Every message, photo, contact, and file on a mobile device is like a puzzle piece. When put together, this puzzle holds very valuable information about an individual’s life and their interactions. Unfortunately, sometimes when we’re putting the puzzle together, we find that there are pieces missing.
Data forensics is the process of extracting, recording, and analyzing data from an electronic device. Every mobile device has a hard drive, memory, and communication device. Each one of these can be extracted from the device, even if some data is presumed to be deleted. When you delete a file on a mobile device, it doesn’t actually disappear completely. When a file is deleted, the connection between the file and the device index is removed so it can no longer be seen.
Extracting deleted data from mobile phones is initiated by a USB connection typically to proprietary software. This software is used to extract the physical data from the mobile device and in some cases, data that are stored on the cloud or other external network. Mobile devices are a combination of a computer and a radio. The radio part of the device is constantly connecting with similar nearby devices like Bluetooth, wifi, cellular networks, etc. Every time a mobile device hits a connection point with one of these nearby devices, it creates a record connected to that device. For example, if an individual was near a device called “Jessica’s Speaker”, the mobile device will create a record that it was at one point located nearby “Jessica’s Speaker”. Additionally, mobile devices connect and store data from nearby vehicle devices such as GPS, entertainment, etc.
Data forensics can uncover significant data. Using data forensics, your investigator can locate viable data such as text messages, call logs, photos, location history, contacts, and much more. Data forensics is designed to help put together the missing puzzle pieces. If the pieces aren’t fitting properly, data forensics may help shed light on the location of those missing puzzle pieces.
