| Summary: | Den stigande populariteten av mobila enheter har inte bara lett till en smidigarevardag med snabb tillgang till e-post och sociala medier utan aven blivit ett allt mervanligt instrument anvant vid kriminella handlingar. Detta har medfort ett behov attkunna undersoka dessa enheter pa ett sakert satt utan att riskera att bevis blirkontaminerade. Det har arbetet har undersokt de mobilforensiska verktyg somanvands av Polisen och deras tillvagagangssatt vid utredning. Genom att anvanda ossutav Polisens tillvagagangssatt och deras verktyg sa har vi utfort experiment ochintervjuer for att undersoka om data forandras vid utvinning. Experimenten pavisaratt data forandras vid utvinning med ett givet verktyg medans intervjuerna visarskiftande asikter bland Poliser och utvecklare gallande kontaminering.Resultatet fran experimentet visade oss att verktyget UFED raderat bevisfiler frananvandardatan pa en enhet under utvinning. Polisens nonchalans gallandekontaminering bor uppmarksammas da en av deras anvanda verktyg visade ettresultat som kan ha en avgorande roll vid utredning. === The rising popularity of mobile devices has not only led to a smoother way of livingwith quick access to email and social media, but has also become an increasinglycommon instrument used in criminal activity. This has led to a need to investigatethese devices safely without risking the integrity of the evidence. This paper hasexamined the mobile forensic tools used by the Swedish Police and their procedureused in investigations. By following the same procedures and using the same tools,we have conducted experiments and interviews to investigate if data changes duringthe extraction. The experiments demonstrate that the data changes duringextraction of a given tool, while the interviews shows diverse opinions among thePolice and developers behind these tools regarding contamination. The results fromthe experiments showed us that the tool UFED erased evidence files from theuserdata on a device during extraction. The Police negligence regardingcontamination should be attended to, since one of their used tools showed resultsthat could have had a critical impact in an investigation.
|
|---|
