Like all digital evidence, the data on cell phones must be protected from being changed or destroyed during the examination process that can occur if the cell phone is allowed to connect to a cellular network. To do this, a cell phone must be isolated from all networks to prevent the phone from sending or receiving. This is usually handled by using a Faraday bag to block radio signals to or from the phone. Figure 37.2 shows a phone inside a Faraday bag for isolation during an exam.

A Faraday bag blocks any signals that a cell phone might pick up by blocking electrical fields and radio frequencies. A microwave uses this same technology, utilizing a Faraday cage to contain the radio frequency generated by the magnetron within the cooking chamber. A cell phone can also be isolated from any networks by wrapping the phone in radio frequency shielding cloth and placing the phone into Airplane mode. These are the most common methods of isolating a cell phone from any networks it might connect to. There are others, but whatever methods are used to block the cell phone’s signal, they need to comply with best forensic practices and be recognized as a viable solution by the digital forensics community.

Logical acquisitions of cell phones are performed using cell phone forensic software. A logical acquisition typically only recovers data on a cell phone that is not deleted. Depending on the phone and the forensic tools used, some or all of the data might be able to be acquired. For instance, where only some of the data can be acquired, this means that the text messages, contact list, and call history might be acquirable using the cell phone forensics tools, but the images and ringtones are not. Even if only existing data can be captured from a cell phone, there are good reasons for performing a logical acquisition instead of simply taking pictures of the information on the phone from the device itself. When a logical acquisition is performed, the data can be preserved in stasis and the phone returned to the custodian to which it belongs. You would then have a snapshot in time of the cell phone evidence as it existed when the acquisition was performed, which preserves that evidence and also allows for verification. Some cell phone forensic tools allow multiple phones to be added to one case, which allows the data from multiple phones to be compared using graphs and diagrams. Examples of this are included later in this chapter. If a logical acquisition is not performed, then the possibility of performing these analysis functions is off the table.

Although it is uncommon, it is possible to get deleted data when performing a logical acquisition. This only applies to phones where the unallocated space on the phone can be acquired as if it were a logical file. This allows an examiner to carve out information from the unallocated space that might be of interest in a case.

Physical acquisitions of cell phones are also performed using cell phone forensic software. A physical acquisition of a cell phone is the acquisition of the data at the hardware level. In other words, a physical acquisition is able to acquire all of the data present on a device, regardless of the file system, operating system, or other factors that act as limitations when performing a logical acquisition. If a physical acquisition is possible, this is almost always the best option when acquiring cell phone evidence. Physical acquisitions are able, in almost every situation, to get all the types of data from a cell phone, and also the unallocated space. An examiner can then carve out deleted information from the unallocated space. An example of this is shown in Fig. 37.3. For more information on unallocated space and deleted data carving, see Chapter 29.

With cell phones, a physical acquisition is usually the best option, and logical acquisitions are the second best option. Manual examinations should be the last option when performing a forensic acquisition of a cell phone. A manual examination introduces a greater degree of risk than the previous acquisition methods in the form of human error. With physical and logical acquisitions, the manipulation of the actual cell phone from the keypad and menu on the device is minimal. With a manual acquisition, the entire process must be performed using the keypad and menu to navigate through the cell phone.

When you get a new cell phone, it can be difficult to operate at first since there is a learning curve associated with getting familiar with the keypad, menu, and other ways to manipulate the controls of the phone. The chance of you accidentally creating evidence, such as accidentally hitting a speed dial button and creating a call attempt, is greater. The chance of deleting evidence is also greater; for example, you might accidentally delete a text message instead of just viewing the next one as you intended.

A correctly performed manual examination will reduce the risks of modifying the original evidence. With correct procedures and thorough documentation, a manual examination is a viable option when acquiring cell phone evidence. The quality of a manual cell phone examination really depends on the competency of the examiner; if correct procedures and thorough documentation are not part of the manual examination, it can call into question whether or not the evidence was actually preserved, or if any tampering, intended or otherwise, occurred during the examination of the cell phone.

A manual examination of a cell phone typically involves an examiner manipulating the cell phone to the different areas of information, such as text messages or call history, and taking pictures of the screen with a camera. While this is viewed as acceptable by some members of the digital forensics community, to others this is not enough.

Pictures only tell part of the story; what could have happened during the time between the individual pictures being taken? Pictures alone do not provide any real verification that the phone evidence has not been modified or tampered with. The only way to make a truly verifiable manual examination of a cell phone is to also record the process using a digital video camera running continuously throughout the process with no breaks, pauses, or edits. The video should begin before the phone is taken out of the secure evidence container and should be powered on in view of the camera. At the end of the examination, the phone should be powered down in view of the camera and placed back into a secure evidence container.

Many cell phones today have expansion slots in them designed to accommodate a Secure Digital card (SD Card) as shown in Fig. 37.5. Usually they accommodate a small version of a SD card, called a microSD card. Users would purchase one of these cards and place it in their phones if they wanted to be able to store additional data. SD cards can be examined as if they were a tiny hard drive. They need to be write-protected just like a hard drive during the acquisition process for evidence preservation. If an SD card is present, it is possible to recover any form of deleted data that might have been saved to the SD card. Media cards are formatted and act just like computer hard drives when storing data. The presence of a media card almost guarantees that some level of deleted data recovery is possible. Figure 37.5 shows some of the different types of storage cards available.