Third-party application burner phone analysis

Abstract

In today’s day and age, how people communicate is changing. Communication is often done using cell phones, specifically among users through multiple third-party applications. Although the options available to communicate are endless, they are also becoming a very dangerous tool. A third-party communication application is an application that is downloaded by a user to communicate with friends and family or socialize, separate from the mobile device text messaging. However, third-party applications are often used in criminal activities. Users’ need for privacy also pushes manufacturers to improve and impose strong security features in their software. These improvements make forensic examinations and recovery of such data on mobile devices more difficult. This study explores the recovery of data from disposable numbers offered by the Burner application. The mobile devices utilized in the study differentiate in operating systems to compare data recovered in an Android operating system and an iOS operating system. Within the Burner Application, three lines will be used to exchange messages, photos, and videos. Data extraction and parsing will be conducted with Cellebrite UFED 4PC version 7.73.0.68 and Cellebrite Physical Analyzer Inseyets version 10.5.0.1016. The research demonstrated that the different operating systems contribute to how much data is recovered. In this study, the amount of data recovered from the Apple iPhone 15 Plus, an iOS device associated with the Burner application, was more significant than the Samsung Galaxy S23 Ultra, Android operating system. Future research should utilize various Android devices as they differ based on manufacture and service provider. Data associated with the Burner application is recoverable depending on the operating system. Using different mobile devices forensic tools could also yield different results. This research applies methods for recovering disappearing messages to recover digital artifacts created by Burner’s disposable number feature, an area not previously studied or published.