Forensics: A call for evidence

Jan 21, 2011 By Lee Swee Heng

Many people today rely heavily on instant messaging services such as AIM, Windows Live Messenger and Google Talk for communications, and an increasing number of users are accessing these online chat services from their mobile phones. For forensic investigators, such conversations may provide valuable evidence, but retrieving the instant messages from mobile phones remains a great challenge.

Vrizlynn Thing and co-workers at the A*STAR Institute for Infocomm Research have now developed an to extract volatile application data such as incoming and outgoing instant messages from mobile phones running on Google’s Android mobile operating system. The forensic system and methodology, in theory, could extend to other mobile operating systems.

Previous experimental groups have used state-of-the-art forensic systems to extract call logs, SMS messages, contacts, emails and images from mobile phones, but attempts to retrieve instant messages have met with no success. The reason for the difficulty is that unlike computers, mobile phones tend to store application data in volatile memory, which is overwritten whenever the user types or sends a new message.

Thing and her co-workers have developed a memory acquisition tool called Memgrab and a memory dump analyzer called MDA for collecting and analyzing volatile information on the Android platform. The Memgrab tool connects to an Android phone and retrieves a bit-by-bit copy of the volatile memory, while the MDA tool decodes and extracts useful information from the retrieved data.

The researchers conducted an experiment to examine the performance of Memgrab and MDA in automatically retrieving and analyzing data during a chat session. They used the Android phone to send 15 messages to a computer and receive 15 messages from the computer in return. They found that, depending on the typing speed and waiting time, the acquisition rate for incoming messages could vary from 75.6% to 100%. However, in all of their tests, their acquisition rate for outgoing messages was consistently 100%.

Based on their statistics, the researchers are confident that their system is capable of capturing close to 100% of in real-life situations. “Digital forensics is a very important area and technology is advancing at an exponential rate. However, without a more sophisticated mobile device forensics tool, potentially important evidence could be lost forever,” says Thing. “To the best of our knowledge, our study represents the first work in the modeling and analysis of dynamic evidence on a .” The researchers are now applying the methodology and porting the system to other mobile operating systems.

Explore further: Software provides a clear overview in long documents

More information: Thing, V.L.L., Ng, K.Y. & Chang, E.C. Live memory forensics of mobile phones. Digital Investigation 7, S74–S82 (2010).

Provided by Agency for Science, Technology and Research (A*STAR)

not rated yet
add to favorites email to friend print save as pdf

Related Stories

Microsoft Announces Windows Mobile 6.5

Feb 17, 2009

( -- At the Mobile World Congress 2009 in Barcelona, Microsoft officially revealed the new Windows phones featuring new user-friendly software and services. The next generation of Windows phones ...

Vodafone and Orange join messaging forces

Feb 24, 2006

United Kingdom-based cellular providers Vodafone and Orange will soon provide their customers with instant messaging interoperability. The companies unveiled the move at last week's 3GSM World Congress in Barcelona.

Virus sends costly messages from Android phones

Aug 11, 2010

Mobile security firm Lookout on Tuesday warned that a booby-trapped Movie Player application is infecting Android phones in Russia with a virus that sends costly text messages.

Recommended for you

London mayor expected to say city will rock 5G by 2020

53 minutes ago

London mayor Boris Johnson this week will pledge to bring 5G to London in the next six years, reported The Telegraph on Monday. The pledge is part of a more extensive plan for London's infrastructure between ...

T-Mobile deal helps Rhapsody hit 2M paying subs

3 hours ago

(AP)—Rhapsody International Inc. said Tuesday its partnership with T-Mobile US Inc. has helped boost its number of paying subscribers to more than 2 million, up from 1.7 million in April.

Airbnb woos business travelers

3 hours ago

Airbnb on Monday set out to woo business travelers to its service that lets people turn unused rooms in homes into de facto hotel space.

Google searches hold key to future market crashes

14 hours ago

A team of researchers from Warwick Business School and Boston University have developed a method to automatically identify topics that people search for on Google before subsequent stock market falls.

Lenovo's smart glasses prototype has battery at neck

16 hours ago

China's PC giant Lenovo last week offered a peek at its Google Glass-competing smart glass prototype, further details of which are to be announced in October. Lenovo's glasses prototype is not an extreme ...

User comments : 0