dissertation

of the PUK 1 from the service provider. Also, the SIM only has limitedstorage for a small, fixed number of messages, so other messages would haveto be retrieved from the phone. There is therefore a point in performinganti-forensics on these items on the phone. Furthermore, the difference inback-end data storage between the contact list and these SIM data itemsshould provide a test of the generality of the method.4.2 Limitations4.2.1 Triggers for anti-forensic behaviourThe anti-forensics system needs to be able to distinguish between a requestfor data made by the legitimate user and one made for the purposes of forensicexamination, in order to determine which set of data to return. This is, ofcourse, impossible in the general case. However, we can make assumptionsabout how the forensic examination is carried out, and base the trigger onthese assumptions. Should this prove inadequate, new trigger mechanismscan be designed from the observed behaviour of forensic investigators.Based on the recommendations in the ACPO Good Practice Guide forComputer-Based Electronic Evidence [53], an examination can be assumedto be carried out in the following steps:1. Seizure.2. (Optional) Connection to a portable power supply for transport to theforensics lab.3. Network cut-off, using e.g. a Faraday cage.4. Transport to a forensics lab.5. Enabling of debug mode (required for the analysis system to be ableto upload its application to the phone).1 PIN Unlock Key or Personal Unlock Key, a code which can be used to reset the SIMPIN code20