Test Results for Mobile Device Acquisition Tool: Micro Systemation .XRY 3.6

• NCJ Number: 224148
• Date Published: October 2008
• Length: 145 pages
• Grant Number(s): 2003-IJ-R-029
• Agencies: NIJ
• Publication Type: Test/Measurement

Annotation

As part of the Computer Forensics Tool Testing (CFTT) program--whose objective is to provide measurable assurance to practitioners, researchers, and other applicable users that the tools used in computer forensics investigation provide accurate results--this report presents the results of testing Micro Systemation. XRY, version 3.6, a mobile device data acquisition tool.

Abstract

With the exception of two test cases (CFT-IM-05 and CFT-IM-06), the tested tool acquired all supported data objects completely and accurately from the following selected test mobile devices and associated media: the Nokia 6101, T-Mobile SIM, Motorola TAZR V3, and AT&T SIM. Regarding one exception (CFT-IM-05), the MSISDN was not reported for the Nokia 6101 after a successful internal memory acquisition. For the second exception (CFT-IM-06), the maximum length notes created on the Nokia 6101 were truncated, preventing the entire message from being acquired. The tool reports a maximum of 184 characters within a note. The tool was tested against the GSM Mobile Device and Associated Media Tool Specification and Test Plan Version 1.1. The report’s section on test case selection contains a table that lists the features available in Micro Systemation .XRY and the linked test cases. A second table lists the features not available in the device and the linked test cases. The report’s section on results by test assertion contains a table that summarizes the test results by assertion. For each assertion, the number of test cases that use the given assertion is indicated. For each assertion that involves an anomaly, the table provides the report’s section number where the anomaly is discussed. Another section of the report describes the testing environment, including the test computers. The report’s concluding section provides the test results report key and the details of each test result. Extensive data tables