NIST tests efficacy of mobile phone data recovery methods

National Institute of Standards and Technology (NIST) researchers are hacking mobile phones to find out which forensic tools are best for data recovery. 

The research forms part of NIST’s Computer Forensics Tool Testing project, which aims to help law enforcement identify the most useful, up-to-date and trustworthy methods for accessing criminals’ computer, mobile phone and GPS data. 

The latest study saw researchers attempt to restore unencrypted data from several popular Android phones’ memory chips, using software such as ‘Cellebrite’s Universal Forensic Extraction Device Physical Analyzer’ and ‘Paraben’s Electronic Evidence Examiner – Device Seizure’, and compare software output to the phones’ original text messages, photos, contacts, and location and social media data, according to NIST. 

So far reports have only been uploaded for two of eight software tools tested, with Cellebrite’s software appearing to be more effective at reforming data than Paraben’s tool overall.

“Many labs have an overwhelming workload, and some of these tools are very expensive,” NIST Computer Forensic Scientist and research leader Rick Ayers said. 

“To be able to look at a report and say, ‘This tool will work better than that one for a particular case’ — that can be a big advantage.”

Devices’ user and location information, call logs, text messages, emails, images, and audio and video recordings can be “vital evidence” in an investigation, and sometimes it has to be obtained through JTAG, chip-off and other hardware or software techniques, NIST said; particularly if the criminal has tried to destroy evidence by smashing, shooting, cooking or submerging the device. 

“Because these methods produce data that might be presented as evidence in court, it’s important to know if they can be trusted,” the Institute said.

Image: NIST researchers extracting mobile phone data via the JTAG method. Image credit: ©R. Press/NIST