Forensics: A call for evidence

Jan 21, 2011 By Lee Swee Heng

Many people today rely heavily on instant messaging services such as AIM, Windows Live Messenger and Google Talk for communications, and an increasing number of users are accessing these online chat services from their mobile phones. For forensic investigators, such conversations may provide valuable evidence, but retrieving the instant messages from mobile phones remains a great challenge.

Vrizlynn Thing and co-workers at the A*STAR Institute for Infocomm Research have now developed an to extract volatile application data such as incoming and outgoing instant messages from mobile phones running on Google’s Android mobile operating system. The forensic system and methodology, in theory, could extend to other mobile operating systems.

Previous experimental groups have used state-of-the-art forensic systems to extract call logs, SMS messages, contacts, emails and images from mobile phones, but attempts to retrieve instant messages have met with no success. The reason for the difficulty is that unlike computers, mobile phones tend to store application data in volatile memory, which is overwritten whenever the user types or sends a new message.

Thing and her co-workers have developed a memory acquisition tool called Memgrab and a memory dump analyzer called MDA for collecting and analyzing volatile information on the Android platform. The Memgrab tool connects to an Android phone and retrieves a bit-by-bit copy of the volatile memory, while the MDA tool decodes and extracts useful information from the retrieved data.

The researchers conducted an experiment to examine the performance of Memgrab and MDA in automatically retrieving and analyzing data during a chat session. They used the Android phone to send 15 messages to a computer and receive 15 messages from the computer in return. They found that, depending on the typing speed and waiting time, the acquisition rate for incoming messages could vary from 75.6% to 100%. However, in all of their tests, their acquisition rate for outgoing messages was consistently 100%.

Based on their statistics, the researchers are confident that their system is capable of capturing close to 100% of in real-life situations. “Digital forensics is a very important area and technology is advancing at an exponential rate. However, without a more sophisticated mobile device forensics tool, potentially important evidence could be lost forever,” says Thing. “To the best of our knowledge, our study represents the first work in the modeling and analysis of dynamic evidence on a .” The researchers are now applying the methodology and porting the system to other mobile operating systems.

Explore further: Software for schools links classroom technology and strategies to student achievement

More information: Thing, V.L.L., Ng, K.Y. & Chang, E.C. Live memory forensics of mobile phones. Digital Investigation 7, S74–S82 (2010).

Provided by Agency for Science, Technology and Research (A*STAR)

not rated yet
add to favorites email to friend print save as pdf

Related Stories

Microsoft Announces Windows Mobile 6.5

Feb 17, 2009

( -- At the Mobile World Congress 2009 in Barcelona, Microsoft officially revealed the new Windows phones featuring new user-friendly software and services. The next generation of Windows phones ...

Vodafone and Orange join messaging forces

Feb 24, 2006

United Kingdom-based cellular providers Vodafone and Orange will soon provide their customers with instant messaging interoperability. The companies unveiled the move at last week's 3GSM World Congress in Barcelona.

Virus sends costly messages from Android phones

Aug 11, 2010

Mobile security firm Lookout on Tuesday warned that a booby-trapped Movie Player application is infecting Android phones in Russia with a virus that sends costly text messages.

Recommended for you

Twitter working with probe on online threats

1 hour ago

Twitter said Monday it was working with law enforcement officials on unspecified threats, amid reports that the social network had been targeted for blocking accounts linked to the Islamic State.

Google to offer own cellular network plan

1 hour ago

Google will soon be offering cellular network plans in a bid to bridge the gap between the realms of Internet services and mobile device software it dominates.

Should Australia consider thorium nuclear power?

2 hours ago

Australia has developed something of an allergic reaction to any mention of uranium or nuclear energy. Blessed as we are with abundant reserves of coal, oil and gas, we have never had to ask the hard questions ...

Personalized factory workstations

2 hours ago

Tomorrow's factory jobs will be completely different from those of today. Although they will continue to be organized around assembly stations, they will not work in rigid shifts, be subject to inflexible ...

User comments : 0

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.