Paraben Device Seizure Version 4.3 Evaluation Report

• NCJ Number: 239588
• Date Published: July 2012
• Length: 19 pages
• Grant Number(s): 2010-FD-CX-K001
• Agencies: NIJ-Sponsored
• Publication Type: Test/Measurement
• Award: Criminal Justice Electronic Crime Technology Center of Excellence

Annotation

This report presents the features and manufacturer claims for the Paraben Device Seizure Version 4.3, along with the results of its evaluation and testing by the National Institute of Justice's Electronic Crime Technology Center of Excellence (NIJ ECTCOE).

Abstract

Paraben states that its Device Seizure can acquire and analyze data from over 4,000 mobile phones, PDAs and GPS devices. Device Seizure is a software platform that installs onto a computer work-station and includes a driver pack designed to maintain forensic integrity of device acquisitions. Device Seizure also includes a toolbox of cables and hardware for connecting devices to the work-station. Device Seizure is designed to assist State and local law enforcement agencies in the acquisition of and reporting on logical and physical examinations of mobile devices. The evaluation and testing concludes that Paraben's Device Seizure does a good job of reporting extracted information to the user in a readable form; however, deleted information will likely not be recovered with a logical extraction. Physical extractions, if supported for a particular phone, may recover deleted data. The testing found that the list of manufacturer and phone types given in the Data Acquisition wizard does not clearly identify which phone models are supported by the Device Seizure. It is also unclear as to which features of the phone can be extracted until the extraction is actually attempted and completed. In addition, during testing, some phones could not recover data due to the lack of a SIM card. It is likely that this shortcoming could be overcome by creating a cloned SIM card for examination. Testing results are presented for each device examined with the Device Seizure. The test-bed configuration is described.