Mobile Forensics · Reporting & Ethics · Lesson 5 of 5

Challenge: The Departing Manager

Examine a company phone, defend your hashes and word the report with care.

The case brief

You're Priya, an IT security analyst at a mid-sized logistics company. A sales manager, Mark, resigned last week. Leadership suspects he sent a confidential supplier contract to a competitor before leaving.

Here's what you have:

• His company-issued Android phone, which he handed in. The company owns it, and the device policy he signed allows IT to examine company devices.
• Written approval from Legal, limited to the company email and chat apps from January to March, plus anything about the supplier contract.
• A full file system extraction you made on Monday. You recorded its SHA-256 in your case notes.

The phone has stayed powered on in the IT office since then. On Friday, a colleague makes a second extraction of the same phone to try a different tool. Its SHA-256 doesn't match yours. Your manager, Dana, sees the two values and worries out loud that someone has tampered with the evidence. You hash your Monday extraction file again, and it matches the value in your notes.

Everything on the phone

The extraction holds far more than work email and chat. There are Mark's personal photos, messages with his family, and a thread with his doctor's office about an appointment.

Dana asks you to send her "the whole thing" so she can browse through it herself, just in case something useful turns up. You decline. Only material inside Legal's approval will be examined and reported, and the personal data stays out of the report.

Wording the findings

In the email app's database you find work messages from January and February. In the database's free pages you also recover a deleted message from Mark to an outside address, dated 20 February, with an attachment whose file name matches the supplier contract. You find no email at all from March.

Dana drafts a few lines for the findings section and asks which one is right to use.

The deleted photos

Dana has one more request. A coworker says Mark photographed pages of the contract with this phone, then deleted the photos from the gallery about a month ago. Dana asks you to "pull them back off the memory chip."

You explain that this phone uses file-based encryption. When a file is deleted its key is discarded, and TRIM lets the storage erase the freed blocks, so carving the raw chip is very unlikely to work. Any other source would need its own review by Legal.