Is the Answer on a Mobile Device?

Russell W. Gilmore, CISSP, CISM, EnCE Electronic Data Recovery, Mobile Forensics

Quite often, yes.

Clients have been complaining that John, a sales representative at your company, hasn’t been showing up to scheduled appointments for months, and you noticed his area sales have been rapidly declining. However, John has been submitting reports for all the expenses he’s incurred while traveling. You decided to fire John due to the discrepancies in his reports, and now he’s suing you for wrongful termination. What can your company do to prove John was not where he said he was and his termination was warranted?

As it turns out, quite a bit.

Previously, mobile forensics had been extremely difficult due to diversity in manufacturers and differences in technologies and applications. Thanks to the overwhelming need, software and technology now allow investigators to tap into data stored on cell phones across platforms and applications.

If there’s a need to collect data from mobile phones – such as crimes or civil litigations – voicemail, GPS location information, and, on occasion, deleted data, images, and more can be collected.

Using the right tools and relying on investigative experience, forensics investigators can quickly make sense of the information contained on a mobile device.

With significant investigative and forensics experience, Protus3 continues to make important investments in tools and knowledge to improve their success rate in extracting data and preserving evidence. We set ourselves apart with our distinguished staff of investigators – most of whom have a law enforcement background – and our ability to collect and analyze the evidence extracted from devices. We not only see the IT side, but the investigative side as well.

In the case of John, Protus3 would be able to extract data and look for key points in his mobile history.

Did the device connect to hotel WiFi?

Was the GPS used for driving directions?

Were applications such as OpenTable or Yelp used during travel?

Protus3 can extract that data – and more – and determine if John was where he said he was.