Memory card storage capacity ranges from 128MB and up. As technological advances are made, such media becomes physically smaller and offers larger storage densities. Removable media extends mobile devices’ storage capacity, allowing individuals to store additional files beyond the device’s built-in capacity and share data between compatible devices.
Some forensics tools can acquire the contents of memory cards; many are not. If the acquisition is logical, deleted data present on the card is not recovered. Fortunately, such media can be treated similarly to a removable disk drive and imaged and analyzed using conventional forensic tools using an external media reader.
Physical acquisition of data present on removable media allows the examiner to search the contents of the media and potentially recover deleted files. One drawback is that mobile device data, such as SMS text messages, may require manual decoding or a separate decoding tool to interpret. A more serious issue is that content protection features incorporated into the card may block data recovery. Table 4 gives a brief overview of various storage media in use.
Post your comment on this topic.