+91 11 47074263
Sifs India
February 20, 2023 - BY Tisha Ramteke

Mobile Forensic Tools And Challenges Faced By Mobile Forensic

Mobile phones have become part of our day to day lives. Today almost every person is using cellphone or mobile phones for their needs, entertainment, studies and etc. It has come a long way from just communication devices to feature mobile kits such as high-quality cameras, 4G/5G technology and etc, and also a social media, online games etc. These contain a lot of information about users and user activity. Mobile devices such as tablets, laptops, and smartphones develop very rapidly because of the market demands so it is very difficult for the investigator to investigate.

Mobile phones can provide a lot of abundant information. The most obvious type of data is call records, contact lists and text messages. The other various types of evidence are documents, files, notes as well as location which can also provide valuable clues for investigation. This evidence is very friable in nature and can be tampered easily so it must be handle very carefully.


One of the biggest forensic challenges when it comes to the mobile platform is the fact that data can be accessed, stored, and synchronized across multiple devices. As the data is volatile and can be quickly transformed or deleted remotely, more effort is required for the preservation of this data. Mobile forensic is different from computer forensic and present unique challenges to forensic examiners or investigator.

Forensic examiner often struggle to obtain digital evidence from mobile devices. The following reasons are:

Mobile operating system: Unlike personal computer where windows has dominate the market for year, mobile device widely use more operating systems, including Apple’s ios, Google’s Android, RIM’s Blackberry OS, Microsoft’s windows mobile, and many others. Even within this operating system, there are several versions which make the task of forensic investigator more difficult.

Lack of resources: As mentioned earlier, with the growing number of mobile phone, the tools used by forensic examiner would also increases. 

Anti-forensic technique: Anti-forensic techniques, such as data forgery, data hiding and secure wiping, make investigations on digital media more difficult.

Dynamic nature of evidence: Digital evidence may be easily either intentionally or unintentionally. For example, browsing an application on the phone might alter the data stored by that application on the device.

Communication shielding: Mobile device communicate over cellular network, wi-fi network, Bluetooth, and infrared. As device get connected to other communication network so the present data of the device get alter.

• Passcode recovery: If the device is protected within the pass code, the forensic examiner needs to gain access to the device without damaging the data on the device. While there are techniques to bypass the screen lock, they may not work always on all the versions. 

Lack of availability of tools: There is a wide range of mobile device. A single tool may not support the entire device or perform all the necessary functions, so a combination of tools needs to be used. Choosing the right tool for a particular phone might be difficult.

Malicious programs: The device might contain malicious software or malware, such as a virus or a Trojan. Such malicious program may attempt to spread over the device that device may be a wired or wireless.

Legal issues: Mobile device might be involved in crimes, which can cross geographical boundaries. In order to tackle these multijurisdictional issues, the forensic examiner should be aware of the nature of the crime and the regional laws.


Data that can be collected from mobile devices are SIM card, contacts, call records, Media, App data, Files, hidden data, documents and deleted files. Techniques to gather such data are:

Physical Acquisition: It is a technique for capturing all data including deleted data from a mobile device. The received data is originally in raw format which is converted into human readable format.

Logical Acquisition: It is a technique for extracting files and folder without any deleted data from the device. It makes a copy of the file using a software tool. For example, iTunes backups are used to create logical image for the iPhone or iPad.


In recent years, various tools related to hardware, software and packages have emerged to recover the logical and physical evidence of mobile devices. The hardware contains various cables to connect the phone to the forensic acquisition engine. The package is designed to extract evidence and often analyze it.

Recently, a rhetoric tool for mobile device was developed. This is often a response to both military unit requirements, and anti-terrorist information and Execution is a rhetorical foresight in crime scenes, execution of arrest warrants or emergency situations. In general, for anyone tool to capture all evidence from all mobile devices is not possible it requires various different working model software.


Mobiledit: Can extract deleted data and perform a deep analysis of the features of a phone.

• Oxygen Forensics: Practitioner toolset capable of extracting forensic data, and generating reports.

• Cellebrite: It provides tools for federal, state, local law enforcement agencies, businesses and services provide to collect, review and analyze the digital data.

• Elcomsoft Los forensic Toolkit: it performs complete file system and logical survey of iphone, ipad ,ipod Touch devices. It creates image of the device file system, extract the password, encryption key, protected data and can decrypt file system image.

Free Tools

• FTK Imager

• Andriller

• Autopsy

• Linux Memory Extractor

• AFLogical OSE


With the help of open source digital forensic tools like Mobiledit lite and autopsy, details such as SMS, call registers, Images, songs, Videos and Files can be stored for Further investigation. Mobiledit Lite comes with write blocker (read only) feature so as to ensure the in tegrity of the mobile phone is maintained and the evidence is not contaminated. Mobiledit lite and Autopsy alone are not sufficient to recovery of deleted items. Other open source tools or commercial tools can be used with them for additional functions such as authentication bypass, SIM cloning and Retrieval of browsing internet data. Using Timeline Analysis report of autopsy, the sequence of events can be established and useful in event reconstruction.

Services at SIFS India 


Learning at SIFS India

To learn more, visit the Sherlock Institute of Forensic Science India where the team of expert professionals and certified faculty provides you with a great opportunity to learn forensics by attending different forensic events organized from time to time. Also, you can learn by registering yourself in forensic courses and training programs offered by SIFS India both in online and offline mode. You can also visit our YouTube channel for all the events recoding.

Join our Telegram Channel for the hub of forensic books and study material.

You can put your review here if you have a great experience with SIFS India.

Follow us on FacebookInstagram, and LinkedIn for all updates regarding internships training, conference and other educational events organised by Sifs India.

You can Attempt the weekly forensic quiz and post your certificate on social media by tagging the official Page of SIFS India with proper hashtags such as #SIFSIndia #LearnForensic to get a chance to be the winner.