Forensics of computers and handheld devices: identical or fraternal twins?

by nena Lim and anne Khoo likely to encounter such handheld devices during their investigation process. The increasing size of storage, built-in cameras, and Internet-enablement of handheld devices make them a rich source of evidence. Apart from forensic investigators, system administrators as well as senior management in organizations should also beware that they cannot treat forensics of mobile phone and PDA lightly because of the unique characteristics of such handheld devices. To date, only limited publications on handheld device forensics are available and they are predominantly technical papers describing how one should examine different types of handheld devices. 3, 6, 11 The objective of this article is to draw the readers’ attention to some of the major differences between personal computer forensics and handheld device forensics. As the target audience is not forensic professionals, this article forgoes the more technical details of handheld forensics and does not provide any specific forensic instructions. Instead it highlights and explains in laymen terms the unique characteristics of mobile phones and PDAs during the forensic investigation process in comparison with those of ordinary personal computers.