![](https://csdnimg.cn/release/download_crawler_static/7735891/bg11.jpg)
Guidelines on Mobile Device Forensics
3
2. Background
This chapter gives an overview of the hardware and software capabilities of mobile devices
and their associated cellular networks. The overview provides a summary of general
characteristics and, where useful, focuses on key features relevant to forensics. Developing an
understanding of the components and organization of mobile devices (e.g., memory
organization and its use) is a prerequisite to understanding the intricacies involved when
dealing with them forensically. For example, mobile device memory that contains user data
may be volatile (i.e., DRAM/SRAM) and require continuous power to maintain content
similar to RAM in a personal computer. Similarly, features of cellular networks are an
important aspect of mobile device forensics, since logs of usage, geographic location, and
other data are maintained. Mobile device technologies and cellular networks are rapidly
changing, with new technologies, products, and features being introduced regularly. Because
of the fast pace with which mobile device technologies are evolving, this discussion captures a
snapshot of the mobile device discipline at the present time.
2.1 Mobile Device Characteristics
Mobile devices perform an array of functions ranging from a simple telephony device to those
of a personal computer. Designed for mobility, they are compact in size, battery-powered, and
lightweight. Most mobile devices have a basic set of comparable features and capabilities.
They house a microprocessor, read only memory (ROM), random access memory (RAM), a
radio module, a digital signal processor, a microphone and speaker, a variety of hardware keys
and interfaces and a liquid crystal display (LCD). The operating system (OS) of a mobile
device may be stored in either NAND or NOR memory while code execution typically occurs
in RAM.
Currently, mobile devices are equipped with system-level microprocessors that reduce the
number of supporting chips required and include considerable internal memory capacity
currently up to 64GB (e.g., Stacked NAND). Built-in Secure Digital (SD) memory card slots,
such as one for the micro Secure Digital eXtended Capacity (microSDXC), may support
removable memory with capacities ranging from 64GB to 2TB of storage. Non-cellular
wireless communications such as infrared (i.e., IrDA), Bluetooth, Near Field Communication
(NFC), and WiFi may also be built into the device and support synchronization protocols to
exchange other data (e.g., graphics, audio, and video file formats).
Different mobile devices have different technical and physical characteristics (e.g., size,
weight, processor speed, memory capacity). Mobile devices may also use different types of
expansion capabilities to provide additional functionality. Furthermore, mobile device
capabilities sometimes include those of other devices such as handheld Global Positioning
Systems (GPS), cameras (still and video) or personal computers. Overall, mobile devices can
be classified as feature phones that are primarily simple voice and messaging communication
devices or smartphones that offer more advanced capabilities and services for multimedia,
similar to those of a personal computer. Table 1 highlights the general hardware characteristics
of feature and smartphone models, which underscore this diversity.
The classification scheme is illustrative and intended to give a sense of the range of hardware
characteristics currently in the marketplace. Over time, characteristics found in smartphones
tend to appear in feature phones as new technology is introduced to smartphones. Though the