DOI: 10.36347/sjet.2017.v05i11.007

Pages: 644-654

Nowadays, mobile devices are considered as an important necessity in our daily lives. Mobile devices can keep us connecting with family, friends, colleagues and so on. Moreover, combining with the sprung up social networking sites, lots of people have permanently altered their way of living habits. For example, more and more new mobile devices have successfully launched in the market, people in the world can easily contact with anyone everywhere at any time. However, there are some problems we should concern. Thanks to the new technology and cyber worlds are prosperous, the mobile phones and social networking sites have become a tool or medium for perpetrators to commit a crime in recent years. As a result, the investigators should collect important evidences from all the digital devices at the crime scene, such as computer, mobile phone, tablet and so forth. In this paper, we focus on the mobile forensics of Dcard application running on the mobile phone. In the experiment, we strive to search the digital evidence that user has been done on the mobile phone. We adopt “dd” instruction to create an image file for the physical memory. The physical memory is also called non-volatile memory. The data stored in the non-volatile memory would not be vanished when the power is cutting off. Thereafter, we make use of authoritative computer forensic tools which is called FTK Imager to analyze these significant evidences and the correlation between them in detail. In addition, we also adopt SQLite editor to examine and analyze the database on the mobile phone. The analysis of experiment was performed with the aim of determining what information can be found on the device. We find that which behavior of suspect will leave what kind of evidences in the mobile phone. These findings could be an important reference for law enforcement agency to investigate a cybercrime.