Screenshots allow investigators to capture a snapshot of what is currently displayed on a mobile device’s screen during digital forensic triage.They can even be used to capture encrypted messages preserving evidence. This method makes it possible to collect digital evidence that would otherwise not be available in an advanced logical acquisition because the data is protected.
Screenshots are a versatile and powerful tool for digital forensics experts, allowing them to capture and analyze digital evidence that can be lost easily. Screen recording essentially provides forensic investigators with the same capabilities. Using the screen recording feature, law enforcement can easily record and view videos of the device's screen, in real-time. You can see and hear the digital evidence presented.
ADF Solutions has a feature in Mobile Device Investigator that allows you to document the evidence that is in front of you that has the potential to walk and never be seen again. Whether the screen recording is from a witness's device or the actual suspect device, it is easy to obtain and process evidence from iOS or Android mobile devices using ADF's Mobile Forensics tools.
You may capture screenshots during a forensic preview or investigation. They are collected before starting the logical acquisition, you can capture screens, and then extract data to be included in the logical acquisition.
In ADF, there are 2 ways to access the Screenshots Capture screen:
-
When starting a mobile device scan, if the Search Profile contains the APPLICATIONS > Screenshots Capture.
-
By navigating to Home > Image Attached Devices (ADF PRO Tools ) or Home > Acquire Android/iOS Devices (MDI logo - Mobile Device Investigator).
How to Take Screenshots:
-
On the mobile device, navigate to a relevant app and screen.
-
On this screen, enter a group name corresponding to the app on the mobile device.
-
Add comments (optional)
-
Click on the Take Screenshots button to collect a copy of what is displayed on the mobile device
-
Go back to step #1 to collect more screenshots.
-
Click FINISH to save the screenshots and go to the home page, or
-
Click ACQUIRE to save the screenshots and move to the advanced logical acquisition
-
Click Home to discard the screenshots and go to the Home page.
Note: Once you finish collecting you have two options:
Acquire- will save the screenshots and create an Advanced Logical Backup that can be scanned later by using the Add Phone Backup button in the Scan screen.
Finish- will save the screenshots only which can be scanned later by using the Add Phone Backup button in the Scan screen.
You may separate screenshots into distinct groups for later processing. You can also add comments to individual screenshots which you can use to search and filter later on. Once they are processed with optical character recognition screenshots can be searched for textual content and included in the final report.
Screenshots/Screen recordings can be great for documenting evidence when limited in scope, having a device belonging to a victim witness, having consent to scan the device, or capturing data prior to acquisition that may not be available in advanced logical acquisition. You can continue with a case that may have been stalled or the opportunity lost due to an uncooperative witness/suspect.
ADF’s Mobile Device Investigator uses Artificial Intelligence and Machine Learning to quickly and easily collect evidence from iOS and Android phones and tablets. With the ability to leverage screenshots/screen recordings and OCR textual analysis, you can conduct a thorough investigation and produce useful reports.
Screen recording, mirroring, and screenshots of apps with security policies allow your forensic investigators to easily collect data, on the scene, now.
