Extraction of Persistent, Nonvolatile and Deleted Data from Windows Phone without JTAG Implementation

Abstract

Cybercrime is spreading day by day and now become a part of routine life of users. With easily availability of smartphones and internet, which creates opportunity for the cyber criminals to commit such cybercrimes by utilizing smartphones. In today’s world the majority of the devices used in day to day life are Android and iOs but still there are some Windows Phone available in use. In the black market the price of Windows Phone is high due to its high security features and lake of available forensic tools. Before the seizure of AlphaBay and Hansabay (TOR Marketplace) the price of windows phone was high due to secure file system and robust architecture of Windows Phone. The available tool are not sufficient for extracting the forensic artifacts. So in this paper author has proposed and implement the method which is used for physical acquisition without using JTAG on hardware of windows Phone to extract persistent, nonvolatile and deleted data.