Data acquisition
Acquiring data from a Windows Phone is challenging for forensic examiners, as the physical, file system, and logical methods that were defined in previous chapters are not greatly supported. In addition to this, the phone may need to be at a specific battery charge state (%) in order for the commercial tool to recognize and acquire the device. This is often one of the most difficult steps in acquiring Windows Phones.Â
One of the most common techniques implemented by commercial tools attempting data acquisition is to install an application or agent on the device, which enables two-way communication for commands to be sent to the device in order to extract data. This could result in certain changes on the device; nevertheless, this is still forensically sound if the examiner follows standard protocols and has tested the validity of the tool being used. These protocols include proper testing to ensure no user data is changed (and if changed, documenting what occurred), validation...
