Explores qualitative reports of information recovered from a Windows Mobile smart phone. A comparison is made of the results obtained from a variety of different toolkits used to examine a Windows Mobile memory image. The paper demonstrates that no one technique recovers all information of potential forensic interest from a Windows Mobile device and that in some cases the information recovered is conflicting. However, it is unclear to what extent these tools can present a complete view of the information held on a mobile device, or the extent the results produced by different tools are consistent.This paper investigates what information held on a Windows Mobile smart phone can be recovered using several different approaches to acquisition and decoding. In addition, manufacturers have adopted a variety of file systems and formats complicating decoding and presentation.A variety of tools and methods have been developed (both commercially and in the open source community) to assist mobile forensics investigators.
Device memory is usually integrated into the device, making isolation prior to recovery difficult. Acquisition, decoding and presentation of information from mobile devices is complex and challenging.
