Forensic Analysis of Broken and Damaged Mobile Phone - A Crime Case Study

Abstract

Forensic laboratories are frequently subjected to mobile devices that are assailed by shock or forced damage which might be the result of intentional efforts to destroy proof from the devices or accidental exposure. Chip-off technique is an effective method for data retrieval from such kind of exhibits. However, nowadays all mobiles phones are securely encrypted with full disk encryption (FDE) or file-based encryption (FBE) which makes chip-off forensics an improbable process to successfully retrieve data. In many of these cases, the encryption is on the hardware and hence, the device could be successfully decrypted by bringing it in its original condition. Thus, the original user data can be obtained for investigative purposes. This process can be enabled by replacement of electronic parts of the original device which contains user data and decryption keys i.e. PCB to the new host. This research paper covers a case study of a mobile phone obtained in broken and shattered condition whose diagnosis of PCB and subsequent actions led to data recovery.