Does MPI need the phone to perform the exam?

I am asked regularly if I need to have the cell phone to perform the exam.  The answer is yes in most cases.  The tools used in the cell phone forensic arena must make a connection to the device to recover the data.  There are howerver some devices where this is not always the case.  The iPhone and the Blackberry operating systems have a backup option.  These backup files can be imported and examined.

iPhone

When a user connects a device to their computer to downlaod a new song, or uses iTunes in any way, iTunes creates a backup of the data on the iPhone.  A Cell Phone Forensic examiner using the correct tools can import the iTunes backup file and create a report from that backup.  Examiners are able to recover text messages to include some deleted messages, call logs , contacts, email, pictures, videos and music from these backups.  For some people this backup file may be your best option when requesting an exam of  an iPhone.

Blackberry

Theb Blackberry Operating Sytems backups are somwhat different then the iPhone.  The Blackberry uses its desktop software to perform the backup but it must either be auto generated or activated by the user.  The desktop software can be programmed to automatically backup the BB device when it is connected.  In most cases the user performs the backup on their own. 

The Blackberry OS backup uses a propritary format called an .ipd file.  These .ipd files never automatically overwrite themselves.  If a user is regimental about backing up their device there may be a complete history of the device in the backup files. 

In either case these backup files can be very valuable.  If you believe data has been deleted and our tools can not recover the messages.  I recommend looking on the computer to see if these backup files exist.  If you need more information on the backup files please contact MPI.