Toward a new tool to extract the Evidence from a Memory Card of Mobile phones

TL;DR

This paper introduces a new unified tool designed to efficiently extract evidence from mobile phone memory cards, addressing current limitations in forensic investigation software and reducing investigation time.

Contribution

The paper presents a novel, user-friendly tool that simplifies and consolidates the process of extracting evidence from mobile phone memory cards in forensic investigations.

Findings

Successfully tested with WhatsApp data from various phones

Reduces investigation time compared to existing methods

Supports multiple mobile phone models and artefacts

Abstract

Today, a mobile phone is not just a phone but it is a computer that you can also use for calling someone. Besides, in criminal investigations the importance of evidence from the mobile phone is increasing as more and more phones are seized at the Digital Forensic Department of the police. Indeed, the amount of memory cards of these mobile phones that need to be investigated separately is also increasing. Possible reasons are that the mobile phone investigation software does not support the specific mobile phone or the specific, for that investigation, artefacts. Sometimes the software investigates just the internal memory of the mobile phone and not the data which is written on the memory card. Fact is also that although the mobile phone was investigated by the dedicated software, the possibility that the associated memory card contains additional important information is evident. The current procedure to get all of the usable information from a memory card of a mobile phone is very time-consuming process and not user friendly. In this paper, we present a new single tool to simplify the investigation of a memory card from a mobile phone. We also test our tool with WhatsApp application installed on the memory card from different mobile phones.