The New Burn Phones Can Burn You in an Investigation

For anyone who has done mobile forensics for any length of time, you have likely come to had "burn phones". These inexpensive phones have been used for years by criminals because they are cheap and can easily be thrown away after being used for a short amount of time for nefarious purposes. These phones are typically broken into two categories the feature phone, and the smartphone. Both are still classified as burn phones. The largest problems with these types of phones are focused on the data connection that the manufacture has allowed with the device.

Let’s talk about feature phones that are burn phone category. These devices typically have been disabled to connect with any type of desktop system as part of the manufacturer design this is difficult for many examiners because it leaves you with no other choices than to take pictures of the screens associated with the data on the device. Tools such as Project-A-Phone can make this task easier, but in the end it is a long day in the lab to have to take pictures of the screens of any device.

The other type of device to deal with that is burn in nature is the smartphone device. These devices can range in operating system support, but the most popular is the Android OS. These devices can be processed in forensics rather successfully with a few changes in strategy.

First you need to make sure the device is enabled for connection to a PC through the debugging protocols in the device. These are typically found under development settings. Depending on the age of the device you might have to bring out the development settings by activating an Easter egg on the device.

Here is a great YouTube video that demonstrates this:

After that is activated on the device typically Windows will be able to see the device. However, that doesn’t mean that you always have it that easy. A lot of times the plan provider will have modified drivers for their burn phones. So for example a Samsung Phone from a primary telecom provider will not work with the same drivers as a Samsung phone for a burn phone provider. You cannot have both drivers installed at the same time so you will need to uninstall the default primary drivers. Then go to the burn phone provider’s site and download the specific drivers for your device. In our lab we maintain a separate machine to only work on burn phones that we do not do the default driver installs so the machine is only getting the specific ones from the burn providers.

Once drivers are in place you are good to go in processing the device like any other Android OS phone.