An investigation on forensic opportunities to recover evidential data from mobile phones and personal computers

This paper is a summary of experiments conducted to explore forensic opportunities available to the Law Enforcement Agency in the recovery of artefacts resulting from criminal use of popularly chosen applications. The experiments were conducted using forensic examination tools and techniques on a mobile phone running an Android operating system (OS) and another using Apple’s OS, as well as a computer running Windows 10 OS. These examinations involved the forensic acquisition and analysis of artefacts resulting from simulated criminal use of common messaging applications, running on both mobile smart phones and personal computers. Many of the complexities and factors effecting successful forensic data acquisition, such as encryption and ephemeral burn functions were also explored together with data analysis.