Hashing Techniques for Mobile Device Forensics

Previous research conducted at the National Institute of Standards and Technology has shown that mobile device internal memory hash values are variable when performing back-to-back acquisitions. Hash values are beneficial in providing examiners with the ability to filter known data files, match data objects across platforms and prove that data integrity remains intact. The research conducted at Purdue University compared known hash values with reported values for data objects populated onto mobile devices using various data transmission methods. While the results for the majority of tests were uniform, the hash values reported for data objects transferred via Multimedia Messaging Service (MMS) were variable. Index Terms Cell Phone Forensics, Mobile Device Forensics, Hashing, MMS, MD5.