Abstract
PDAs (Personal Digital Assistants) are among the digital hand-held devices that are increasingly being adopted by criminals to conduct their activities. The increasing utilization of PDAs in criminal incidents has brought about the necessity of the forensic examiners to come up with counter-intelligence tools that enable precise retrieval along with speedy examination of information that are found in the PDA devices (Jansen, 2009). In this respect, therefore, the computer industry is devising more sophisticated forensic image tools to help retrieve information from suspected PDAs used by criminals. However, there is concern whether the tools used by law enforcement can be able to keep with the ever increasing new advances in the PDA technology going forth. This paper seeks to discuss the latest PDA devices currently available on the market, the comparative capabilities to those of regular desktop computers, computer forensic tools used by criminal and justice department to retrieve forensic images from PDAs, and whether these tools will be able to keep up with new advances in the PDA technology. In other words, this is an analysis of the present forensic software, purposed for acquisition, analysis, reporting of information extracted on PDAs, and a look at their capabilities as well their limitations with the advancing technology.
Introduction
Computer forensics deals with the preservation, identification, retrieval, documentation, as well as analysis of computer data. As such, computer forensic examiners have well-established methodologies and procedures that are employed in particular situations in the course of countering criminal activities (Limaye, 2009). The most common methodologies often involve the following steps:
Preparation of a forensic copy pertaining to the digital device in question whilst taking care not to compromise the integrity of the media,
Examination of forensic copy so as to retrieve information
Analysis of the retrieved retrieved data and develop a report on the incriminating data that has been uncovered.
Nonetheless, the rapid evolution of the handheld digital devices have necessitated the need for forensic tools to modernize their lockstep fashion when dealing with criminals. Basically, the forensic toolkits serve to foster the work of law enforcement offices by enabling them to conduct the above-outlined steps in both a timely and structuree way, besides improving the quality of the final outcomes. This basic design is also followed by most PDAs and give comparable capabilities.
Personal Digital Assistants (PDAs)
A Personal Digital Assistant (PDA) is a handheld device which incorporates computing, internet, network and telephone/fax functionalities. As such, a typical PDA can serve as a cellular phone, Web browser, fax sender as well as a personal organizer. In addition, the PDA devices have handwriting recognition features because they largely use stylus instead of a keyboard for input common with most portable computers. Similarly, there are PDA devices with the capability to respond to voice input thanks to the voice recognition technologies that have been incorporated in them. PDAs are also known as palmtops, pocket computers and hand-held computers (Solomon et al, 2011).
PDAs currently in the market
There are three most popular families of PDA families that are presently available and in use. Though the principle by which they operate on are essentially similar, the several types of PDAs currently available on the market often differ in such aspects as interaction style, hardware components as well as Operating Systems. Microsoft Pocket PC and Palm OS are the two most dominant operating systems on which major PDA families operate on. Android and IOS are also common operating systems preinstalled on PDAs.
PDAs and regular desktop computers
There are a number of significant ways in which PDAs differ with personal computers (PCs). For instance, unlike the personal computers the PDAs are compact in terms of size and powered by batteries besides having the capability to store user data in a delicate memory and not a hard disk. Furthermore, the PDAs can hibernate and suspend processes when they are switched off so as to avoid the time-consuming process of rebooting when powered on again. This means that the PDAs are well-designed for mobility unlike the PCs (Jansen, 2009). In this sense, therefore, it is clear that the PDAs need specialized forensic tools and procedures that are greatly distinct from those applied on single PC systems and their network servers. Law enforcement officers engaged in forensic examination of PDAs therefore need to have a basic understanding of the particular characteristics of the varied types of PDAs they work on.
The work of the law enforcement forensic examiners is aided by the fact that majority of the PDA types have comparable capabilities and features. These include a microprocessor, random access memory (RAM), flash read only memory (ROM), a touch sensitive liquid crystal display, and a variety of hardware keys and interfaces. The most recent high-end PDAs are supplied with fast processors together with considerable memory capacity which affords the user performance that is comparable to a desktop machine. In addition, some PDAs have combined capabilities of other devices like cellular phones, cameras, and global positionining systems (GPS) to give new types of hybrid devices.
Current Computer Forensics used to access PDA
PDA Seizure
This is a forensic software toolkit that enables forensic examinere to get hold of and examine content on PDAs for both POS and PPC platforms. It has the ability to give a forensic imge of Pocket and Palm PC devices, do examiner-defined searches on information contained in acquired PDA, then produce a report of the results (Limaye, 2009).
EnCase
A forensics software toolkit which allows acquisition of suspect device, search and analytical tools, together with data capture and documentation essentials. It enables creation of a full physical bit-stream image of a source device, called an EnCase evidence file. It thus enables the investigator to examine the information on the PDA device without compromising the integrity of the original data itself.
CellDek
Fight against crime has been revolutionalized by the adoption of CellDel computer forensic tool by law enforcement officers. This is because the CellDek is compatible with over 1800 phones, PDA’s, as well as satelite navigation devices. It allows investigators to identify devices by their brands, model numbers, dimensions together with photographs. The CellDek thus does automatic forensic extraction of such data as Dialed and received calls, serial numbers (IMSI, IMEI), handset time and date, SMS on both handset and SIM), MMS messages, deleted SIM messages, calendar, video and audio, to do lists, pictures, memos (Solomon et al, 2011). The selection of the device type enables a smart adapter featuter to indicate the appropriate USB adapter from the up to 40 adapters built-in the system’s rack. Furthermore, the CellDek has a Network Isolation Card (NIC) that allows for isolation of the suspect handset from the cellular network (Solomon et al, 2011).
Likewise, there is the improved CellDek TEK that is compatible with a large number of PDAs and cellular phines, including Blackberry devices and commercial GPS navigation devices. It is a light-weight PDA forensics device best suited for to be used both in the lab and at crime scene. Furthermore, it works in tandem with the user’s own desktop PC or laptop. Besides PDA devices, the CellDek TEK software is able to retrieve data from CDMA, TDMA, GSM, and Iden cell phones.
FINALMobileTM 2.3
FinalMobile ForensicsTM 2.3 affords law enforcers to efficiently conduct critical tasks during the investigation of cellular phones. This makes good of the capabilities of both Final Acquisition (an industry leading acquisition software) and Final Analysis (software with ability tio quicly report plus analyze acquired data). FINALMobile ForensicsTM 2.3 has acquired data on PDAs such as call logs, internet connection logs, flagged deleted items, lock codes, images, memos, phonebooks, MMS, SMS, video clips, system files, amd voice files. It is famed as the optimal solution as relates to acquisition as well as analysis of mobile device data (Maras, 2011).
TAP Systems
TAP Systems is mainly a hardware application that enables forensic examiners to use eForensics tools in a fast and quick way in the copying of data including deleted and hidden, or encripted files on PDAs. The TAP Systems are both accurate and evidentially sound besides being faster that most typical software solutions. The TAP Systems come in handy especially where there is need for a copy of the suspect volatile PDA memory or when the computer forensic expert has little tile to get hold of the required data. Some of the most popular TAP Systems used by law enforcement officers to access data on PDAs include:
forensics dossier – a recent hard drive eForensic imager platform that quickly processes multiple suspect drives and entails concurrent MDS & SHA256 hash verify besides ensuring evidence capture
Forensics Talon-E – a portable hard drive & SSD forensic imaging platform which offers imaging platform providing evidential capture, storage, analysis, preview and network in one package.
Forensic Quest – a handheld data capturing hard drive eForensic imaging solution.
Use of the tools in the future
The PDA technology is changing by the day and becoming more sophisticated for the current PDA forensic toolkits used by the criminal and justice department. There is genuine fear that the tools currently in use will not be best placed to deal with the PDA technology is fast evolving. The current state of affairs is such that there are already limited number as well as variety of toolkits designed for PDAs and many other handheld devices (Jansen, 2009). In this sense, there are connsiderable fewer specialized tools and toolkits besides the fact there is typically a narrow range of devices on which the tools and toolkits operate on i.e. only the most common familites of PDA devices (the Pocket PC and Palm OS). In addition, the tools and toolkits are insufficient in the sense that they require the investigator to have full access to the device meaning that the device is not protected by a defined aunthentification mechanism (Maras, 2011).
Likewise, the tools used on PDA continue to face the limitation of capabilities as majority of them are devised to deal with a single function either acquisition, examination, or reporting functionalities. Therefore, there would have to be an improvement in the technology of the computer forensic tools and toolkits so as to be in line or even beat the PDA technology and in so doing curb technology-assisted crime.
References:
Jansen, Wayne. (2009). Guidelines on Cell Phone and PDA Security: Recommendations of the National Institute of Standards and Technology. Pennyslavania, DIANE Publishing.
Limaye. (2009). Software Testing. Tata New Delhi, McGraw-Hill Education.
Maras, Marie-Helen. (2011). Computer Forensics: Cybercriminals, Laws, and Evidence. Massachusetts, Jones & Bartlett Publishers.
Solomon, G. Michael, Rudolph, K., Tittel, Ed, Broom, Neil, & Barrett, Diane. (2011). Computer Forensics JumpStart. New Jersey, John Wiley & Sons.
