Pervasive social networking forensics: Intelligence and evidence from mobile device extracts

In pervasive social networking forensics, mobile devices (e.g. mobile phones) are a typical source of evidence. For example, figures from an Australian law enforcement agency show the number of mobile phones submitted for analysis increasing at an average of 60% per annum since 2006, and data from FBI regional computer forensics laboratory showing an increase of 67% per annum for mobile phone examinations. When coupled with the growth in capacity of memory card and device storage, which doubles approximately every 15 months, there is an ongoing and increasing growth in the volume of data available for evidence and intelligence analysis. There is a potential for information relevant to a range of crimes within the extracted data, such as terrorism and organised crime investigations, with potential cross-device and cross-case linkages. In this paper, we propose the Digital Forensic Intelligence Analysis Cycle (DFIAC). Using mobile device extracts from an Australian law enforcement agency, we demonstrate the utility of DFIAC in locating information across an increasing volume of forensically extracted data from mobile devices, and a greater understanding of the developing trends in relation to mobile device forensic analysis.