NIST Releases PDA Forensics Study

National Institute of Standards and Technology (NIST), sponsored by the US Department of Homeland Security, has released a new report and study on PDA forensics. The report takes a look at current PDA forensic tools as well as a detailed look at handheld operating systems and security.

Tech savvy criminals are just as likely as anyone else to use high-tech devices, such as personal digital assistants (PDAs), to help keep track of their activities. When these devices are used in a crime, law enforcement investigators need to know how to find, properly retrieve and examine the information they store, even if the criminal tried to hide or delete the data.

Researchers from the National Institute of Standards and Technology recently examined a number of software tools designed to acquire information from operating systems used in most PDAs: Palm OS, Microsoft Pocket PC and Linux.

The researchers examined the tools in a range of situations commonly encountered during a forensic examination of PDAs. For example, the researchers wanted to determine if tools could find information, including deleted information, associated with applications such as calendars, contacts and task lists. The tools also were examined to see if someone could obtain the user's password and gain access to the contents of the device.

NIST's review of the current state of the art of forensic software, PDA Forensic Tools: An Overview and Analysis (.pdf) (NISTIR 7100), will help investigators better understand the capabilities and limitations of these software tools. Sponsored by the Department of Homeland Security, the study was not intended to be exhaustive or serve as a formal product evaluation but to complement the more rigorous specifications and test methods being developed as part of the Computer Forensics Tool Testing project. The CFTT is a joint effort of NIST, the National Institute of Justice, and law enforcement organizations.

A companion NIST report, which provides more detailed procedures on preserving, examining, analyzing and reporting of digital evidence on PDAs, will be available soon. A draft of this publication, Guidelines on PDA Forensics, is now available.