mobile forensics
sarada avadhanam

Mobile Forensics..A New Challenge
The increasing use of Mobile phones by the population as a personal means of communication has made Mobile Phones an important piece of evidence in many legal cases. In the coming days, Mobiles will be used for e-commerce and the relevance of Mobile Evidence will assume greater importance. Since Mobile phone is an electronic device there are several aspects of ITA-2000 that apply to the Mobile phone transactions.
1. These are early days of using of Mobile evidence and there is a very high possibility that an imperfect understanding of the technology by the Police, the Lawyers and the Judges may lead to wrong judicial decisions.
2. In view of the importance of the Mobile devices as Cyber Evidence we shall discuss some key elements of Mobile evidence for academic understanding and debate.

3. The important aspects for which Mobile evidence is being presently used are
3.1. To find out the numbers to which calls have been made from a given mobile with date and time
3.2. To find out the numbers from which the calls have been received in a given mobile with date and time
3.3. To know the contacts through the Phone book.
3.4. To know the details of recent SMS messages received
3.5. To know the details of SMS templates
3.6. To know the Ring tones and Games stored in the instrument
3.7. To know the Pictures and video clips stored in the mobile either on the SIM card or a flash memory card.
3.8. Of these, a) and b) are also available at the service provider's level. Also while the number of entries available on the instrument may be limited by the memory, the service provider has a more detailed and reliable data with timing for the purpose of billing.
3.9. What the service provider's data may provide is however the information as recorded at their system based on the SIM card recognized by the system.
3.10. If the data at the service provider's systems match the data of recently called and received numbers as found on the instrument, it could mean that the SIM card presently on the instrument has data matching with what is available at the service provider's level.
3.11. If the two data does not match it means that the SIM card data has been manipulated.
3.12. Manipulating SIM card data on the instrument is a very easy process and hence the data on the SIM card can only be taken as only an indicating evidence and has to be properly certified to be of any use in a court of law.
3.13. If the data on the SIM card is extracted from the Mobile after the mobile has been in the custody of the Police for some time, it is possible for the defense to take a stand that the data has been manipulated.
3.14. On the other hand the data at the service provider's level cannot be manipulated except with the connivance of the service provider or hacking into their system. Again here the data as found visible on the computers of the service provider can be taken as prima-facie evidence but if it has to be relied upon, there has to be a corroborative certification that the data is apparently not altered.
3.15. Since mobile conversations are not presently recorded by the service provider and they are not normally available for any evidence.
3.16. If the conversation is hacked and recorded, then it will be a case of illegal tapping and the quality of the evidence needs to be evaluated by other parameters including a voice recognition.
3.17. The phone book details only provides information about the persons whom the mobile owner has been in contact and nothing more.
3.18. A few of the incoming SMS messages are normally stored on the mobile and along with time data corroborated with the service provider's information, may be evidence of an incoming message. Templates may indicate the likely outgoing information and if it contains any spam or obscene message, may indicate the intention of the mobile user and nothing more.
3.19. Ring tones and Games may be relevant from the point of view of copyright violations.
3.20. Details of pictures and video clippings on an accompanying memory card indicates the intentions of the mobile user and if they can be matched with any outgoing data packets, may be used as evidence for the likely outgoing message. These can be of use in case of any obscene pictures being transmitted from the mobile.
3.21. However linking the stored data to a sent message requires certain Forensic testing and it is doubtful if such capabilities exist with the Indian Police as of date.


4. Identification of Mobile
4.1. Essentially there are two identification aspects of a mobile device. Firstly the SIM card identity which allows the transactions of a mobile to be recorded in the service provider's records.
4.2. The second is the IMEI (International Mobile Equipment Identifier) which is associated with the hardware.
4.3. Some service providers monitor IMEI numbers with call data. In such cases if a mobile is stolen and a new SIM card is being used, it would be possible to run IMEI filters to block the stolen numbers.


5. Spoofing:
5.1. It must be remembered that spoofing of SMS messages as well as voice messages is not impossible on a mobile.
5.2. Firstly it is possible to send SMS messages from a computing device with a false "Sender's Mobile Number".
5.3. Secondly, it is possible to pick a hand set and alter the SIM card data to make it look like a different SIM card and use it for sending offending messages or making calls which can be attributed to the original owner of the SIM Card.
5.4. For example a card belonging to Mr Fraud can be altered to match the SIM card of Mr Innocent and used for making calls to Targets 1 and 2 . Then if this SIM card is presented as evidence with or without the hand set of Mr Innocent, it is possible to create an evidence which appears as if Mr Innocent has made calls to Mr Targets 1 and 2.
5.5. Acceptance of SIM card data as evidence is therefore required to be accompanied by several collaborative Forensic certifications that eliminate the possibilities of such manipulation.
5.6. Even though the IMEI number is considered a good identification of the hardware, it is said that in India the existence of sets with duplicate IMEI numbers is wide spread and hence the service providers have been reluctant to use IMEI blocking as a solution to immobilize stolen mobiles.
5.7. [P.S: In CDMA phones the identification is through what is called ESN-(Electronic Security Number) numbers.]
5.8. Further both IMEI numbers and ESN numbers can be modified with the use of right equipments and such practices are being regularly practiced by those who deal in stolen mobiles.
5.9. It must therefore be considered possible to clone a mobile if the person so charged is shown to have sufficient resources and access to technology.
6. Future of Mobile Evidence
6.1. The first impact of the recognition that Mobile Evidence can be modified, will be felt by the law enforcement authorities since evidence gathered by them in many cases will be questioned in the courts of law.
6.2. Just when the judiciary in India is grappling with understanding the evidentiary aspects of Computer records, the focus being generated on the Mobile Evidence will be a further challenge to the Indian judiciary.
6.3. The undersigned is in the process of developing a Check list and Guidance Note to suggest the preferred procedure for Mobile Evidence Seizure, Preservation and Presentation as part of its activity to contribute to the "Mobile Forensics".