To change or not to change: That is the question

Manual Analysis Phase for (PIFPM): Platform Independent Forensics Process Model for Smartphones

“…Given these results, the Preliminary Toolset of PIFPM can be designed with respect to the amount of change that takes place within each category. To assist in this effort, the average percent of change by category is computed in Table 5 [5,9].…”

“…Both the HTC Aria and the Nokia 5230 have categories that contain no results and both therefore show four of the six categories in their order of examination. Contact, call, browser, and SMS is the order in which the HTC Aria should be examined while the Nokia 5230 should be examined as follows: SMS or MMS, picture, and contact [5,9].…”

“…If there are several categories in Experiment 2 that result in the same average percentage of content change, Experiment 1 will take precedence as well. The rule of thumb is that the more files available for comparison in Experiment 2, the stronger the results [5,9]. The categorical examination order of each smartphone is given in Table 6 [5,9].…”

“…This number is then divided by 100. "Num of Diff" is the number of differences from test state 1 to state 2 and "Cat%∆" is the number that is categorically different [9].…”

“…RIM Blackberry 8703e, Blackberry 7103, Blackberry 8530, and the Symbian Nokia Nuron already performed in Experiment 2, and the Apple iPhone, HTC Aria, and HTC TouchPro 6850 will perform in this experiment. To assist with folders that change in content, the researcher has deign a lookup tables with unique IDs that tells the status from test state 1 to test state 2 in Table 1 [5][6][7][8][9]. …”