Windows Phone Forensics - Practical Mobile Forensics - page 350

Extracting the data
On an unlocked device (again, similar to a jailbroken iOS device), it is possible to run an
app that can extract the user data present in the phone. The app TouchXperience , which
comes along with the Windows Mobile Device Manager ( WPDM ), can be used for this
purpose. Windows Mobile Device Manager is the management software for Windows
Phone 7. The client app TouchXperience extracts data such as the file system from the mo-
bile device, and WPDM retrieves this data and converts it into a human readable graphical
format. The following are the steps which will help a forensic examiner extract user data
present on an unlocked Windows Phone device:
1. Download Windows Phone SDK 7.1 and the Zune software on the forensic work-
station and install it ( http://www.microsoft.com/en-us/download/de-
tails.aspx?id=27570 ).
2. Download the Windows Phone Device Manager on the workstation, and launch
WPDeviceManager.exe ( http://touchxperience.com/windows-phone-device-
manager/ ) .
3. Connect the device to the workstation, and it should be detected automatically. If it
is not detected, make sure a passcode is not set on the device. If it is, this process
may fail if the passcode is unknown.
4. Windows Phone Device Manager will automatically install the TouchXperience
app when the phone is connected for the first time. Make sure you set what the
software is allowed to do on the device (that is, make sure not to change the user
data, not update date/time settings, or anything else that will modify the user data).
Make sure to document that TouchXperience was installed in order to extract data
from the Windows Phone as standard forensic methods provide little support for
these devices.
5. Thereafter, the following screen is presented, which provides access to a vast
amount of files present on the device: