or position
where a mobile phone was or is, this technique can be used. Information can be assessed
on the basis of SMS is either sent or received and call is made from a mobile phone or a
call is received.
 Phase 10- Preservation: At this stage, for sealing the evidences like devices and other
accessories, anti-static packaging envelopes are used. Along with this, before packaging,
identification and their labeling are done (Yates, n.d.). Besides that, proper transportation
and storage procedures are followed as per the guidelines of National Institute of
Standards and Technology.
 Phase 11- Examination: Data filtering, validation, pattern matching and searching
activities are performed in order to critical examination of the evidences collected at
particular place. In this regard, investigators can select text messages, voice messages,
documents and emails evidences before proceeding to examination. For mathematical
authentication of data, hashing techniques like md5 can be employed by forensic experts.
 Phase 12- Analysis: In the context of analyzing hidden data, reconstructing the event
data, analyzing hidden data to arriving at proper conclusions, some activities are to be
performed at this stage. On the basis of the results of the previous examination, analysis
processes are analyzed and properly documented to identify actual outcome (John, 2012).
 Phase 13- Presentation: After completing the whole analysis, findings or outcomes are
presented to variety of audience such as law enforcement officials, technical experts,
legal experts and corporate management etc. to present actual findings.
 Phase 14:- Review: In this stage of the Windows Mobile Forensic Process Model, review
of all the steps during the investigation is done. It may be used for the purpose of further
refining data and to get the total picture of an incident or crime effectively.
Besides that, different models can also be employed for the purpose of mobile phone
forensics that can be described as follow.
9

Table 1: Models used for Smartphone investigation
(Source: Goel, Tyagi and Agarwal, 2012)
Evaluating current evidence gathering practices and assess their impacts
For digital evidence gathering, all agencies use commercially available computer forensic
tools to examine smart phones and cell phones. In this regard, different types of software’s can
be used such as Forensic software write blockers, Bit stream imaging software, Anti-Virus
10

Software, Litigation Support Software, Hash Authentication Software and Backup Software etc.
Besides that, Camera, Cell phone Analysis Tools to read SIM cards, Network Equipment (cables,
card, and hub), Hardware Write Blockers and Search box types of hardware’s may be used for
gathering and analyzing digital information in a significant manner (Deloitee access economics,
2013). Despite of that, in order to solve any serious criminal investigation such as murder, rape,
carjacking, gambling, property crimes and terrorism etc. principles of digital evidence can also
be applied to identify main cause of incidence.
For example, if a criminal was using Google maps and communicating via text message
with accomplices before a crime. In such kind of circumstance, a savvy investigation team can
use an electronic trail of information to get the most valuable data from criminal smartphone.
Agencies can also collect information from internet history, images, emails, text and instant
messages from electronic devices and used them very effectively as evidence (Dezfouli and
et.al., 2012). However, along with this, it is necessary that the authority of the agency follow
national law related legislation to retrieve digital information during the mobile phone evidence
gathering. The ways of handling of privileged and private digital information can also create
challenges for organization and mobile phone users (Lee and Hong, 2011).
Mobile phone evidence gathering technologies: EnCase software applications package can be
used for the purpose of conducting efficient and forensically-sound data collection. This software
is the global standard in digital investigation and powerful as well as court-accepted. Besides
that, LinEn tool can be employed to acquire data from the widest variety of devices and maintain
the integrity in a format that the courts have come to trust (EnCase Forensic, 2013).
New legislations and communication technologies to deal new area of crime:
Mobile devices are communicating through cellular, Wi-Fi and Bluetooth and these
devices divide large geographic areas into smaller areas (Gonzalez and Hung, 2011). Besides
that, currently, enterprises are using different types of techniques such as handheld devices,
Microsoft windows and live forensic (Chun and Park, 2012). Apart from this, different types of
network topologies such as IP addressing, intrusion detection system, network security and
workstation forensics are presently used by forensic team to deal with criminal cases. By
desoldering the memory circuit, imaging of mobile internal memory can be done. The impact of
forensic investigation on individuals and enterprises can be measured in term of identifying
crime victims, rehabilitate criminals and safety of citizens.
11

European Union is emphasizing on developing new legal policy for digital forensic the
purpose of better deal with security related issues. For mobile devices in the US and UK, FTK
Mobile Phone Examiner (MPE) forensic tool is used (Rodríguez-Domínguez and et.al., 2013).
Apart from this, many agencies in Europe are emphasizing on effective use of Oxygen Forensic
Suite tool to extract unique information from a smartphone such as SIM-card data, incoming
calls, contacts list and text notes etc. In addition, rules developed by United Kingdom’s
Association of Chief Police Officers (ACPOL) will be helpful for enterprises while handlings of
mobile phones are processed.
CONCLUSION
With the increase of mobile and handled devices and constantly changes arise in
technology, making forensic a challenge. For imaging and direct analysis of the flash memory,
forensic sound analysis of mobile phone internal memory can be helpful for organizations and
experts. Data extracted methods presented in this report are beneficial for companies in term of
reading data and collect information from mobile phones. It has been observed that forensic
investigation influence by motivation, data manipulation and malware environments related
factors. Further study can be conducted on evaluating requirement of mobile forensic toolkits to
reduce chances of security and privacy for each kind of smartphone in a proper way.
12

REFERENCES
Books and Journals
Al-Mutawa, N., Baggili, I. and Marrington, A., 2012. Forensic analysis of social networking
applications on mobile devices. Digital Investigation. 9. pp.24-33.
Aquilina, J., Casey, E. and Malin, C.H., 2008. Malware Forensics. Investigating and analyzing
malicious code. Burlington Syngress Publishing.
Brickell, E. and Li, J. 2009. Enhanced privacy ID: a remote anonymous attestation scheme for
hardware devices. Intel Technology Journal. 13.pp. 96–111.
Chen, S. W., Yang, C. H. and Liu, C. T., 2011. Design and implementation of live SD acquisition
tool in Android smart phone. Genetic and Evolutionary Computing (ICGEC). pp. 157-
162.
Chun, W. S. and Park, D. W., 2012. A study on the forensic data extraction method for sms,
photo and mobile image of Google android and windows mobile smart phone.
Convergence and Hybrid Information Technology. pp. 654-663.
Dezfouli, F. N. and et.al., 2012. Volatile memory acquisition using backup for forensic
investigation. Cyber Security, Cyber Warfare and Digital Forensic International
Conference. pp. 186-189.
Duranti, L 2009. From digital diplomatics to digital record forensics. Archivaria. 68. pp.39–66.
Fang, J. and et.al., 2012. Forensic analysis of pirated Chinese Shanzhai mobile phones. Advances
in Digital Forensics VIII. pp. 129-142.
Glisson, W. B. and et.al., 2011. Electronic retention: what does your mobile phone reveal about
you?. International Journal of Information Security. 10(6). pp. 337-349.
Goel, A., Tyagi, A. and Agarwal, A., 2012. Smartphone Forensic Investigation Process Model.
International Journal of Computer Science & Security (IJCSS). 6(5).
Grispos, G., Storer, T. and Glisson, W. B., 2011. A comparison of forensic evidence recovery
techniques for a windows mobile smart phone. Digital Investigation. 8(1). pp. 23-36.
Kubi, A. K., Saleem, S. and Popov, O., 2011. Evaluation of some tools for extracting e-evidence
from mobile devices. Application of Information and Communication Technologies
(AICT). pp. 1-6.
13

Lee, J. and Hong, D., 2011. Pervasive forensic analysis based on mobile cloud computing.
Multimedia Information Networking and Security. pp. 572-576.
Mislan, R., 2008. Mobile Device Analysis. Small Scale Digital Device Forensics Journal.pp.75-
80.
Rodríguez-Domínguez, C. and et.al., 2013. Designing a communication platform for ubiquitous
systems: The case study of a mobile forensic workspace. New Trends in Interaction,
Virtual Reality and Modeling. pp. 97-111.
Online
Bennett, W., 2011. The Challenges Facing Computer Forensics Investigators in Obtaining
Information from Mobile Devices for Use in Criminal Investigations. [Online]. Available
Through :< http://articles.forensicfocus.com/2011/08/22/the-challenges-facing-computer-
forensics-investigators-in-obtaining-information-from-mobile-devices-for-use-in-
criminal-investigations/>. [Accessed on: 29th September 2015].
Cartel working group, 2010. Digital evidence gathering. [Pdf]. Available Through :<
http://www.internationalcompetitionnetwork.org/uploads/library/doc627.pdf >. [Accessed
on: 29th September 2015].
Deloitee access economics, 2013. Mobile nation: The economic and social impacts of mobile
technology. [Pdf]. Available Through :< file:///C:/Users/user/Downloads/DAE%20-
%20AMTA%20report%202013.pdf>. [Accessed on: 28th September 2015].
EnCase Forensic, 2013. EnCase Forensic v7.10: The Fastest, Most Comprehensive Forensic
Solution Available. Available Through :<
https://www.guidancesoftware.com/products/Pages/encase-forensic/overview.aspx>.
[Accessed on: 28th September 2015].
Gonzalez, J. and Hung, J., 2011. Mobile Device Forensics: A Brave New World?. [Pdf].
Available Through :< http://www.strozfriedberg.com/files/Publication/224ca0f8-5101-
4e1b-938a-4d4b128ad5ed/Presentation/PublicationAttachment/ef4a28ad-ff7d-4014-aea8-
80505789b86c/Mobile%20Device%20Forensics_%20A%20Brave%20New
%20World.pdf >. [Accessed on: 28th September 2015].
John, J., 2012. Digital forensic and preservation. [Pdf]. Available Through :<
file:///C:/Users/user/Downloads/dpctw12-03.pdf >. [Accessed on: 28th September 2015].
Lookout, 2015. 2014 Mobile Threat Report. [Online]. Available Through :<
14

https://www.lookout.com/resources/reports/mobile-threat-report >. [Accessed on: 28th
September 2015].
Moshe, B. 2013. Solving Cases with Mobile Forensic Analysis. [Online]. Available Through :<
http://www.criminallawandjustice.co.uk/features/Solving-Cases-Mobile-Forensic-
Analysis>. [Accessed on: 28th September 2015].
National Forensic Science Technology Center, 2012. A simplified guide to digital evidence.
[Pdf]. Available Through :<
http://www.crime-scene-investigator.net/SimplifiedGuideDigitalEvidence.pdf>.
[Accessed on: 28th September 2015].
Willassen, Y., 2012. Forensic analysis of mobile phone internal memory. [Pdf]. Available
Through :< http://digitalcorpora.org/corpora/files/Mobile-Memory-Forensics.pdf>.
[Accessed on: 28th September 2015].
Yates, M., n.d. Practical Investigations of Digital Forensics Tools for Mobile Devices. [Pdf].
Available Through :< http://www.famu.edu/cis/p156-yates.pdf>. [Accessed on: 28th
September 2015].
15