Evidence-related Research On Mobile Forensics

Mobile forensics has become the focus of attention of forensic personnel due to the rapid popularity of smart phones. At present, mobile forensics is confronted with the contradiction between the information security technology and the demand of evidence collection. What’s more, the analysis technology can’t satisfy the situation of mass data storage. In the forensics process, not only a high technical risk is raised up, evidence issues are also derived from the technical barriers. However, the current domestic and foreign research mainly focus on the technical field of mobile forensics, the research on the relevant evidence issues only stay at the macro level of electronic data, and did not highlight the characteristics of mobile forensics. The innovation of this paper lies in the combination of the characteristics of mobile phone forensics, proposed several long neglected problems of the evidence from the point of view of authenticity, relevance and legitimacy of evidence, and makes theoretical preparation for application of related technologies in the judicial practice through specific discussion.In order to extract more mobile phone data, the most common way is to obtain the highest authority of the system, which is often called as root or jailbreak. However, there is no uniform standard for mobile forensics in China, and different models or systems need different methods, which easily leads to parties’ doubt about authenticity of evidence and “ghost defense”. We think although root will cause changes to the system, the user data hasn’t been changed, which means root itself does not affect the authenticity of user data. However, the mobile phone’s protection will get weakened due to root, which makes the phone more vulnerable to be attacked, so the data should be saved and checked in time to ensure the authenticity of the evidence.Applying data mining technology in electronic forensics is a research direction that a lot of researchers are studying. The diversity of mobile phone data also provides great space for more information related to the case. However, the effectiveness of data mining depends on the probability of association rules, which leads to the association rules with small probability unable to meet the relevance requirement. At the same time, even if the association rules are of high probability, they still can’t make sure that the data has a link to the case. If the data collected in the mobile phone need to be used as evidence in litigation, it’s necessary to meet the logical cause and effect of natural law, and obey the legal conditions, such as the standard of criminal proof to exclude reasonable doubt.With the public’s attention to information security and personal privacy, mobile phone encryption and protection measures are becoming more and more difficult to crack, which brings in great challenge to mobile forensics. In the situation that investigative organs can’t meet the requirement of forensics, it’s an alternative t to seek assistance from third parties. The third party includes not only the forensic institutions, also includes the mobile phone manufacturers. But it will cause a legitimate procedural problem to involve the manufacturers in forensics. As an ordinary civil subject, the manufacturer has the confidentiality obligation of user data and it is not a qualified subject. Acquire data through an inappropriate way which may infringes citizens’ legitimate rights will be excluded as illegal evidence.