Skip to content

PC vs Mobile

Differences between PC and Mobile

  • Write Blockers: Write blockers are not effective for mobile phones because forensic acquisition requires two-way communication and deploying agents (like ADB for Android) on the device
  • Hashing:
  • PC forensics: Hash taken before and after creating forensic image - both must match
  • Mobile forensics: Hashes won't match before and after acquisition due to background services continuously running (alarms, apps) and agent deployment
  • For mobile phones, meaningful hash is taken only of the forensic image itself
  • Physical Bit-by-Bit Imaging: Not possible on modern mobile phones (Android 7+ or iOS 10+) due to file-based encryption
  • Encryption keys stored in Secure Enclave or Trusted Execution Environment
  • Even physical copies would only contain encrypted data