Mobile forensics is an increasingly complex environment for investigators because of the rapid rate of innovation and adoption of new technologies, applications, and hardware. Smartphones are being used in so many different ways that they have become a central focus in digital forensic investigations. The mobile platform is a forensic challenge because of the number of third-party applications found on many devices, the rapidly evolving security measures employed by the device manufacturers and application developers, and the explosive growth in the use of mobile devices and options.

Mobile devices include cell phones, tablets, and wearables, with literally several thousand different devices, equipped with countless types of interfaces, operating systems, and connectivity options. This type of environment has many implications for the incident responder. The number of devices makes it impossible to be well-versed in each one, complicating analysis. The sheer number of devices also makes it very expensive to stay abreast of the major players in the market. Users tend to choose mobile devices based on their portability, number of communication interfaces and sensors (e.g., GPS), and easy wireless Internet connectivity. The features that make these devices popular are the same features that make them a critical piece of a digital forensics investigation.

In the steps that comprise this project, you will examine mobile investigative challenges, as well as the techniques and technologies available to perform mobile forensic examinations. First, familiarize yourself with the details of the case and the basics provided by the sheriff. Then, you will need to develop an investigation plan that describes the current state of mobile incident response and investigation. As you proceed through Project 4, you will get hands-on practice using the forensic tool MPE+ by AccessData and complete a forensic report. The next component will be a comparative analysis, in which you will describe the features of companion mobile phone forensic tools and recommend tools and techniques to use in the current investigation. The final component is a comprehensive forensic investigation report that will synthesize the investigation plan, forensic report, and comparative analysis.

Now that you know what’s ahead of you, move on to the first step of the project.

When you submit your project, your work will be evaluated using the competencies listed below. You can use the list below to self-check your work before submission.

• 1.1: Organize document or presentation clearly in a manner that promotes understanding and meets the requirements of the assignment.
• 1.2: Develop coherent paragraphs or points so that each is internally unified and so that each functions as part of the whole document or presentation.
• 1.3: Provide sufficient, correctly cited support that substantiates the writer’s ideas.
• 1.4: Tailor communications to the audience.
• 1.5: Use sentence structure appropriate to the task, message and audience.
• 1.6: Follow conventions of Standard Written English.
• 1.7: Create neat and professional looking documents appropriate for the project or presentation.
• 2.1: Identify and clearly explain the issue, question, or problem under critical consideration.
• 2.2: Locate and access sufficient information to investigate the issue or problem.
• 2.3: Evaluate the information in a logical and organized manner to determine its value and relevance to the problem.
• 2.4: Consider and analyze information in context to the issue or problem.
• 2.5: Develop well-reasoned ideas, conclusions or decisions, checking them against relevant criteria and benchmarks.
• 4.1: Lead and/or participate in a diverse group to accomplish projects and assignments.
• 4.4: Demonstrate diversity and inclusiveness in a team setting.
• 5.1: Demonstrate best practices in organizing a digital forensic investigation
• 5.3: Demonstrate the appropriate use of multiple digital forensic tools and techniques for imaging
• 5.4: Demonstrate an understanding of the different parts of a computer
• 5.5: Apply risk management principles to an investigation.
• 5.6: Use of multiple digital forensic tools and techniques for imaging
• 5.7: Use forensic tools and techniques to carry out an email investigation
• 6.1: Perform report creation, affidavit creation, and preparation to testify
• 6.2: Demonstrate ability to investigate mobile technology
• 6.3: Use forensic tools for investigation of multimedia technologies
• 6.4: Demonstrate the ability to gather file system evidence.
• 6.6: Perform malware analysis
• 6.7: Access encrypted data or process data and systems that have been subjected to anti-forensics techniques
• 6.9: Employ ethics throughout the forensic investigation process.
• 7.5: Evaluate encryption
• 7.7: Incorporate Geographic Information Systems into plans for conducting Digital Forensics on a network.
• 8.1: Employ ethics when planning and conducting forensic investigations, and when testifying in court.
• 8.2: Incorporate international issues including culture and foreign language to plans for investigations.
• 9.1: Examine Data Storage and Transport Technologies
• 9.2: Evaluate Enterprise Architecture
• 9.3: Analyze File Systems
• 9.4: Utilize Hexadecimal and ASCII
• 9.5: Investigate Operating Systems
• 9.6: Evaluate Information Systems/Network Security