Data acquisition

While the sales of BlackBerry devices is on the decline, they are still encountered during forensic investigations. Commercial forensic tools provide limited support for BlackBerry devices in comparison to other smartphones. Even worse, open source methods are not available for data acquisition of BlackBerry devices. Hence it is important for the examiners to understand all possible methods of data extraction available for these devices. The following sections discuss the various steps involved in acquiring data from a BlackBerry device.

Standard acquisition methods

Standard forensic acquisition methods can be applied to BlackBerry devices. However, encrypted and locked devices may not be possible to acquire, and it will be even more difficult (if not impossible) to analyze whether the password or encryption keys are present. The level of acquisition support available depends on the forensic kit, the device model, and the security level currently being used on the BlackBerry...