TABLE OF CONTENTS by Amber Schroader
The field of digital forensics has long been centered on traditional media like hard drives. Being the most common digital storage device in distribution it is easy to see how they had become a primary point of evidence. However, as technology brings digital storage to more and more devices, forensic examiners have needed to prepare for a change in what types of devices hold a digital fingerprint. Cell phones and PDA (Personal Digital Assistant) devices are so common that they have become standard in today s digital examinations. (See Chapters 4 and 9 for more details on PDAs, iPods, and more.)
Digital forensics is the examination of hardware or software in the pursuit of evidence to disprove or prove an allegation.
Handheld forensics is the examination of hardware and software that are typically an integrated unit in the pursuit of evidence to disprove or prove an allegation.
However, as you can see from these definitions, the scope of how they impact forensics is one that is very new and very different. These small devices carry a large burden for the forensic examiner, with different handling rules from scene to lab and with the type of data being as diverse as the suspects they come from.
Handheld devices are rooted in their own operating systems, file systems, file formats, and methods of communication. Dealing with this creates unique problems for examiners. Performing a forensic exam on a cell phone or...
