Test Results for Mobile Device Acquisition Tool: Final Data-Final Mobile Forensics 2.1.0.0313

• NCJ Number: 228227
• Date Published: September 2009
• Length: 249 pages
• Grant Number(s): 2003-IJ-R-029
• Agencies: NIJ
• Publication Type: Test/Measurement

Annotation

Test results are presented for the mobile device data acquisition tool by Final Data, Final Mobile Forensics, Version 2.1.0.0313.

Abstract

Except for some select test cases, Final Data - Final Mobile Forensics, version 2.1.0.0313, a mobile device data acquisition tool acquired all supported data objects completely and accurately from the selected mobile devices. The exceptions included: 1) the user was not informed when connectivity was disrupted; 2) address book entries were not reported properly when using the function; 3) when attempting to open a case file that had been modified with a hex editor, examiners were not informed the case file had been modified; and 4) address book entries and text messages containing non-ASCII characters were excluded from the address book entry and text message. The Computer Forensics Tool Testing (CFTT) program, a joint project of the National Institute of Justice (NIJ) and the National Institute of Standards and Technology's, Office of Law Enforcement Standards and Information Technology Laboratory seeks to provide measurable assurance to practitioners, researchers, and other applicable users that the tools used in computer forensics investigations provide accurate results. This document reports the results from testing Final Data's Final Mobile Forensics, version 2.1.0.0313, against the Non-GSM Mobile Device and Associated Media Tool Test Assertions and Test Plan Version 1.1. The tool is run on a Windows XP Service Pack 2 environment. Figures