Digital Forensic on MTK-based Shanzhai Mobile Phone with NAND Flash

The use of mobile phone has increased dramatically in the last decade. Globally, the number of mobile cellular subscriptions reached 5.3 billion by the end of 2010, reported by Jinan University, Guangzhou, China Abstract Mobile phone has become a necessity of our life. There exist hundred kinds of Chinese Shanzhai mobile phones and they had an important impact on the mobile industry and the society. There is also a trend that Shanzhai phones are used in crimes as they are much cheaper and hard to be traced. The adverse impact on forensic is the difficulty of obtaining useful evidence from these phones due to the absence of system manuals and knowledge of the memory layout. In this paper, we attempt to provide some important information of how the phone book, phone call records, SMS, web browser record etc. are stored inside a MTK-based Shanzhai phone with NAND flash and how this kind of Shanzhai phone handle these important data. This information can help investigators understand the working mechanisms of Shanzhai phone and analyze the problems encountered during investigation.