Windows Phone 8.x is one of the most challenging smartphone operating systems in a forensics context. Common acquisition methods are not fully supported and only a few available forensic tools can perform partial logical acquisitions from Windows Phone devices.
Most of the commercial tools offer only very limited data acquisition or only over-the-air (cloud) acquisition, as we will see in the following sections. As most forensic examiners rely on forensic tools, facing a Windows Phone 8.x device remains a relatively big deal, especially when some tools list some devices as supported even if that's not the case. The Computer Forensic Tool Testing (CFTT) program of the National Institute of Standards and Technology publicly reports test results for mobile device acquisition tools (http://www.cftt.nist.gov/mobile_devices.htm), and almost all tools fail when acquiring data from Windows-based devices. Phone Forensics Express v2.1.2.2761 was not able to connect...