Acquiring data from Windows Phone devices is challenging as they are secure and commercial forensic tools and open source methods do not provide easy solutions for forensic examiners. Multiple tools, chip-off, JTAG, and the methods defined in this book are some of the methods that provide access to user data on Windows Phone devices. Often, you will find that Windows Phone devices require multiple extraction methods to acquire accessible data. The biggest challenge is getting access to the device to acquire the data. Once the data is available, all the extracted information can be analyzed by the examiner. UFED Physical Analyzer and Oxygen Detective both accept JTAG and chip-off extractions for analysis.

Again, the device must not contain a passcode. It must be unlocked (jailbroken or rooted) to use non-commercial methods, and it may be modified by the examiner in order to extract the data using the methods defined in this chapter. While some may challenge us and say that these methods...