Wireless Forensic Analysis Tools for Use in the Electronic Evidence Collection Process

This paper discusses the need for both a series of electronic tools and procedural changes to the evidence collection process to accommodate the possibilities of wireless technologies. 802.11-based wireless technologies in particular pose an issue to the collection of electronic evidence, as devices that appear isolated may be tirelessly accessed during the collection phase, leading to after-seizure communications and a tampering of evidence in custody. Whilst forensic acquisition and analysis procedural guides are yet to discuss the acquisition of wireless devices, one of the core issues in collecting wireless devices is that there is no indication for the number or type of devices connected to a wireless network, should one exist in an area of interest. It is proposed that a series of forensic software tools be developed to aid in the detection, analysis and control of wireless networks that are in the process of being seized for forensic analysis. Through control of the wireless medium, information regarding connected devices may be gathered and methods to prevent communication between devices during and after evidence seizure are also examined