Forensics: A call for evidence

Jan 21, 2011 By Lee Swee Heng
Credit: iStockphoto.com/manley099

Many people today rely heavily on instant messaging services such as AIM, Windows Live Messenger and Google Talk for communications, and an increasing number of users are accessing these online chat services from their mobile phones. For forensic investigators, such conversations may provide valuable evidence, but retrieving the instant messages from mobile phones remains a great challenge.

Vrizlynn Thing and co-workers at the A*STAR Institute for Infocomm Research have now developed an to extract volatile application data such as incoming and outgoing instant messages from mobile phones running on Google’s Android mobile operating system. The forensic system and methodology, in theory, could extend to other mobile operating systems.

Previous experimental groups have used state-of-the-art forensic systems to extract call logs, SMS messages, contacts, emails and images from mobile phones, but attempts to retrieve instant messages have met with no success. The reason for the difficulty is that unlike computers, mobile phones tend to store application data in volatile memory, which is overwritten whenever the user types or sends a new message.

Thing and her co-workers have developed a memory acquisition tool called Memgrab and a memory dump analyzer called MDA for collecting and analyzing volatile information on the Android platform. The Memgrab tool connects to an Android phone and retrieves a bit-by-bit copy of the volatile memory, while the MDA tool decodes and extracts useful information from the retrieved data.

The researchers conducted an experiment to examine the performance of Memgrab and MDA in automatically retrieving and analyzing data during a chat session. They used the Android phone to send 15 messages to a computer and receive 15 messages from the computer in return. They found that, depending on the typing speed and waiting time, the acquisition rate for incoming messages could vary from 75.6% to 100%. However, in all of their tests, their acquisition rate for outgoing messages was consistently 100%.

Based on their statistics, the researchers are confident that their system is capable of capturing close to 100% of in real-life situations. “Digital forensics is a very important area and technology is advancing at an exponential rate. However, without a more sophisticated mobile device forensics tool, potentially important evidence could be lost forever,” says Thing. “To the best of our knowledge, our study represents the first work in the modeling and analysis of dynamic evidence on a .” The researchers are now applying the methodology and porting the system to other mobile operating systems.

Explore further: Watching others play video games is the new spectator sport

More information: Thing, V.L.L., Ng, K.Y. & Chang, E.C. Live memory forensics of mobile phones. Digital Investigation 7, S74–S82 (2010).

Provided by Agency for Science, Technology and Research (A*STAR)

not rated yet
add to favorites email to friend print save as pdf

Related Stories

Microsoft Announces Windows Mobile 6.5

Feb 17, 2009

(PhysOrg.com) -- At the Mobile World Congress 2009 in Barcelona, Microsoft officially revealed the new Windows phones featuring new user-friendly software and services. The next generation of Windows phones ...

Vodafone and Orange join messaging forces

Feb 24, 2006

United Kingdom-based cellular providers Vodafone and Orange will soon provide their customers with instant messaging interoperability. The companies unveiled the move at last week's 3GSM World Congress in Barcelona.

Virus sends costly messages from Android phones

Aug 11, 2010

Mobile security firm Lookout on Tuesday warned that a booby-trapped Movie Player application is infecting Android phones in Russia with a virus that sends costly text messages.

Recommended for you

Watching others play video games is the new spectator sport

9 hours ago

As the UK's largest gaming festival, Insomnia, wrapped up its latest event on August 25, I watched a short piece of BBC Breakfast news reporting from the festival. The reporter and some of the interviewees appeared baff ...

SHORE facial analysis spots emotions on Google Glass

Aug 28, 2014

One of the key concerns about facial recognition software has been over privacy. The very idea of having tracking mechanisms as part of an Internet-connected wearable would be likely to upset many privacy ...

Does your computer know how you're feeling?

Aug 22, 2014

Researchers in Bangladesh have designed a computer program that can accurately recognize users' emotional states as much as 87% of the time, depending on the emotion.

User comments : 0