Articles & E-Books

 

The future of remote forensic data collection is here

Dec 13, 2022

In any forensics investigation, it’s likely that collecting data from a relevant mobile device, such as a smartphone or tablet, is a critical part of the information-gathering process. But it also causes significant disruption and inconvenience for those who agreed to (or are legally required to) temporarily relinquish their devices so that pertinent texts, emails, images and other data can be acquired by a forensics specialist.

Traditionally, individuals would either take their phone or other mobile device to an office where someone would spend several hours acquiring needed data from it, or they would endure three or more days without their device if they were required to ship it to an out-of-town specialist and wait for it to be shipped back after the data extraction.

But an industry-changing option is now available that should lead to far less resistance and inconvenience: remote forensic data collection. While remote collection of computer-based devices has been available for years, that option was limited or nonexistent for most mobile devices until recently.

Users now have five simple data collection steps

Most users will just need to follow this straightforward, five-step process:

  1. The user receives an email from the forensics specialist with a link to download an app to their laptop.
  2. They click the link to start the download process.
  3. The downloaded application tells them to prepare their mobile device for the data acquisition with some specific actions (such as making sure their phone doesn’t go into sleep mode right away).
  4. They connect the device to their laptop or other computer and the acquisition process begins automatically. The user doesn’t need to select what’s being imaged and they don’t have the ability to limit or interfere with the collection. The forensic specialist controls those options, having already configured that prior to starting the process.
  5. The data collection commences, followed by packaging and virtual shipping to the forensic analyst via the internet.

Whatever the alleged wrongdoing — financial misappropriation, intellectual property theft, sexual harassment or something else — the chances are high that geolocation data, metadata, chat histories call logs, videos and/or pictures will yield useful evidence for the investigation.

Remote culture change

The rise of the remote workforce and work-from-home culture since the start of the COVID-19 pandemic has caused a complete rethinking of how law firms and other organizations approach remote forensic collections. Remote collections are no longer seen as a luxury but a necessity.

Technological progress has advanced this area in a short amount of time. Before the arrival of these latest tools facilitating remote data acquisition, such efforts involved sending end-users a cumbersome kit — either a commercial product or a customized package full of adapters and imaging hardware. The user was then expected to have enough knowledge to make the necessary changes to their device, connect everything correctly and troubleshoot any issues that arose over the course of the collection.

This was a lot to ask of most people, even if the forensic analyst was working with them remotely to get things running.

The ability to perform remote digital imaging without burdening the user with potential technical challenges or requiring they surrender their device for any length of time is a major advantage in the world of forensic investigations. Organizations with access to such providers will benefit from the efficiencies and cost effectiveness, while the lack of disruption will be greatly appreciated by device owners.

How Wipfli can help

Data collection from mobile devices in forensic investigations is no longer a difficult and disruptive process. Wipfli specialists have access to the latest technology tools to make remote data acquisition as seamless as possible for all parties.

Contact us to learn how we can help facilitate your fraud investigations with leading technology.

Sign up to receive additional forensic services content in your inbox, or continue reading on:

Author(s)

John Walther, EnCE, GCFE, GCFA, GSEC, OFE, CISSP, MCFE-AXIOM
Lead Cybersecurity Consultant
View Profile