Toward a new tool to extract the Evidence from a Memory Card of Mobile phones
This work addresses a domain-specific need for digital forensic investigators by providing a more efficient tool for memory card analysis, though it appears incremental as it builds on existing forensic practices.
The authors tackled the problem of extracting evidence from mobile phone memory cards, which is currently a time-consuming and non-user-friendly process, by developing a new single tool that simplifies the investigation and tested it with WhatsApp data on various phones.
Today, a mobile phone is not just a phone but it is a computer that you can also use for calling someone. Besides, in criminal investigations the importance of evidence from the mobile phone is increasing as more and more phones are seized at the Digital Forensic Department of the police. Indeed, the amount of memory cards of these mobile phones that need to be investigated separately is also increasing. Possible reasons are that the mobile phone investigation software does not support the specific mobile phone or the specific, for that investigation, artefacts. Sometimes the software investigates just the internal memory of the mobile phone and not the data which is written on the memory card. Fact is also that although the mobile phone was investigated by the dedicated software, the possibility that the associated memory card contains additional important information is evident. The current procedure to get all of the usable information from a memory card of a mobile phone is very time-consuming process and not user friendly. In this paper, we present a new single tool to simplify the investigation of a memory card from a mobile phone. We also test our tool with WhatsApp application installed on the memory card from different mobile phones.