SEARCH provides a downloadable document at www.search.org/files/pdf/CellphoneInvestToolkit-0508.pdf. "Creating a Cell Phone Investigation Toolkit: Basic Hardware and Software Specifications," written by SEARCH computer crime training specialists Keith Daniels and Lauren Wagner, describe pieces of hardware and software available to law enforcement.
Hardware comes at a range of prices. One of the medium-priced tools, the Cellebrite Universal Forensic Extraction Device (UFED) is indispensable, according to Daniels, because it supports about 95 percent of the cell phones currently on the market. Other law enforcement-specific hardware includes Susteen Secure View for Forensics, which is part of a kit with SecureView software and other equipment; and Paraben's similar Device Seizure ToolBox. Guidance Software's Neutrino integrates with the company's EnCase software so investigators can analyze both mobile and computer evidence.
In addition to the software that comes with the hardware, many investigators round out their arsenal with free or low-cost tools:
BitPim recovers memory from CDMA devices. As open-source software, it's free for use. The lower-priced Oxygen Forensic recovers data from Nokia and Symbian phones. Paraben-owned SIMCon, together with a standard SIM card reader, images all files on a GSM/3G SIM card to a computer file for an extremely low price. It can recover deleted text messages. Quantac Solutions' USIMdetective likewise retrieves data off SIM cards.
The investigator also can take video of the evidence. Daniels recommends Windows MovieMaker software, FireWire or USB cable, and a digital videocamera mounted on a desk tripod. "It's much faster than taking still images of each screen, and you can pause the video to get stills," he explains.
Specialized software exists to make this task easier (though Gilleland doesn't believe it's strictly necessary). For example, Fernico's ZRT (Zippy Reporting Tool, which comes with a Canon A640 10-megapixel camera and a flexible arm with a desk clamp) has a useful reporting tool, which is the product's main feature. Its more expensive ZRTV captures camera video and audio of a crime taking place. "You plug ZRT into the forensic computer and set it to pause every second or two to take screenshots. It's fully automated," Daniels says. Project-a-Phone can accomplish much the same thing.
Some phone manufacturers themselves offer ways to recover data. "When you can't use any of the other tools, go to the manufacturer Web site," Daniels says. "Motorola and BlackBerry make free tools." Gilleland says Motorola PhoneTools, which supports only that company's phones, can recover phonebooks, images and video, though not SMS messages. These kinds of software should be used only as a last resort — they are not forensically sound, and are not commonly used for criminal investigations.
Other useful tools can be found on the Internet. Loving explains that phones are sometimes equipped with third-party GPS software such as TeleNav or AccuTracking. Marketed to businesses for years, he says, this kind of technology is beginning to be targeted toward parents. "It's simple," he says. "It allows a parent not only to track their child utilizing GPS and cell phone technology, but also allows them to be proactive in looking at historical data to see where their child has been, what speeds he or she may have traveled throughout the day, and to set up geo-fences to be alerted when a child exits or enters a certain area." All of these records are based on the company's servers, not on the phone, so investigators can get a court order to obtain them.
Another resource is Web-based translation tools for SMS messages, which can be hard to decipher. TransL8it! converts a text message to plain English (and back again); many investigators have found this useful when interpreting messages for juries. Lingo2Word.com can help translate many acronyms found on the Internet and in SMS messages.