Police expert admits mobile phone forensics barrier

A police digital forensics expert has admitted that some mobile phones are impenetrable to software used by police in forensic examinations.

The revelation follows a paper by a Cambridge researcher, which originally made the claim. “There are some phones that are not supported by any tools,” said Kevin Mansell, a hi-tech crime trainer for Centrex.

Mr Mansell told the on-line news site OUT-LAW, covering the latest legal stories in IT and e-commerce: “But it`s important to remember that data on phones can always be retrieved manually, just as you would navigate through your own phone.

“Some tools work with 200 phones, but when you think that a phone that comes in for examination could come from any manufacturer and be from the last 10 to 15 years, you see that 200 is only a fraction of the total.

“Volume is an issue, but one that can be dealt with by resourcing and hopefully with new and better forensic tools. There does not, though, appear to be an easy solution to retrieving deleted data on a phone for which there is no examination software,” added Mr Mansell.

The claim that some models of mobile phone are impenetrable to police forensic searches comes from a Cambridge University researcher. Tyler Moore, a PhD student in computer security, analysed the way that police forces conduct digital forensics. He found that a lack of phone operating system standards means that forces do not always have the right tool to penetrate a phone.

“Uncommon phone types are often inaccessible with standard software products,” he told OUT-LAW.

“This is an undesirable outcome for law enforcement, and it is a direct consequence of mobile phone manufacturers` choosing to store data in proprietary formats rather than standard ones,” he said.

Mr Moore examined the differences between forensics for computers and for mobile phones and claims that because mobile phone manufacturers write their own operating systems, it has serious implications for policing.

“The cost of extracting data on mobile phones is higher, since software has to be individually developed for each manufacturer and tailored to individual models.”

David Compton, technical lead for eForensics in the Forensic Science Service (FSS), said: “The complexity of recovering deleted data requires us to employ a suite of data extraction methods. The combined power of these methods, along with the expertise of our analysts can often provide the solution.”