Smartphone Challenges: Prepaid Phones
Prepaid phones have been a problem for some time, and continue to be a problem for law enforcement in particular. That’s because the disabled data port on these devices cannot be enabled, and vendors don’t make the devices’ APIs—the normal mode by which logical and file system extractions are completed—available to commercial forensic extraction tools’ developers.
File system extractions have the dual benefit of making more data—including some deleted data—available quickly. However, because it extracts only data from allocated space on a device’s memory, it still remains limited in some ways. It also requires a higher degree of expertise on the examiner’s part because it requires decoding.
Physical extraction, the bit-for-bit copy of the device’s internal flash memory, provides the fullest amount of accurate data because it obtains information from both allocated and unallocated space. However, it can be time consuming even with a good forensic tool; it requires decoding, and therefore demands the examiner to have explicit training or expertise.
From: 6 Persistent Challenges with Smartphone Forensics by Ronen Engler and Christa M. Miller