Authors: Graeme Horsman and Lynne Conniss (Northumbria University)
DFRWS EU 2015
Abstract
The United Kingdom is witnessing some of the highest volumes of motor vehicle traffic on its roads. In addition, a large number of motor vehicle traffic accidents are reported annually, of which it is estimated that a quarter involve the illegal use of a hand-held mobile device by the driver. Establishing whether mobile phone usage was a causal factor for an accident involves carrying out a forensic analysis of a mobile handset to ascertain a timeline of activity on the device, focussing on whether the handset was used immediately prior to, or during, an incident. Previously, this involved identifying whether SMS messages have been sent or received on the handset alongside an examination of the call logs. However, with advancements in smartphone and application design, there are now a number of ways a driver can interact with their mobile device resulting in less obvious forms of evidence which can be termed as ‘passive activity’. This article provides an analysis of iPhone’s CurrentPowerlog.powerlogsystem file and Android device ‘buffer logs’, along with their associated residual data, both of which can potentially be used to establish mobile phone usage at the time of, or leading up to, a motor vehicle accident.