The range of information that can be obtained from mobile phones is detailed in this section. Data on a mobile phone can be found in a number of locations—SIM card, external storage card, and phone memory, for example. In addition, the service provider also stores communication-related information. This book primarily focuses on data acquired from a phone's memory. Mobile device data extraction tools recover data from a phone's memory. Even though data recovered during forensic acquisition depends on the mobile model, in general, the following data is common across all models and useful as evidence. Note that most of the following artifacts contain timestamps:
- Address book: This contains contact names, phone numbers, email addresses, and so on.
- Call history: This contains dialed, received and missed calls and call duration...
