Output details

An empirical comparison of data recovered from mobile forensic toolkits

<29>Innovation: Presents the first empirical comparison of results gathered by commercial forensic toolkits for a black box data set. The paper demonstrates discrepancies between recovery methods that seriously hinder independent verification of digital evidence.

Rigour: Data was extracted using 3 different toolkits comprising 6 different recovery methods from 49 devices. All results were manually verified and the entire experiment was repeated to confirm results.

Impact: The results will have serious consequences for the presentation of digital information as evidence, since the paper demonstrates that it is highly challenging to verify results for one device using an independently developed toolkit.