RSS Feed
Page image

Free Stuff

Useful Tools/Resources for Phone Examiners

Example cover sheet for a mobile forensic extraction

Suggested wording for a cover sheet that might accompany a mobile device extraction report

iOS Photo Attribution flowchart

Flowchart for assisting in attributing photos which may have been synchronised via PhotoStream or shared via iCloud Photo Sharing

Android folder paths for microSD and eMMC storage

Help identify whether a folder path on an Android device relates to a removable microSD card or rather the eMMC storage on the device

Devices containing eMMC and eMCP chips

A list of devices containing eMMC and eMCP chips, and which form factor (size) chip they contain (to assist with reading the chip after de-soldering)

Proposed Model for Defining the Role of a Mobile Forensic Examiner

A PDF document intended to accompany the slide presentation “Has Anyone Seen A Career Path Around Here?” first delivered by Kevin Mansell in June 2014.

Handset Re-branding

A guide to identifying handsets which are the same but sold under different make and model names

IMSI and ICCID prefixes

A list of IMSI and ICCID prefixes used by different communication service providers.

Default SIM PINs

A list of default SIM PINs used by different communication service providers.

Default Handset Security Codes

A list of default security codes used by different handset manufacturers.

Searching Hex Dumps – search terms and regular expressions

Handy tips and search expressions for finding SMS, ICCIDs, IMSIs, MMS and more in hex dumps of mobile phone handsets

Android Recovery Mode

A list of the different keypress combinations used to access recovery mode on different Android handset models

Built-in Mobile Phone Web Browsers

A guide to locating web browsing artefacts in extractions of mobile phone handsets

Handset imaging via USB mass storage

List of handsets that present part of their internal memory via USB mass storage, thereby allowing it to be imaged

White Papers


Mobile Phone Video White Paper

Our free white paper on mobile phone video illustrates how developing a better understanding of the underlying file format can really help when you’re trying to recover deleted video from a memory dump. In the paper we use off-the-shelf carving tools to recover 3GP/MP4 video from memory dumps of Samsung handsets and then compare results with a Python carving script written specifically for the purpose. Download the white paper.

White Paper On Handset Imaging

Kevin Mansell collaborated with Royal Military Police’s digital forensics unit in Portsmouth to publish a white paper for the F3 Annual Conference 11-13 November 2008.  Titled  ‘Recovering Deleted Data from FAT Partitions Within Mobile Phone Handsets Using Traditional Imaging’ the paper explores how deleted and unallocated data can quickly and easily be retrieved from the internal memory of certain handsets using easily accessible data cables and computer forensic imaging tools. Download the white paper.

‘The Iceberg Presentation’

In this presentation, Kevin Mansell suggests that the forensic examinations of electronic devices such as mobile phones are akin to icebergs.  Find out more.

Comments are closed.