Theory and practice of flash memory mobile forensics

Authors

Salvatore Fiorillo, Information Security Consultant

Document Type

Conference Proceeding

Publisher

School of Computer and Information Science, Edith Cowan University, Perth, Western Australia

Abstract

This paper is an introduction to flash memory forensics with a special focus on completeness of evidence acquired from mobile phones. Moving through academic papers and industrial documents will be introduced the particular nature of non-volatile memories present in nowadays mobile phones; how they really work and which challenges they pose to forensic investigators. Then will be presented an advanced test in which some brand new flash memories have been used to hide data in man-made bad blocks: the aim is to verify if forensic software tools are able to acquire data from such blocks, and to evaluate the possibility to hide data at analysts’ eyes.

Comments

7th Australian Digital Forensics Conference, Edith Cowan University, Perth Western Australia, December 3rd 2009.

DOI

10.4225/75/57b2893340cd0