Seeking the Truth from Mobile Evidence - 1st Edition - ISBN: 9780128110560

Seeking the Truth from Mobile Evidence

1st Edition

Basic Fundamentals, Intermediate and Advanced Overview of Current Mobile Forensic Investigations

Authors: John Bair
Paperback ISBN: 9780128110560
Imprint: Academic Press
Published Date: 1st November 2017
Page Count: 424
Tax/VAT will be calculated at check-out

Institutional Access

Secure Checkout

Personal information is secured with SSL technology.

Free Shipping

Free global shipping
No minimum order.


Seeking the Truth from Mobile Evidence: Basic Fundamentals, Intermediate and Advanced Overview of Current Mobile Forensic Investigations will assist those who have never collected mobile evidence and augment the work of professionals who are not currently performing advanced destructive techniques. This book is intended for any professional that is interested in pursuing work that involves mobile forensics, and is designed around the outcomes of criminal investigations that involve mobile digital evidence. Author John Bair brings to life the techniques and concepts that can assist those in the private or corporate sector.

Mobile devices have always been very dynamic in nature. They have also become an integral part of our lives, and often times, a digital representation of where we are, who we communicate with and what we document around us. Because they constantly change features, allow user enabled security, and or encryption, those employed with extracting user data are often overwhelmed with the process. This book presents a complete guide to mobile device forensics, written in an easy to understand format.

Key Features

  • Provides users with the steps and methodology needed for mobile forensics acquisitions, from start to finish
  • Includes discussions on legal issues, SIM file systems, mobile networks, virtual networks and troubleshooting
  • Presents how to investigate using Attention Terminal Protocols, encoding/decoding, Protocol Delivery Unit (PDU), NAND and NOR memory, wear-leveling, garbage collection and SQlite databases
  • Contains complete coverage of Protocol Delivery Unit (PDU), Joint Test Action Group (JTAG) techniques, use of flasher and programming boxes and chip-off (destructive) techniques


Digital forensic professionals and analysts, information security professionals, researchers, and practitioners, legal professionals, law enforcement officers, as well as students in digital forensics criminal justice programs at university

Table of Contents

Part I:  Basic, Fundamental Concepts
1. Defining Cell Phone Forensics, Standards, Evidence Contamination and Faraday Methods
2. The Legal Process, Mobile Network Operators, Mobile Virtual Network Operators, Search Warrant Language
3. The Cellular Network
4. Subscriber Identity Module
5. Device Identification
6. Triaging Mobile Evidence
7. The Logical Exam
8. Troubleshooting Logical Exams
9. Manual Exams
10. Report Writing

Part II:  Intermediate Concepts
11. Physical Acquisitions
12. Physical Memory and Encoding
13. Date & Time Stamps
14. Physical Analyzer Decoding – Rebuilding Data and The Project Tree
15. Physical Analyzer – Data searching using the Find tab
16. Physical Analyzer – RegEx (GREP), SMS 7Bit (PDU), Pattern and Code Searching
17. Physical Analyzer – Open Advanced (Using Chains and Plug-ins)
18. Physical Analyzer – Watch List Editor and Malware Scanner
19. Application Data
20. Advanced Validation

Part III: Advanced Concepts
21. Android user enabled security: (Passwords and Gesture)
22. Non-destructive hardware and software solutions
23. JTAG (Joint Test Action Group)
24. JTAG specialized equipment
25. RIFF Box Overview
26. RIFF 2 Box Overview
27. Z3X (Easy JTAG) Box
28. Chip Removal Overview
29. BGA cleaning and reading
30. eMMC Reading and In-System Programming


No. of pages:
© Academic Press 2018
Academic Press
Paperback ISBN:

About the Author

John Bair

John Bair is currently employed as a detective with the Tacoma Police Department. He has been commissioned as a law enforcement officer since May 1989. During his assignment in the homicide unit he began specializing in Cell Phone Forensics.

In 2006 John created the current forensic lab that focuses on mobile evidence related to violent crimes. His case experience shortly thereafter gained the attention of Mobile Forensics Incorporated (MFI) where he was hired and spent several years serving as a contract instructor. MFI soon merged with AccessData to become the only training vendor for their mobile forensics core. This relationship fostered direct contact with engineers who assist in criminal cases which need anomalies and exploits addressed within their forensics products.

July 2013 he was hired as a contract instructor by Fox Valley Technical College to assist in training for the Department Of Justice - Amber Alert Program. His expertize with mobile forensics is being utilized to structure a digital evidence module for investigators responding to scenes where children had been abducted. The program promotes how to prevent mobile evidence contamination and how to triage live devices under exigent circumstances.

Within in Pierce County, he began a mobile forensics training program for Superior Court Prosecutors and Judicial Officers which is currently in its fourth year. The program stresses the technical origins of the warrant language, what to check for, validation of evidence and how to present this dynamic content in court.

In December 2013, Detective Bair gave a presentation to the University Of Washington Tacoma (UWT) Institute of Technology which provided an outline to merge digital solutions between the Tacoma Police Department and UWT. The relationship will focus on building a digital forensic lab that will be modeled after the Marshall University Forensic Science Center in West Virginia. The lab proposal also includes the ability to conduct advanced destructive forensics which will be a one of kind facility on the west coast. Based upon the proposal to create a combined lab, John created a mobile forensic course and began part time lecturing at UWT in April 2014. The course covers legal concepts, logical, physical searching methods and manual “carving”. John authored his own student and lab manuals for these courses. In March 2015, John started an intern program within the lab at the Tacoma Police which involved students from this program. In late August 2015, one of the interns was able to use advance python writing to assist with parsing over 3300 deleted messages in a homicide that took place earlier that year.

John Bair has instructed at various federal labs within the United States (Secret Service, ICE). He has presented on mobile evidence as a guest speaker at Paraben’s Innovative Conference, Washington State Association of Prosecuting Attorney’s (WAPA) Summit, and the Computer Technology Investigations Network Digital Forensics Conference. Recently he spoke at the 16th Annual Conference on Information Technology Education / 4th Annual Research in IT Conference in Chicago Illinois. These conferences are sponsored by the ACM Special Interest Group for Information Technology Education (SIGITE). John and two other professors from the University Of Washington – Tacoma (UWT) recently co-authored a paper regarding the current Mobile Forensic Program.

John has 26 certifications related to digital evidence. The following reflect the most significant related to mobile forensics: Mobile Forensics Certified Examiner (MFCE), Cellebrite Certified Physical Analyst (CCPA), AccessData Certified Examiner (ACE), Cellebrite Mobile Forensics Fundamentals (CMFF), AccessData Mobile Examiner (AME), and Cellebrite Certified Instructor (CCI).

Affiliations and Expertise

MFCE, CCME, CCPA, CCLO, AME, Lecturer - Digital Mobile Forensics, University of Washington (Tacoma)