New tool recovers phone's information to aid investigators

By: GizBot Bureau

    A new tool to recover information stored in smartphone's volatile memory could give investigators important clues to solve a criminal case, say researchers.

    New tool recovers phone's information to aid investigators

    With the new device, the researchers from Purdue University move the focus from a smart phone's hard drive, which holds information after the phone is shut down, to the device's RAM, which is volatile memory.

    SEE ALSO: Kyocera DuraForce Pro Announced: 6 Things to Know about World's First Rugged Action Camera Phone

    "We argue this is the frontier in cyber crime investigation in the sense that the volatile memory has the freshest information from the execution of all the apps," said lead researcher Dongyan Xu.

    "Investigators are able to obtain more timely forensic information toward solving a crime or an attack," Xu noted.

    Although the contents of volatile memory are gone as soon as the phone is shut down, it can reveal surprising amounts of forensic data if the device is up and running.

    New tool recovers phone's information to aid investigators

    The team's early research resulted in work that could recover the last screen displayed by an Android application.

    Building on that, Xu said, it was discovered that apps left a lot of data in the volatile memory long after that data was displayed.

    RetroScope makes use of the common rendering framework used by Android to issue a redraw command and obtain as many previous screens as available in the volatile memory for any Android app.

    SEE ALSO: 6 Myths Related to Smartphone Usage AT NIGHT Debunked

    The device requires no previous information about an app's internal data.

    The screens recovered, beginning with the last screen the app displayed, are presented in the order they were seen previously.

    "Anything that was shown on the screen at the time of use is indicated by the recovered screens, offering investigators a litany of information," Xu said.

    New tool recovers phone's information to aid investigators

    In testing, RetroScope recovered anywhere from three to 11 previous screens in 15 different apps, an average of five pages per app.

    The findings were presented during the USENIX Security Symposium in Austin, Texas.

    SEE ALSO: Xiaomi Mi Note 2 Dual Curved Edge Screen Leaks: This is How the Phone Might Look Like [PICS]

    "We feel without exaggeration that this technology really represents a new paradigm in smart phone forensics," he said.

    "It is very different from all the existing methodologies for analysing both hard drives and volatile memories," Xu noted.

    Source IANS

    Read More About: smartphone phones data back up news

    Stay updated with latest technology news & gadget reviews - Gizbot

    We use cookies to ensure that we give you the best experience on our website. This includes cookies from third party social media websites and ad networks. Such third party cookies may track your use on Gizbot sites for better rendering. Our partners use cookies to ensure we show you advertising that is relevant to you. If you continue without changing your settings, we'll assume that you are happy to receive all cookies on Gizbot website. However, you can change your cookie settings at any time. Learn more