You are in:
New forensic tool reveals web cache evidence
Mobile phones have always been a rich source of forensic evidence in criminal investigations – but, until now, there has been a level of evidence which investigators have been missing out on: interpreting a phone's web cache files.
Developers at CCL-Forensics have taken a major step towards addressing this problem with a technique to interpret and present a phone’s web cache files, showing a subject’s internet history and activity.
According to CCL-Forensics many phone forensic tools may extract these files, but will do little nothing to interpret them or present the investigator with the potentially vital evidence they contain.
CCL-Forensics has created MWCT (Mobile Web Cache Toolkit) which it can use in-house during investigations for police and law enforcement agencies.
It allows the company’s digital analysts to carry out an in-depth investigation into the phone’s usage and enhances the basic information (calls, text messages, deleted data) extracted during a typical forensic analysis.
This valuable data could be deleted – and is often extracted during the acquisition process.
The tool also has the additional functionality to present CCL-Forensics’ investigators with loose web cache files which can’t be linked to any web pages, but still contain date and time information, and can provide potentially vital evidence.
Phil Ridley, Mobile Phone Lab Manager at CCL-Forensics says: “Phone forensics is about much much more than simply extracting call logs and text messages.
An example is shown in a brief web video here.
