Symbian Smartphone Forensics: Linear Bitwise Data Acquisition and Fragmentation Analysis

  • Vrizlynn L. L. Thing
  • Tong-Wei Chua
Part of the Communications in Computer and Information Science book series (CCIS, volume 339)


In this paper, we propose a forensics evidentiary acquisition tool for the Symbian smartphones. We design and build the acquisition tool to support a low-level bit-by-bit acquisition of the phone’s internal flash memory, including the unallocated space. After acquiring the raw image of the phone’s memory, we conduct experiments and analysis to perform a detailed study of the fragmentation scenarios on the Symbian smartphone. The objective of this work is to create a complete evidentiary data acquisition tool for the Symbian smartphone, analyse the latest Symbian OS version, S60 5th Edition smartphone (i.e. find out how user’s data files are being stored on the phone) and to provide a better understanding for the purpose of further in-depth mobile phone forensics evidence reconstruction and security analysis.


Symbian forensics security memory analysis mobile devices smartphones data acquisition fragmentation 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Willassen, S.: Forensics and the GSM mobile telephone system. International Journal of Digital Evidence 2, 1–17 (2003)Google Scholar
  2. 2.
    Casadei, F., Savoldi, A., Gubian, P.: Forensics and SIM cards: an overview. International Journal of Digital Evidence 5, 1–21 (2006)Google Scholar
  3. 3.
    Kim, K., Hong, D., Chung, K., Ryou, J.-C.: Data acquisition from cell phone using logical approach. Proceedings of World Academy of Science, Engineering and Technology 26 (December 2007)Google Scholar
  4. 4.
    Mokhonoana, P.M., Olivier, M.S.: Acquisition of a Symbian smart phone’s content with an on-phone forensic tool. Department of Computer Science, University of Pretoria (2007)Google Scholar
  5. 5.
    Distefano, A., Me, G.: An overall assessment of mobile internal acquisition tool. In: Proceedings of the 8th Digital Forensics Research Conference (DFRWS), Digital Investigation, vol. 5, pp. S121–S127 (September 2008)Google Scholar
  6. 6.
    Jansen, W., Delaitre, A., Moenner, L.: Overcoming impediments to cell phone forensics. In: Proceedings of the 41st Hawaii International Conference on System Sciences (2008)Google Scholar
  7. 7.
    Hoog, A.: Android forensics. Presented at Mobile Forensics World 2009 (May 2009)Google Scholar
  8. 8.
    Willassen, S.: Forensic Analysis of Mobile Phone Internal Memory. In: Pollitt, M., Shenoi, S. (eds.) Advances in Digital Forensics. IFIP, vol. 194, pp. 191–204. Springer, Boston (2005)CrossRefGoogle Scholar
  9. 9.
    Al-Zarouni, M.: Introduction to mobile phone flasher devices and considerations for their use in mobile phone forensics. In: Proceedings of the 5th Australian Digital Forensics Conference (December 2007)Google Scholar
  10. 10.
    Thing, V.L.L., Chua, T.-W., Cheong, M.-L.: Design of a digital forensics evidence reconstruction system for complex and obscure fragmented file carving. In: Proceedings of the International Conference on Computational Intelligence and Security (December 2011)Google Scholar
  11. 11.
    Thing, V.L.L., Tan, D.J.J.: Symbian Smartphone Forensics and Security: Recovery of Privacy-Protected Deleted Data. In: Chim, T.W., Yuen, T.H. (eds.) ICICS 2012. LNCS, vol. 7618, pp. 240–251. Springer, Heidelberg (2012)Google Scholar
  12. 12.
    Sales, J.: Symbian os internals: Real-time kernel programming (January 2006)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2012

Authors and Affiliations

  • Vrizlynn L. L. Thing
    • 1
  • Tong-Wei Chua
    • 1
  1. 1.Digital Forensics Lab, Cryptography & Security DepartmentInstitute for Infocomm ResearchSingapore

Personalised recommendations