Applications are the future of smartphones, but what may have been the hot application for chatting last week is, today, outdated and no longer trending. Examiners must stay on top of how smartphone operators are using their devices. The commercial mobile forensic solutions do a great job at tackling the task of keeping current with the constantly expanding application market. However, they must put their resources into the applications that have proven to be the most widely utilized or those that provide the greatest “cache” of forensic data.

What does this mean for forensic examiners? Many applications may be overlooked because the data within these applications hasn’t been fully exploited by a commercial tool. The forensic tools on the market do a great job of reconstructing the file system and providing access to all the files that reside on smart devices, but many times, there is just too much data to report. It doesn’t mean that the data isn’t included in the image file; it just requires a little extra digging on the part of the examiner, all of which is possible if you have a good understanding of how different smart device platforms store their data.