Forensic Examination And Imaging Of Password Protected Moveable Media Cards

Over the years there has been an ever increasing demand for more storage capacity and portability of electronic devices. History has witnessed the change in storage media technology from the floppy disk (1.44 Mb) to blue ray disc (25,000 Mb). But the greatest change of all revolutions in storage media facility was the introduction of the pen drive and the Memory cards. These memory cards are manufactured in various dimensions and specific technical aspects. At present, in open market more than 20 types of media cards are available[1-3]. These media cards provide users with the ease of portability and compatibility with numerous digital devices. Memory card can be used as external memory in a mobile phone as well as in a digital camera. The memory card can also be inserted in a memory card reader that can transfer the digital data captured from an electronic device to a computer. As such devices are so commonly in use, they are frequently encountered in many crimes as digital evidences having digital data in the form of digital pictures, messages, phone book, or even higher documents such as Microsoft office files. Retrieving data from such media card can be of major significance in providing clues to solve a crime. Abstract In digital world memory cards are an extension to user’s ability for storing, transferring and sharing data. Many digital devices available in the open market are designed to support the requirement of adding extra memory in the form of memory cards. With increasing use of such types of data storage devices their value as a source of digital evidence cannot be ignored. Multimedia memory cards may be recovered from devices such as mobile phone, digital cameras, and PDA’s. Password protection to the storage devices can be a big challenge to forensic examiners. In this paper an attempt has been made to provide solutions to digital forensic examiners in handling cases where memory cards are protected with a secrete password. The suggested procedure allows the examiner to remove the password and to image the memory card for further analysis.