Expert Tips for Digital Forensic Investigations of Mobile Devices

In the fifteen years since smartphones became truly popular, law enforcement agencies have faced a growing wave of digital evidence. They are still concerned with cybercrime, white collar crime, and digital fraud, but today smartphones and other digital devices often contain evidence relating to almost every routine criminal case. Mobile data is an integral part of nearly every criminal investigation, yet the increasing volume and variety of data across numerous apps can make it challenging to quickly uncover critical information. 

The contributions digital forensic investigators and analysts make to the criminal justice process have gone from occasional participation in high-profile cases to a routine element of almost every investigation. Unfortunately, this rapid increase in demand for digital forensic investigations hasn’t made the radically simpler. It still takes time and skilled analysis to reach accurate conclusions that will stand up in a court of law. Focusing on the user rather than the app is essential to streamline the process.

One area in particular where investigators can benefit from new advances in technology is in investigations of mobile devices. Here are some tips that can help digital forensic investigators resolve cases more efficiently than ever.

Focus on the individual.

Make sure you're investigating data based on the individual user, rather than by apps. App-based investigations require the investigator to stitch together the data into a holistic narrative. Combining the interactions from a variety of chat and messaging applications into a single user profile provides a more coherent picture of what's happening in a given case.

Use timelines to build a narrative.

Timelines can help identify unusual patterns such as sudden communication gaps and reconstruct the "story" of events around a specific point in time that is a focus of the investigation. Users switch between applications frequently, and it's important to understand the sequence of events. For example, are they taking a picture, sending it to another individual, then having a phone conversation.

Build a comprehensive report.

Comprehensive reports help convey the full scope of the investigation and support decision-making. Make sure your reports capture the entire communication flow and user activity, so a jury or other parties understand what's happening in the case. Leverage timelines, usage activity, and other significant user interactions to build a compelling story.

For more tips and tricks, download Exterro's latest checklist, Investigating Mobile Devices with a User-First Approach.