A new tool to recover information stored in Smartphone’s
volatile memory could give investigators important clues to solve a criminal
case, say researchers.
With the new device, the researchers from Purdue University
move the focus from a smart phone's hard drive, which holds information after
the phone is shut down, to the device's RAM, which is volatile memory.
"We argue this is the frontier in cyber crime investigation
in the sense that the volatile memory has the freshest information from the
execution of all the apps," said lead researcher Dongyan Xu.
"Investigators are able to obtain more timely forensic
information toward solving a crime or an attack," Xu noted.
Although the contents of volatile memory are gone as soon as
the phone is shut down, it can reveal surprising amounts of forensic data if the
device is up and running.
The team's early research resulted in work that could
recover the last screen displayed by an Android application.
Building on that, Xu said, it was discovered that apps left
a lot of data in the volatile memory long after that data was displayed.
RetroScope makes use of the common rendering framework used
by Android to issue a redraw command and obtain as many previous screens as
available in the volatile memory for any Android app.
The device requires no previous information about an app's
internal data.
"Anything that was shown on the screen at the time of
use is indicated by the recovered screens, offering investigators a litany of
information," Xu said.
"We feel without exaggeration that this technology
really represents a new paradigm in smart phone forensics," he said.
"It is very different from all the existing
methodologies for analysing both hard drives and volatile memories," Xu
noted.
With the new device, the researchers from Purdue University move the focus from a smart phone's hard drive, which holds information after the phone is shut down, to the device's RAM, which is volatile memory.
"We argue this is the frontier in cyber crime investigation in the sense that the volatile memory has the freshest information from the execution of all the apps," said lead researcher Dongyan Xu.
"Investigators are able to obtain more timely forensic information toward solving a crime or an attack," Xu noted.
Although the contents of volatile memory are gone as soon as the phone is shut down, it can reveal surprising amounts of forensic data if the device is up and running.
The team's early research resulted in work that could recover the last screen displayed by an Android application.
Building on that, Xu said, it was discovered that apps left a lot of data in the volatile memory long after that data was displayed.
RetroScope makes use of the common rendering framework used by Android to issue a redraw command and obtain as many previous screens as available in the volatile memory for any Android app.
The device requires no previous information about an app's internal data.
"Anything that was shown on the screen at the time of use is indicated by the recovered screens, offering investigators a litany of information," Xu said.
"We feel without exaggeration that this technology really represents a new paradigm in smart phone forensics," he said.
"It is very different from all the existing methodologies for analysing both hard drives and volatile memories," Xu noted.