Digital handheld devices, such as Personal Digital Assistants (PDA) are becoming more affordable and common in the workplace. They provide data storage in addition to computational and networking capabilities for managing appointments and contact information, reviewing documents, communicating via electronic mail and performing other similar tasks. As digital technology evolves day by day, the capability of these devices also continues to improve rapidly. When handheld devices are involved in a crime or other incident, forensic examiners require tools that allow the proper retrieval and speedy examination of information present on the device. For gathering the whole information of the evidences the forensic utilities plays significant role and proves to be very helpful during the investigation process.
Phases of Digital Forensics Tool:
There are three major phases of investigating the mobile phones, elaborated as follows:
The Acquisition Phase – Acquire Evidence (Data)
In acquisition phase the data of the mobile phone is acquired. Using forensic tools, the data can be easily extracted and managed. In this phase, the examiner includes the evidence and information collected from the extraction of mobile phone information.
Various cell phone forensics tools are available capable of fetching complete information of all Pocket PC, PDA, Smart Phones, Hand held PC Device, Palm Device, Palm OS Platform Cell Phone Device including:
The Analysis Phase – Analyze the Evidence
The analysis phase takes the acquired data and examines it to identify pieces of evidence. The data extracted from the mobile phones in acquisition phase will be analyzed in the analysis phase and detailed report will be generated. The actual report analysis will be displayed in a human-friendly-format that can be easily used as evidence by the detectives or investigating officers. The analysis of the data will produce walking directory structures, extracting unallocated files and other related information of the mobile phones. The investigator will interact with the analysis phase in detail and direct it to analyze and produce information about the hardware and software architecture of the mobile phones or PDA.
The Presentation Phase – Conclude the Investigation
This phase presents the conclusions and corresponding evidence taken from the acquisition and analysis phase of investigation. Mobile Forensic software easily performs in-depth analysis and extracts detailed information of the Windows based Pocket PC or PDA mobile phone device. A detailed report will be prepared on the basis of fetched information of mobile phones and can be easily saved in specific file format at user specified location on the disk so that it can be made available easily when required in future for verification purposes in the crime investigation.
After going through the above phases of digital forensic tool, the mobile phone's detailed data can be easily extracted, collected and presented as evidence in front of investigation officers.
Forensic and investigating utility support all major brands of Windows based Pocket PC or PDA mobile phones like:
Data Doctor provides following Forensic Tool to fetch the complete information of Pocket PC mobile phone along with date and timing details: