Dialing Up and Drilling Down: Forensic Preservation of Handheld Devices

Abstract

Cell phones, pagers and other personal digital assistants (PDAs) provide people with the ability to exchange pictures, check email, surf the Web, capture videos, listen to music, or watch movies in the palm of their hand. The future holds even greater promise as these devices may be used as “digital wallets” to pay bills, check account balances, and store other forms of data. In some circumstances, however, a handheld device can become the focus of litigation, investigation, or law enforcement action. At that point, a tool of convenience becomes a source of digital evidence. Digital forensic examiners may be called upon to preserve a wide variety of handheld devices that can produce critical evidence, including email, call logs, pictures, password, videos, user-created documents, and text messages. As PDAs, cell phones, and other handheld devices integrate new technologies for communications and data storage, they will continue to emerge as sources of additional evidence in criminal and civil investigations. Consequently, digital forensic examiners must know how to preserve and acquire data effectively on handheld communication devices. This article provides an overview of preservation issues, solutions for examiners, and tips for successful preservation of hand-held devices.