Test Results for Mobile Device Acquisition Tool: AFLogical 1.4

• NCJ Number: 235712
• Date Published: December 2011
• Length: 70 pages
• Grant Number(s): 2003-IJ-R-029
• Agencies: NIJ
• Publication Type: Test/Measurement

Annotation

This report presents the results from testing AFLogical Version 1.4, against the "Smart Phone Tool Test Assertions and Test Plan."

Abstract

The tool logically acquired active data elements from the mobile device internal memory completely and accurately, except for the following cases: a case where acquisition of Personal- Information-Management data was attempted, and a case where acquisition of Multimedia-Messaging-Service data was attempted. In addition, in a case that tested the tool's behavior when connectivity is interrupted, the tool failed to notify the user that the acquisition had been disrupted. Five anomalies were observed in the testing. First, graphics files associated with address book entries were not reported. Second, regular and maximum length Personal-Information-Management (PIM) data were not reported. Third, Maximum-length PIM data (memos) were not reported. Fourth, the textual portions of outgoing Multimedia-Messaging-Service (MMS) messages were not reported. Fifth, notification of device disruption during acquisition was not successful. Two sections of this report provide justification for the selection of test cases and assertions from the set of possible cases defined in the test plan for smart phone forensic tools. The test cases are generally selected based on features offered by the tool. Another section of the report lists the hardware and software used to conduct the test cases. The report's concluding section describes each test case, test assertions used in the test case, the expected result, and the actual result. Extensive tables