Test Results for Mobile Device Acquisition Tool: Lantern v2.3

• NCJ Number: 241154
• Date Published: February 2013
• Length: 82 pages
• Grant Number(s): 2003-IJ-R-029
• Agencies: NIJ
• Publication Type: Test/Measurement

Annotation

This NIJ Special Report presents the results from testing Mobile Device Acquisition Tool: Lantern version 2.3 and reports the results from testing against the Smart Phone Tool Test Assertions and Test Plan.

Abstract

This NIJ report presents the results from testing Mobile Device Acquisition Tool: Lantern v2.3 conducted through the Computer Forensics Tool Testing (CFTT) program. The testing covered several areas about the tool: acquisition attempt of nonsupported device, subscriber-related and equipment-related information, personal information management (PIM) data, and acquisition of Internet-related data. The tool was tested for its ability to data from the internal memory of mobile devices running iOS. The testing revealed that, for the most part, the tool was able to acquire all supported data objects completely and accurately from the internal memory of the devices tested. A list of devices tested is included in the report. A few anomalies did occur with the data acquisition, however they were specific to certain devices. Some of these anomalies included lack of an error message stating device not supported when acquisition of nonsupported device was attempted (iPod Nano); subscriber-related and equipment-related information not reported (iPhone4 CDMA); incomplete reporting of address book entries (iPhone4 GSM, iPhone4 CDMA); and Internet-related data not reported (iPhone_3.1.2, iPhone_3.1.3). The information in this report is divided into five sections: 1) a summary of the results from the test runs; 2) justification for the selection of test cases from the set of possible cases defined in the test plan; 3) detailed description of the anomalies found during testing; 4) lists of hardware and software used to run the test cases; and 5) a description of each test case run, including the test assertions used in the case, the expected results, and the actual results. Tables