Chapter 12. Windows Phone Forensics

Windows mobile devices are becoming more widely used and may be encountered during forensic investigations. Locating and interpreting digital evidence present on these devices requires specialized knowledge of the Windows Phone operating system and may not always be possible. Commercial forensic and open source tools provide limited support for acquiring user data from Windows devices. As Windows mobile devices are relatively new, most forensic practitioners are unfamiliar with the data formats, embedded databases used, and so on. This chapter provides an overview of Windows Phone forensics, describing various methods of acquiring and examining data on Windows mobile devices.