Windows Phones are becoming more widely used, and they may be encountered during forensic investigations. These devices are the most affordable on the market, so understanding how to acquire, analyze, and decode data from Windows Phones is important. Locating and interpreting digital evidence present on these devices requires a specialized knowledge of the Windows Phone operating system, and may not always be possible. Commercial forensic and open source tools provide limited support for acquiring user data from Windows devices. As Windows Phones do not occupy much of the mobile market space, most forensic practitioners are unfamiliar with the data formats, embedded databases used, and other artifacts that exist on the device. This chapter provides an overview of Windows Phone forensics, describing various methods of acquiring and examining data on Windows mobile devices.

In this chapter, we will cover the following topics: