Mobile Forensics · Forensics Foundations · Lesson 5 of 5

Challenge: The Desk Drawer Phone

Help a company IT team handle a work phone in a possible data leak, step by step.

Case brief

You're Dana, the one-person security team at a small design studio in the US. Every employee signs a policy saying company-issued phones belong to the studio and may be examined.

This morning a client called. Drafts of their unreleased product appeared on a competitor's website. Only three people had the files. One of them, Sam, resigned yesterday. HR suspects he sent the drafts before leaving.

Sam handed back his company iPhone, and HR put it in his old desk drawer. You find it switched on and unlocked, still connected to the office Wi-Fi and to cellular, at 22% battery. A new message from the competitor is showing on the screen.

Sam is now in a meeting room with HR, holding his personal Android phone. The HR manager tells you to grab that phone too, since it probably has the evidence on it.

The studio's lawyer says the case may end up in court, so everything must be done properly.

The first moves

You're standing at the drawer with the company iPhone. It's unlocked, online and losing battery. The competitor's message is still on screen. You have a camera, a Faraday bag with a battery pack that fits inside, and an evidence bag with a custody form.

Your manager suggests switching the phone off so the battery doesn't die, then dealing with it on Monday.

A night at home

The phone is shielded and charging. A coworker offers to drop it at the outside forensic lab on his way in tomorrow, and takes it home overnight. At the lab, the examiner asks for the paperwork showing who held the phone from the moment you bagged it. The form has your signature at 10:14 the day before, then the lab's signature the next morning, and nothing in between.

Choosing the acquisition

The phone reached the lab still in AFU. The examiner explains the options. The studio's main question is whether Sam sent the drafts through a messaging app, and whether he deleted the conversation afterward. A logical acquisition is available. A deeper method that collects every available active file, including each app's database files, is also available for this model in this state.