U.S. Department of Justice 

Office of Justice Programs 

National Institute of Justice 

Special RepoRt

Test Results for Mobile Device Acquisition Tool: 

Device Seizure 4.0 

NOV. 2010 

Office of Justice Programs 

Innovation • Partnerships • Safer Neighborhoods 

www.ojp.usdoj.gov

www.ojp.usdoj.gov/nij 
 

 

 

 

U.S. Department of Justice 

Office of Justice Programs 

810 Seventh Street N.W. 

Washington, DC 20531 

Eric H. Holder, Jr. 

Attorney General 

Laurie O. Robinson 

Assistant Attorney General 

John H. Laub 

Director, National Institute of Justice 

This and other publications and products of the National Institute 

of Justice can be found at: 

National Institute of Justice 

www.ojp.usdoj.gov/nij 

Office of Justice Programs 

Innovation • Partnerships • Safer Neighborhoods 

www.ojp.usdoj.gov 
 

 

NOV. 2010 

Test Results for Mobile Device Acquisition Tool: 

Device Seizure 4.0 

NCJ 232230 
 

 

 

 

 

 

John H. Laub 

Director, National Institute of Justice 

This report was prepared for the National Institute of Justice, U.S. Department of Justice, by 

the Office of Law Enforcement Standards of the National Institute of Standards and Technology 

under Interagency Agreement 2003–IJ–R–029. 

The National Institute of Justice is a component of the Office of Justice Programs, which 

also includes the Bureau of Justice Assistance, the Bureau of Justice Statistics, the Office of 

Juvenile Justice and Delinquency Prevention, and the Office for Victims of Crime. 
November 2010 

Test Results for Mobile Device Acquisition Tool: 

Device Seizure 4.0 

November 2010 i Results of Device Seizure 4.0 
Contents 

Introduction..................................................................................................................................... 1
 

How to Read This Report ............................................................................................................... 1
 

1 Results Summary ...................................................................................................................... 3
 

2 Test Case Selection ................................................................................................................... 4
 

3 Results by Test Assertion........................................................................................................ 14
 

3.1 Device connectivity ......................................................................................................... 45
 

3.2 Acquisition disruption...................................................................................................... 45
 

3.3 Data acquisition review.................................................................................................... 45
 

3.4 Acquisition of subscriber related information ................................................................. 46
 

3.5 Acquisition of PIM related data....................................................................................... 46
 

3.6 Acquisition of call log data / time stamp data .................................................................. 46
 

3.7 Acquisition of text message data ..................................................................................... 46
 

3.8 Acquisition of MMS related data..................................................................................... 46
 

3.9 Acquisition of stand–alone data files ............................................................................... 46
 

3.10 Acquisition of application related data .......................................................................... 46
 

3.11 Acquisition of Internet related data................................................................................ 46
 

3.12 Report generation........................................................................................................... 46
 

3.13 Acquisition of password protected SIM ........................................................................ 46
 

3.14 Physical acquisition ....................................................................................................... 47
 

3.15 Acquisition of non–ASCII data ..................................................................................... 47
 

4 Testing Environment ............................................................................................................... 47
 

4.1 Test Computers ................................................................................................................ 47
 

4.2 Mobile Devices ................................................................................................................ 47
 

4.3 Internal Memory Data Objects......................................................................................... 48
 

4.4 Subscriber Identity Module Data Objects........................................................................ 49
 

5 Test Results............................................................................................................................. 49
 

5.1 Test Results Report Key .................................................................................................. 50
 

5.2 Test Details ...................................................................................................................... 50
 

5.2.1 SPT–01 (iPhone 3Gs) ............................................................................................... 50
 

5.2.2 SPT–02 (iPhone 3Gs) ............................................................................................... 52
 

5.2.3 SPT–03 (iPhone 3Gs) ............................................................................................... 53
 

5.2.4 SPT–04 (iPhone 3Gs) ............................................................................................... 54
 

5.2.5 SPT–05 (iPhone 3Gs) ............................................................................................... 55
 

5.2.6 SPT–06 (iPhone 3Gs) ............................................................................................... 56
 

5.2.7 SPT–07 (iPhone 3Gs) ............................................................................................... 58
 

5.2.8 SPT–08 (iPhone 3Gs) ............................................................................................... 59
 

5.2.9 SPT–09 (iPhone 3Gs) ............................................................................................... 60
 

5.2.10 SPT–10 (iPhone 3Gs) ............................................................................................. 61
 

5.2.11 SPT–11 (iPhone 3Gs) ............................................................................................. 62
 

5.2.12 SPT–12 (iPhone 3Gs) ............................................................................................. 63
 

5.2.13 SPT–13 (iPhone 3Gs) ............................................................................................. 64
 

5.2.14 SPT–14 (iPhone 3Gs) ............................................................................................. 65
 

5.2.15 SPT–15 (iPhone 3Gs) ............................................................................................. 66
 

November 2010 ii Results of Device Seizure 4.0 
5.2.16 SPT–16 (iPhone 3Gs) ............................................................................................. 67
 

5.2.17 SPT–17 (iPhone 3Gs) ............................................................................................. 68
 

5.2.18 SPT–18 (iPhone 3Gs) ............................................................................................. 69
 

5.2.19 SPT–19 (iPhone 3Gs) ............................................................................................. 70
 

5.2.20 SPT–20 (iPhone 3Gs) ............................................................................................. 71
 

5.2.21 SPT–21 (iPhone 3Gs) ............................................................................................. 72
 

5.2.22 SPT–22 (iPhone 3Gs) ............................................................................................. 73
 

5.2.23 SPT–23 (iPhone 3Gs) ............................................................................................. 74
 

5.2.24 SPT–24 (iPhone 3Gs) ............................................................................................. 75
 

5.2.25 SPT–25 (iPhone 3Gs) ............................................................................................. 76
 

5.2.26 SPT–26 (iPhone 3Gs) ............................................................................................. 77
 

5.2.27 SPT–27 (iPhone 3Gs) ............................................................................................. 78
 

5.2.28 SPT–28 (iPhone 3Gs) ............................................................................................. 79
 

5.2.29 SPT–29 (iPhone 3Gs) ............................................................................................. 80
 

5.2.30 SPT–30 (iPhone 3Gs) ............................................................................................. 81
 

5.2.31 SPT–33 (iPhone 3Gs) ............................................................................................. 82
 

5.2.32 SPT–34 (iPhone 3Gs) ............................................................................................. 83
 

5.2.33 SPT–38 (iPhone 3Gs) ............................................................................................. 84
 

5.2.34 SPT–39 (iPhone 3Gs) ............................................................................................. 85
 

5.2.35 SPT–40 (iPhone 3Gs) ............................................................................................. 86
 

5.2.36 SPT–01 (Blackberry Bold 9700) ............................................................................ 87
 

5.2.37 SPT–02 (Blackberry Bold 9700) ............................................................................ 88
 

5.2.38 SPT–03 (Blackberry Bold 9700) ............................................................................ 89
 

5.2.39 SPT–04 (Blackberry Bold 9700) ............................................................................ 90
 

5.2.40 SPT–05 (Blackberry Bold 9700) ............................................................................ 91
 

5.2.41 SPT–06 (Blackberry Bold 9700) ............................................................................ 92
 

5.2.42 SPT–07 (Blackberry Bold 9700) ............................................................................ 94
 

5.2.43 SPT–08 (Blackberry Bold 9700) ............................................................................ 95
 

5.2.44 SPT–09 (Blackberry Bold 9700) ............................................................................ 96
 

5.2.45 SPT–10 (Blackberry Bold 9700) ............................................................................ 97
 

5.2.46 SPT–11 (Blackberry Bold 9700) ............................................................................ 98
 

5.2.47 SPT–12 (Blackberry Bold 9700) ............................................................................ 99
 

5.2.48 SPT–13 (Blackberry Bold 9700) .......................................................................... 100
 

5.2.49 SPT–14 (Blackberry Bold 9700) .......................................................................... 101
 

5.2.50 SPT–15 (Blackberry Bold 9700) .......................................................................... 102
 

5.2.51 SPT–16 (Blackberry Bold 9700) .......................................................................... 103
 

5.2.52 SPT–17 (Blackberry Bold 9700) .......................................................................... 104
 

5.2.53 SPT–18 (Blackberry Bold 9700) .......................................................................... 105
 

5.2.54 SPT–19 (Blackberry Bold 9700) .......................................................................... 106
 

5.2.55 SPT–20 (Blackberry Bold 9700) .......................................................................... 107
 

5.2.56 SPT–21 (Blackberry Bold 9700) .......................................................................... 108
 

5.2.57 SPT–22 (Blackberry Bold 9700) .......................................................................... 109
 

5.2.58 SPT–23 (Blackberry Bold 9700) .......................................................................... 110
 

5.2.59 SPT–24 (Blackberry Bold 9700) .......................................................................... 111
 

5.2.60 SPT–25 (Blackberry Bold 9700) .......................................................................... 112
 

5.2.61 SPT–26 (Blackberry Bold 9700) .......................................................................... 113
 

November 2010 iii Results of Device Seizure 4.0 
5.2.62 SPT–27 (Blackberry Bold 9700) .......................................................................... 114
 

5.2.63 SPT–28 (Blackberry Bold 9700) .......................................................................... 115
 

5.2.64 SPT–29 (Blackberry Bold 9700) .......................................................................... 116
 

5.2.65 SPT–30 (Blackberry Bold 9700) .......................................................................... 117
 

5.2.66 SPT–33 (Blackberry Bold 9700) .......................................................................... 118
 

5.2.67 SPT–34 (Blackberry Bold 9700) .......................................................................... 119
 

5.2.68 SPT–38 (Blackberry Bold 9700) .......................................................................... 120
 

5.2.69 SPT–39 (Blackberry Bold 9700) .......................................................................... 121
 

5.2.70 SPT–01 (Nokia 6790) .......................................................................................... 122
 

5.2.71 SPT–14 (Nokia 6790) ........................................................................................... 123
 

5.2.72 SPT–15 (Nokia 6790) ........................................................................................... 124
 

5.2.73 SPT–16 (Nokia 6790) ........................................................................................... 125
 

5.2.74 SPT–17 (Nokia 6790) ........................................................................................... 126
 

5.2.75 SPT–18 (Nokia 6790) ........................................................................................... 127
 

5.2.76 SPT–19 (Nokia 6790) ........................................................................................... 128
 

5.2.77 SPT–20 (Nokia 6790) ........................................................................................... 129
 

5.2.78 SPT–21 (Nokia 6790) ........................................................................................... 130
 

5.2.79 SPT–22 (Nokia 6790) ........................................................................................... 131
 

5.2.80 SPT–23 (Nokia 6790) ........................................................................................... 132
 

5.2.81 SPT–26 (Nokia 6790) ........................................................................................... 133
 

5.2.82 SPT–27 (Nokia 6790) ........................................................................................... 134
 

5.2.83 SPT–28 (Nokia 6790) ........................................................................................... 135
 

5.2.84 SPT–30 (Nokia 6790) ........................................................................................... 136
 

5.2.85 SPT–34 (Nokia 6790) ........................................................................................... 137
 

5.2.86 SPT–39 (Nokia 6790) ........................................................................................... 138
 

5.2.87 SPT–01 (HTC Touch Pro 2) ................................................................................. 139
 

5.2.88 SPT–02 (HTC Touch Pro 2) ................................................................................. 140
 

5.2.89 SPT–03 (HTC Touch Pro 2) ................................................................................. 141
 

5.2.90 SPT–04 (HTC Touch Pro 2) ................................................................................. 142
 

5.2.91 SPT–05 (HTC Touch Pro 2) ................................................................................. 143
 

5.2.92 SPT–06 (HTC Touch Pro 2) ................................................................................. 144
 

5.2.93 SPT–07 (HTC Touch Pro 2) ................................................................................. 146
 

5.2.94 SPT–08 (HTC Touch Pro 2) ................................................................................. 147
 

5.2.95 SPT–09 (HTC Touch Pro 2) ................................................................................. 148
 

5.2.96 SPT–10 (HTC Touch Pro 2) ................................................................................. 149
 

5.2.97 SPT–11 (HTC Touch Pro 2) ................................................................................. 150
 

5.2.98 SPT–12 (HTC Touch Pro 2) ................................................................................. 151
 

5.2.99 SPT–13 (HTC Touch Pro 2) ................................................................................. 152
 

5.2.100 SPT–24 (HTC Touch Pro 2) ............................................................................... 153
 

5.2.101 SPT–25 (HTC Touch Pro 2) ............................................................................... 154
 

5.2.102 SPT–29 (HTC Touch Pro 2) ............................................................................... 155
 

5.2.103 SPT–31 (HTC Touch Pro 2) ............................................................................... 156
 

5.2.104 SPT–33 (HTC Touch Pro 2) ............................................................................... 157
 

5.2.105 SPT–38 (HTC Touch Pro 2) ............................................................................... 158
 

5.2.106 SPT–01 (Blackberry 9630) ................................................................................. 159
 

5.2.107 SPT–02 (Blackberry 9630) ................................................................................. 160
 

November 2010 iv Results of Device Seizure 4.0 
5.2.108 SPT–03 (Blackberry 9630) ................................................................................. 161
 

5.2.109 SPT–04 (Blackberry 9630) ................................................................................. 162
 

5.2.110 SPT–05 (Blackberry 9630) ................................................................................. 163
 

5.2.111 SPT–06 (Blackberry 9630) ................................................................................. 164
 

5.2.112 SPT–07 (Blackberry 9630) ................................................................................. 166
 

5.2.113 SPT–08 (Blackberry 9630) ................................................................................. 167
 

5.2.114 SPT–09 (Blackberry 9630) ................................................................................. 168
 

5.2.115 SPT–10 (Blackberry 9630) ................................................................................. 169
 

5.2.116 SPT–11 (Blackberry 9630) ................................................................................. 170
 

5.2.117 SPT–12 (Blackberry 9630) ................................................................................. 171
 

5.2.118 SPT–13 (Blackberry 9630) ................................................................................. 172
 

5.2.119 SPT–24 (Blackberry 9630) ................................................................................. 173
 

5.2.120 SPT–25 (Blackberry 9630) ................................................................................. 174
 

5.2.121 SPT–29 (Blackberry 9630) ................................................................................. 175
 

5.2.122 SPT–33 (Blackberry 9630) ................................................................................. 176
 

5.2.123 SPT–38 (Blackberry 9630) ................................................................................. 177
 

5.2.124 SPT–01 (Palm pixi)............................................................................................. 178
 

5.2.125 SPT–02 (Palm pixi)............................................................................................. 179
 

5.2.126 SPT–03 (Palm pixi)............................................................................................. 180
 

5.2.127 SPT–04 (Palm pixi)............................................................................................. 181
 

5.2.128 SPT–05 (Palm pixi)............................................................................................. 182
 

5.2.129 SPT–06 (Palm pixi)............................................................................................. 183
 

5.2.130 SPT–07 (Palm pixi)............................................................................................. 185
 

5.2.131 SPT–08 (Palm pixi)............................................................................................. 186
 

5.2.132 SPT–09 (Palm pixi)............................................................................................. 187
 

5.2.133 SPT–10 (Palm pixi)............................................................................................. 188
 

5.2.134 SPT–11 (Palm pixi)............................................................................................. 189
 

5.2.135 SPT–12 (Palm pixi)............................................................................................. 190
 

5.2.136 SPT–13 (Palm pixi)............................................................................................. 191
 

5.2.137 SPT–24 (Palm pixi)............................................................................................. 192
 

5.2.138 SPT–25 (Palm pixi)............................................................................................. 193
 

5.2.139 SPT–29 (Palm pixi)............................................................................................. 194
 

5.2.140 SPT–33 (Palm pixi)............................................................................................. 195
 

5.2.141 SPT–38 (Palm pixi)............................................................................................. 196
 

November 2010 v Results of Device Seizure 4.0 
Introduction 

The Computer Forensics Tool Testing (CFTT) program is a joint project of the National 

Institute of Justice (NIJ), the research and development organization of the U.S. 

Department of Justice (DOJ), and the National Institute of Standards and Technology’s 

(NIST’s) Office of Law Enforcement Standards (OLES) and Information Technology 

Laboratory. CFTT is supported by other organizations, including the Federal Bureau of 

Investigation, the U.S. Department of Defense Cyber Crime Center, U.S. Internal 

Revenue Service Criminal Investigation Division Electronic Crimes Program, and the 

U.S. Department of Homeland Security’s Bureau of Immigration and Customs 

Enforcement, U.S. Customs and Border Protection and U.S. Secret Service. The objective 

of the CFTT program is to provide measurable assurance to practitioners, researchers, 

and other applicable users that the tools used in computer forensics investigations provide 

accurate results. Accomplishing this requires the development of specifications and test 

methods for computer forensics tools and subsequent testing of specific tools against 

those specifications. 

Test results provide the information necessary for developers to improve tools, users to 

make informed choices, and the legal community and others to understand the tools’ 

capabilities. This approach to testing computer forensic tools is based on well–recognized 

methodologies for conformance and quality testing. The specifications and test methods 

posted on the CFTT Web site (http://www.cftt.nist.gov/) are available for review and 

comment by the computer forensics community. 

This document reports the results from testing Device Seizure, version 4.0, against the 

Smart Phone Tool Test Assertions and Test Plan, available at the CFTT Web site 

(www.cftt.nist.gov/mobile_devices.htm). 

Test results from other software packages and the CFTT tool methodology can be found 

on NIJ’s computer forensics tool testing Web 

page, http://www.ojp.usdoj.gov/nij/topics/technology/electronic–crime/cftt.htm.

How to Read This Report 

This report is divided into five sections. The first section is a summary of the results from 

the test runs. This section is sufficient for most readers to assess the suitability of the tool 

for the intended use. The remaining sections of the report describe how the tests were 

conducted and provide documentation of test case run details that support the report 

summary. Sections 2 and 3 provide justification for the selection of test cases and 

assertions from the set of possible cases defined in the test plan for smart phone forensic 

tools. The test cases are selected, in general, based on features offered by the tool. 

Section 4 lists the hardware and software used to run the test cases. Section 5 contains a 
description of each test case, test assertions used in the test case, the expected result and 

the actual result. 

November 2010 2 of 196 Results of Device Seizure 4.0 
 

 

 

 

Test Results for Mobile Device Data Acquisition Tool

Tool Tested: Paraben Device Seizure 

Version: 4.0 

Run Environment: Windows XP Service Pack 2 

Supplier: Paraben Corporation 

Address: PO Box 970483, Orem UT, 84097–0483 

Tel: 801–796–0944 

Fax: 801–796–0610 

WWW: http://www.paraben.com 

1 Results Summary 

Except for the following test cases: SPT–01 (Nokia 6790), SPT–03 (iPhone 3Gs, 

Blackberry Bold 9700, Blackberry 9630), SPT–04 (HTC Touch Pro 2), SPT–05 

(Blackberry 9630, Palm pixi), SPT–06 (iPhone 3Gs, Blackberry Bold 9700, HTC Touch 

Pro 2, Blackberry 9630, Palm pixi), SPT–07 (iPhone 3Gs, Palm pixi), SPT–08 (HTC 

Touch Pro 2), SPT–09 (Blackberry Bold 9700, HTC Touch Pro 2, Blackberry 9630, Palm 

pixi), SPT–10 (Blackberry Bold 9700, HTC Touch Pro 2, Blackberry 9630), SPT–11 

(iPhone 3Gs, Blackberry Bold 9700, Blackberry 9630, Palm pixi), SPT–12 (Blackberry 

9630), SPT–24 (HTC Touch Pro 2), SPT–28 (iPhone 3Gs, Blackberry Bold 9700, Nokia 

6790), SPT–31 (HTC Touch Pro 2), SPT–33 (Blackberry 9630) the tested tool acquired 

all supported data objects completely and accurately from the selected test mobile devices 

(i.e., iPhone 3Gs, Blackberry Bold 9700, Nokia 6790, HTC Touch Pro 2, Blackberry 

9630, Samsung Moment, Palm pixi). The exceptions were the following: 

 Connectivity to the device was not successful. Test Case: SPT–01 (Nokia 6790) 

 Notification of device acquisition disruption was not successful. Test Case: SPT– 

03 (iPhone 3Gs, Blackberry Bold 9700, Blackberry 9630) 

 Data acquired from the mobile device is not viewable in the preview–pane. Test 

Case: SPT–04 (HTC Touch Pro 2) 

 Subscriber related data (MSISDN, IMEI) was not reported. Test Case: SPT–05 

(Blackberry 9630, Palm pixi) 

	 Graphics files associated with address book entries were not reported. Test Case: 

SPT–06 (iPhone 3Gs, Blackberry Bold 9700, HTC Touch Pro 2, Blackberry 9630, 

Palm pixi) 

	 Duration of call (i.e., seconds, minutes, hours) not specified. Test Case: SPT–07 

(iPhone 3Gs, Palm pixi) 

 Text messages were not acquired. Test Case: SPT–08 (HTC Touch Pro 2) 

 Acquisition of files associated with MMS messages (i.e., graphics, audio, video) 

were not reported. Test Case: SPT–09 (Blackberry Bold 9700, Blackberry 9630) 

 MMS Messages were not acquired. Test Case: SPT–09 (HTC Touch Pro 2, Palm 

pixi) 

November 2010 3 of 196 Results of Device Seizure 4.0 
 Acquisitions of stand–alone files (i.e., graphics, audio, video) were not acquired. 

Test Case: SPT–10 (Blackberry Bold 9700, HTC Touch Pro 2, Blackberry 9630) 

 Acquisition of application related data was not successful. Test Case: SPT–11 

(iPhone 3Gs, Blackberry Bold 9700, Blackberry 9630, Palm pixi) 

 Acquisition of Internet related data was not successful. Test Case: SPT–12 

(Blackberry 9630) 

 Report generation ended in errors. Test Case: SPT–24 (HTC Touch Pro 2) 

 Acquisition of a password–protected SIM was not successful. Test Case: SPT–28 

(iPhone 3Gs, Blackberry Bold 9700, Nokia 6790) 

 Physical acquisition was not successful; data was not decoded. Test Case: SPT–31 

(HTC Touch Pro 2) 

	 Address book entries containing Non–ASCII characters were not acquired. Text 

messages containing Non–ASCII characters were not reported in their native 

format (messages were reported as: ‘? ? ? ?’). Test Case: SPT–33 (Blackberry 

9630) 

2 Test Case Selection 

Test cases used to test mobile device acquisition tools are defined in Smart Phone Tool 

Test Assertions and Test Plan Version 1.0. To test a tool, test cases are selected from the 

Test Plan document based on the features offered by the tool. Not all test cases or test 

assertions are appropriate for all tools. There is a core set of base cases that are executed 

for every tool tested. Tool features guide the selection of additional test cases. If a given 

tool implements a given feature then the test cases linked to that feature are run. Tables 

(1a–1f) list the test cases available in Device Seizure. Tables (2a–2f) list the test cases not 

available in Device Seizure. 

Table 1a: Selected Test Cases (iPhone 3Gs) 

Supported Test Cases Cases Selected for Execution 

Base Cases SPT–01, SPT–02, SPT–03, SPT–04, 

SPT–05, SPT–06, SPT–07, SPT–08, 

SPT–09, SPT–10, SPT–11, SPT–12, 

SPT–13 

Acquire SIM memory over supported 

interfaces (e.g., PC/SC reader).

 SPT–14 

Attempt acquisition of a non–supported SIM. SPT–15 

Begin SIM acquisition and interrupt 

connectivity by interface disengagement. 

SPT–16 

Acquire SIM memory and review reported 

subscriber and equipment related information 

(i.e., SPN, ICCID, IMSI, MSISDN). 

SPT–17 

Acquire SIM memory and review reported 

Abbreviated Dialing Numbers (ADN). 

SPT–18 

Acquire SIM memory and review reported 

Last Numbers Dialed (LND). 

SPT–19 

November 2010 4 of 196 Results of Device Seizure 4.0 
Supported Test Cases Cases Selected for Execution 

Acquire SIM memory and review reported text 

messages (SMS, EMS). 

SPT–20 

Acquire SIM memory and review recoverable 

deleted text messages (SMS, EMS). 

SPT–21 

Acquire SIM memory and review reported 

location related data (i.e., LOCI, GPRSLOCI). 

SPT–22 

Acquire SIM memory by selecting a 

combination of supported data elements. 

SPT–23 

Acquire mobile device internal memory and 

review reported data via supported generated 

report formats.

 SPT–24 

Acquire mobile device internal memory and 

review reported data via the preview pane. 

SPT–25 

Acquire SIM memory and review reported 

data via supported generated report formats. 

SPT–26 

Acquire SIM memory and review reported 

data via the preview–pane. 

SPT–27 

Attempt acquisition of a password–protected 

SIM. 

SPT–28 

After a successful mobile device internal 

memory, alter the case file via third–party 

means and attempt to re–open the case. 

SPT–29 

After a successful SIM acquisition, alter the 

case file via third–party means and attempt to 

re–open the case. 

SPT–30 

Acquire mobile device internal memory and 

review data containing non–ASCII characters. 

SPT–33 

Acquire SIM memory and review data 

containing non–ASCII characters. 

SPT–34 

Acquire mobile device internal memory and 

review hash values for vendor supported data 

objects. 

SPT–38 

Acquire SIM memory and review hash values 

for vendor supported data objects. 

SPT–39 

Acquire mobile device internal memory and 

review data containing GPS longitude and 

latitude coordinates. 

SPT–40 

Table 2a: Omitted Test Cases (iPhone 3Gs) 

Unsupported Test Cases Cases 

omitted – not 

executed 

Perform a physical acquisition and review data output for readability. SPT–31 

Perform a physical acquisition and review reports for recoverable deleted 

data. 

SPT–32 

November 2010 5 of 196 Results of Device Seizure 4.0 
Unsupported Test Cases Cases 

omitted – not 

executed 

Begin acquisition on a PIN protected SIM to determine if the tool provides 

an accurate count of the remaining number of PIN attempts and if the PIN 

attempts are decremented when entering an incorrect value.

 SPT–35 

Begin acquisition on a SIM whose PIN attempts have been exhausted to 

determine if the tool provides an accurate count of the remaining number 

of PUK attempts and if the PUK attempts are decremented when entering 

an incorrect value.

 SPT–36 

Perform a stand–alone mobile device internal memory acquisition and 

review the status flags for text messages present on the SIM. 

SPT–37 

Table 1b: Selected Test Cases (BlackBerry Bold 9700) 

Supported Test Cases Cases Selected for Execution 

Base Cases SPT–01, SPT–02, SPT–03, SPT–04, 

SPT–05, SPT–06, SPT–07, SPT–08, 

SPT–09, SPT–10, SPT–11, SPT–12, 

SPT–13 

Acquire SIM memory over supported 

interfaces (e.g., PC/SC reader).

 SPT–14 

Attempt acquisition of a non–supported SIM. SPT–15 

Begin SIM acquisition and interrupt 

connectivity by interface disengagement. 

SPT–16 

Acquire SIM memory and review reported 

subscriber and equipment related information 

(i.e., SPN, ICCID, IMSI, MSISDN). 

SPT–17 

Acquire SIM memory and review reported 

Abbreviated Dialing Numbers (ADN). 

SPT–18 

Acquire SIM memory and review reported 

Last Numbers Dialed (LND). 

SPT–19 

Acquire SIM memory and review reported text 

messages (SMS, EMS). 

SPT–20 

Acquire SIM memory and review recoverable 

deleted text messages (SMS, EMS). 

SPT–21 

Acquire SIM memory and review reported 

location related data (i.e., LOCI, GPRSLOCI). 

SPT–22 

Acquire SIM memory by selecting a 

combination of supported data elements. 

SPT–23 

Acquire mobile device internal memory and 

review reported data via supported generated 

report formats.

 SPT–24 

Acquire mobile device internal memory and 

review reported data via the preview pane. 

SPT–25 

Acquire SIM memory and review reported 

data via supported generated report formats. 

SPT–26 

November 2010 6 of 196 Results of Device Seizure 4.0 
Supported Test Cases Cases Selected for Execution 

Acquire SIM memory and review reported 

data via the preview–pane. 

SPT–27 

Attempt acquisition of a password–protected 

SIM. 

SPT–28 

After a successful mobile device internal 

memory, alter the case file via third–party 

means and attempt to re–open the case. 

SPT–29 

After a successful SIM acquisition, alter the 

case file via third–party means and attempt to 

re–open the case. 

SPT–30 

Acquire mobile device internal memory and 

review data containing non–ASCII characters. 

SPT–33 

Acquire SIM memory and review data 

containing non–ASCII characters. 

SPT–34 

Acquire mobile device internal memory and 

review hash values for vendor supported data 

objects. 

SPT–38 

Acquire SIM memory and review hash values 

for vendor supported data objects. 

SPT–39 

Table 2b: Omitted Test Cases (BlackBerry Bold 9700) 

Unsupported Test Cases Cases 

omitted – not 

executed 

Perform a physical acquisition and review data output for readability. SPT–31 

Perform a physical acquisition and review reports for recoverable deleted 

data. 

SPT–32 

Begin acquisition on a PIN protected SIM to determine if the tool provides 

an accurate count of the remaining number of PIN attempts and if the PIN 

attempts are decremented when entering an incorrect value.

 SPT–35 

Begin acquisition on a SIM whose PIN attempts have been exhausted to 

determine if the tool provides an accurate count of the remaining number 

of PUK attempts and if the PUK attempts are decremented when entering 

an incorrect value.

 SPT–36 

Perform a stand–alone mobile device internal memory acquisition and 

review the status flags for text messages present on the SIM. 

SPT–37 

Acquire mobile device internal memory and review data containing GPS 

longitude and latitude coordinates. 

SPT–40 

Table 1c: Selected Test Cases (Nokia 6790) 

Supported Test Cases Cases Selected for 

Execution 

Base Cases SPT–01 

Acquire SIM memory over supported interfaces (e.g., PC/SC reader). SPT–14 

November 2010 7 of 196 Results of Device Seizure 4.0 
Supported Test Cases Cases Selected for 

Execution 

Attempt acquisition of a non–supported SIM. SPT–15 

Begin SIM acquisition and interrupt connectivity by interface 

disengagement. 

SPT–16 

Acquire SIM memory and review reported subscriber and equipment 

related information (i.e., SPN, ICCID, IMSI, MSISDN). 

SPT–17 

Acquire SIM memory and review reported Abbreviated Dialing 

Numbers (ADN). 

SPT–18 

Acquire SIM memory and review reported Last Numbers Dialed 

(LND). 

SPT–19 

Acquire SIM memory and review reported text messages (SMS, 

EMS). 

SPT–20 

Acquire SIM memory and review recoverable deleted text messages 

(SMS, EMS). 

SPT–21 

Acquire SIM memory and review reported location related data (i.e., 

LOCI, GPRSLOCI). 

SPT–22 

Acquire SIM memory by selecting a combination of supported data 

elements. 

SPT–23 

Acquire SIM memory and review reported data via supported 

generated report formats. 

SPT–26 

Acquire SIM memory and review reported data via the preview–pane. SPT–27 

Attempt acquisition of a password–protected SIM. SPT–28 

After a successful SIM acquisition, alter the case file via third–party 

means and attempt to re–open the case. 

SPT–30 

Acquire SIM memory and review data containing non–ASCII 

characters.

 SPT–34 

Acquire SIM memory and review hash values for vendor supported 

data objects. 

SPT–39 

Table 2c: Omitted Test Cases (Nokia 6790) 

Unsupported Test Cases Cases 

omitted – not 

executed 

Attempt internal memory acquisition of a non–supported mobile device. SPT–02 

Begin mobile device internal memory acquisition and interrupt 

connectivity by interface disengagement. 

SPT–03 

 Acquire mobile device internal memory and review reported data via the 

preview–pane or generated reports for readability. 

SPT–04 

Acquire mobile device internal memory and review reported subscriber 

and equipment related information (e.g., IMEI/MEID/ESN, MSISDN). 

SPT–05 

Acquire mobile device internal memory and review reported PIM related 

data. 

SPT–06 

 Acquire mobile device internal memory and review reported call logs. SPT–07 

 Acquire mobile device internal memory and review reported text 

messages. 

SPT–08 

November 2010 8 of 196 Results of Device Seizure 4.0 
Unsupported Test Cases Cases 

omitted – not 

executed 

 Acquire mobile device internal memory and review reported MMS multi– 

media related data (i.e., text, audio, graphics, video). 

SPT–09 

 Acquire mobile device internal memory and review reported stand–alone 

multi–media data (i.e., audio, graphics, video).

 SPT–10 

Acquire mobile device internal memory and review application related 

data (i.e., word documents, spreadsheet, presentation documents). 

SPT–11 

Acquire mobile device internal memory and review Internet related data 

(i.e., bookmarks, visited sites. 

SPT–12 

Acquire mobile device internal memory by selecting a combination of 

supported data elements. 

SPT–13 

 Acquire mobile device internal memory and review reported data via 

supported generated report formats. 

SPT–24 

Acquire mobile device internal memory and review reported data via the 

preview pane. 

SPT–25 

After a successful mobile device internal memory, alter the case file via 

third–party means and attempt to re–open the case. 

SPT–29 

Perform a physical acquisition and review data output for readability. SPT–31 

Perform a physical acquisition and review reports for recoverable deleted 

data. 

SPT–32 

Acquire mobile device internal memory and review data containing non– 

ASCII characters.

 SPT–33 

Begin acquisition on a PIN protected SIM to determine if the tool provides 

an accurate count of the remaining number of PIN attempts and if the PIN 

attempts are decremented when entering an incorrect value.

 SPT–35 

Begin acquisition on a SIM whose PIN attempts have been exhausted to 

determine if the tool provides an accurate count of the remaining number 

of PUK attempts and if the PUK attempts are decremented when entering 

an incorrect value.

 SPT–36 

Perform a stand–alone mobile device internal memory acquisition and 

review the status flags for text messages present on the SIM. 

SPT–37 

Acquire mobile device internal memory and review hash values for vendor 

supported data objects. 

SPT–38 

Acquire mobile device internal memory and review data containing GPS 

longitude and latitude coordinates. 

SPT–40 

Table 1d: Selected Test Cases (HTC Touch Pro 2) 

Supported Optional Feature Cases Selected for Execution 

Base Cases SPT–01, SPT–02, SPT–03, SPT–04, 

SPT–05, SPT–06, SPT–07, SPT–08, 

SPT–09, SPT–10, SPT–11, SPT–12, 

SPT–13 

Acquire mobile device internal memory and 

review reported data via supported generated 

SPT–24 

November 2010 9 of 196 Results of Device Seizure 4.0 
Supported Optional Feature Cases Selected for Execution 

report formats. 

Acquire mobile device internal memory and 

review reported data via the preview pane. 

SPT–25 

After a successful mobile device internal 

memory, alter the case file via third–party 

means and attempt to re–open the case. 

SPT–29 

Perform a physical acquisition and review 

data output for readability. 

SPT–31 

Acquire mobile device internal memory and 

review data containing non–ASCII 

characters.

 SPT–33 

Acquire mobile device internal memory and 

review hash values for vendor supported 

data objects. 

SPT–38 

Table 2d: Omitted Test Cases (HTC Touch Pro 2) 

Unsupported Test Cases Cases 

omitted – not 

executed 

Acquire SIM memory over supported interfaces (e.g., PC/SC reader). SPT–14 

Attempt acquisition of a non–supported SIM. SPT–15 

Begin SIM acquisition and interrupt connectivity by interface 

disengagement. 

SPT–16 

Acquire SIM memory and review reported subscriber and equipment 

related information (i.e., SPN, ICCID, IMSI, MSISDN). 

SPT–17 

Acquire SIM memory and review reported Abbreviated Dialing Numbers 

(ADN). 

SPT–18 

Acquire SIM memory and review reported Last Numbers Dialed (LND). SPT–19 

Acquire SIM memory and review reported text messages (SMS, EMS). SPT–20 

Acquire SIM memory and review recoverable deleted text messages 

(SMS, EMS). 

SPT–21 

Acquire SIM memory and review reported location related data (i.e., 

LOCI, GPRSLOCI). 

SPT–22 

Acquire SIM memory by selecting a combination of supported data 

elements. 

SPT–23 

Acquire SIM memory and review reported data via supported generated 

report formats.

 SPT–26 

Acquire SIM memory and review reported data via the preview–pane. SPT–27 

Attempt acquisition of a password–protected SIM. SPT–28 

After a successful SIM acquisition, alter the case file via third–party 

means and attempt to re–open the case. 

SPT–30 

Perform a physical acquisition and review reports for recoverable deleted 

data. 

SPT–32 

Acquire SIM memory and review data containing non–ASCII characters. SPT–34 

November 2010 10 of 196 Results of Device Seizure 4.0 
 

Unsupported Test Cases Cases 

omitted – not 

executed 

Begin acquisition on a PIN protected SIM to determine if the tool provides 

an accurate count of the remaining number of PIN attempts and if the PIN 

attempts are decremented when entering an incorrect value.

 SPT–35 

Begin acquisition on a SIM whose PIN attempts have been exhausted to 

determine if the tool provides an accurate count of the remaining number 

of PUK attempts and if the PUK attempts are decremented when entering 

an incorrect value.

 SPT–36 

Perform a stand–alone mobile device internal memory acquisition and 

review the status flags for text messages present on the SIM. 

SPT–37 

Acquire SIM memory and review hash values for vendor supported data 

objects. 

SPT–39 

Acquire mobile device internal memory and review data containing GPS 

longitude and latitude coordinates. 

SPT–40 

Table 1e: Selected Test Cases (Blackberry 9630) 

Supported Test Cases Cases Selected for Execution 

Base Cases SPT–01, SPT–02, SPT–03, SPT–04, 

SPT–05, SPT–06, SPT–07, SPT–08, 

SPT–09, SPT–10, SPT–11, SPT–12, 

SPT–13 

Acquire mobile device internal memory and 

review reported data via supported generated 

report formats.

 SPT–24 

Acquire mobile device internal memory and 

review reported data via the preview pane. 

SPT–25 

After a successful mobile device internal 

memory, alter the case file via third–party 

means and attempt to re–open the case. 

SPT–29 

Acquire mobile device internal memory and 

review data containing non–ASCII 

characters.

 SPT–33 

Acquire mobile device internal memory and 

review hash values for vendor supported 

data objects. 

SPT–38 

Table 2e: Omitted Test Cases (Blackberry 9630) 

Unsupported Test Cases Cases 

omitted – not 

executed 

Acquire SIM memory over supported interfaces (e.g., PC/SC reader). SPT–14 

Attempt acquisition of a non–supported SIM. SPT–15 

Begin SIM acquisition and interrupt connectivity by interface SPT–16 

November 2010 11 of 196 Results of Device Seizure 4.0 
Unsupported Test Cases Cases 

omitted – not 

executed 

disengagement. 

Acquire SIM memory and review reported subscriber and equipment 

related information (i.e., SPN, ICCID, IMSI, MSISDN). 

SPT–17 

Acquire SIM memory and review reported Abbreviated Dialing Numbers 

(ADN). 

SPT–18 

Acquire SIM memory and review reported Last Numbers Dialed (LND). SPT–19 

Acquire SIM memory and review reported text messages (SMS, EMS). SPT–20 

Acquire SIM memory and review recoverable deleted text messages 

(SMS, EMS). 

SPT–21 

Acquire SIM memory and review reported location related data (i.e., 

LOCI, GPRSLOCI). 

SPT–22 

Acquire SIM memory by selecting a combination of supported data 

elements. 

SPT–23 

Acquire SIM memory and review reported data via supported generated 

report formats.

 SPT–26 

Acquire SIM memory and review reported data via the preview–pane. SPT–27 

Attempt acquisition of a password–protected SIM. SPT–28 

After a successful SIM acquisition, alter the case file via third–party 

means and attempt to re–open the case. 

SPT–30 

Perform a physical acquisition and review data output for readability. SPT–31 

Perform a physical acquisition and review reports for recoverable deleted 

data. 

SPT–32 

Acquire SIM memory and review data containing non–ASCII characters. SPT–34 

Begin acquisition on a PIN protected SIM to determine if the tool provides 

an accurate count of the remaining number of PIN attempts and if the PIN 

attempts are decremented when entering an incorrect value.

 SPT–35 

Begin acquisition on a SIM whose PIN attempts have been exhausted to 

determine if the tool provides an accurate count of the remaining number 

of PUK attempts and if the PUK attempts are decremented when entering 

an incorrect value.

 SPT–36 

Perform a stand–alone mobile device internal memory acquisition and 

review the status flags for text messages present on the SIM. 

SPT–37 

Acquire SIM memory and review hash values for vendor supported data 

objects. 

SPT–39 

Acquire mobile device internal memory and review data containing GPS 

longitude and latitude coordinates. 

SPT–40 

Table 1f: Selected Test Cases (Palm pixi) 

Supported Test Cases Cases Selected for Execution 

Base Cases SPT–01, SPT–02, SPT–03, SPT–04, 

SPT–05, SPT–06, SPT–07, SPT–08, 

SPT–09, SPT–10, SPT–11, SPT–12, 

SPT–13 

November 2010 12 of 196 Results of Device Seizure 4.0 
Acquire mobile device internal memory and 

review reported data via supported generated 

report formats.

 SPT–24 

Acquire mobile device internal memory and 

review reported data via the preview pane. 

SPT–25 

After a successful mobile device internal 

memory, alter the case file via third–party 

means and attempt to re–open the case. 

SPT–29 

Acquire mobile device internal memory and 

review data containing non–ASCII 

characters.

 SPT–33 

Acquire mobile device internal memory and 

review hash values for vendor supported 

data objects. 

SPT–38 

Table 2f: Omitted Test Cases (Palm pixi) 

Unsupported Test Cases Cases 

omitted – not 

executed 

Acquire SIM memory over supported interfaces (e.g., PC/SC reader). SPT–14 

Attempt acquisition of a non–supported SIM. SPT–15 

Begin SIM acquisition and interrupt connectivity by interface 

disengagement. 

SPT–16 

Acquire SIM memory and review reported subscriber and equipment 

related information (i.e., SPN, ICCID, IMSI, MSISDN). 

SPT–17 

Acquire SIM memory and review reported Abbreviated Dialing Numbers 

(ADN). 

SPT–18 

Acquire SIM memory and review reported Last Numbers Dialed (LND). SPT–19 

Acquire SIM memory and review reported text messages (SMS, EMS). SPT–20 

Acquire SIM memory and review recoverable deleted text messages 

(SMS, EMS). 

SPT–21 

Acquire SIM memory and review reported location related data (i.e., 

LOCI, GPRSLOCI). 

SPT–22 

Acquire SIM memory by selecting a combination of supported data 

elements. 

SPT–23 

Acquire SIM memory and review reported data via supported generated 

report formats.

 SPT–26 

Acquire SIM memory and review reported data via the preview–pane. SPT–27 

Attempt acquisition of a password–protected SIM. SPT–28 

After a successful SIM acquisition, alter the case file via third–party 

means and attempt to re–open the case. 

SPT–30 

Perform a physical acquisition and review data output for readability. SPT–31 

Perform a physical acquisition and review reports for recoverable deleted 

data. 

SPT–32 

Acquire SIM memory and review data containing non–ASCII characters. SPT–34 

November 2010 13 of 196 Results of Device Seizure 4.0 
Unsupported Test Cases Cases 

omitted – not 

executed 

Begin acquisition on a PIN protected SIM to determine if the tool provides 

an accurate count of the remaining number of PIN attempts and if the PIN 

attempts are decremented when entering an incorrect value.

 SPT–35 

Begin acquisition on a SIM whose PIN attempts have been exhausted to 

determine if the tool provides an accurate count of the remaining number 

of PUK attempts and if the PUK attempts are decremented when entering 

an incorrect value.

 SPT–36 

Perform a stand–alone mobile device internal memory acquisition and 

review the status flags for text messages present on the SIM. 

SPT–37 

Acquire SIM memory and review hash values for vendor supported data 

objects. 

SPT–39 

Acquire mobile device internal memory and review data containing GPS 

longitude and latitude coordinates. 

SPT–40 

3 Results by Test Assertion 

Tables 3a – 3f summarize the test results by assertion. The column labeled Assertion 

gives the text of each assertion. The column labeled Tests gives the number of test cases 

that use the given assertion. The column labeled Anomaly gives the section number in 

this report where the anomaly is discussed. 

Table 3a: Assertions Tested: (iPhone 3Gs) 

Assertions Tested Tests Anomaly 

SPT–CA–01 If a cellular forensic tool provides support for connectivity 

of the target device then the tool shall successfully recognize the target 

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA). 

1 

SPT–CA–02 If a cellular forensic tool attempts to connect to a non– 

supported device then the tool shall notify the user that the device is not 

supported. 

1 

SPT–CA–03 If connectivity between the mobile device and cellular 

forensic tool is disrupted then the tool shall notify the user that 

connectivity has been disrupted. 

1 3.2 

SPT–CA–04 If a cellular forensic tool completes acquisition of the 

target device without error then the tool shall have the ability to present 

acquired data objects in a useable format via either a preview–pane or 

generated report. 

2 

SPT–CA–05 If a cellular forensic tool completes acquisition of the 

target device without error then subscriber–related information shall be 

presented in a useable format. 

1 

SPT–CA–06 If a cellular forensic tool completes acquisition of the 

target device without error then equipment related information shall be 

presented in a useable format. 

1 

November 2010 14 of 196 Results of Device Seizure 4.0 
Assertions Tested Tests Anomaly 

SPT–CA–07 If a cellular forensic tool completes acquisition of the 

target device without error then address book entries shall be presented 

in a useable format. 

1 

SPT–CA–08 If a cellular forensic tool completes acquisition of the 

target device without error then maximum length address book entries 

shall be presented in a useable format. 

1 

SPT–CA–09 If a cellular forensic tool completes acquisition of the 

target device without error then address book entries containing special 

characters shall be presented in a useable format. 

1 

SPT–CA–10 If a cellular forensic tool completes acquisition of the 

target device without error then address book entries containing blank 

names shall be presented in a useable format. 

1 

SPT–CA–11 If a cellular forensic tool completes acquisition of the 

target device without error then email addresses associated with address 

book entries shall be presented in a useable format. 

1 

SPT–CA–12 If a cellular forensic tool completes acquisition of the 

target device without error then graphics associated with address book 

entries shall be presented in a useable format. 

1 3.5 

SPT–CA–13 If a cellular forensic tool completes acquisition of the 

target device without error then datebook, calendar, note entries shall be 

presented in a useable format. 

1 

SPT–CA–14 If a cellular forensic tool completes acquisition of the 

target device without error then maximum length datebook, calendar, 

note entries shall be presented in a useable format. 

1 

SPT–CA–15 If a cellular forensic tool completes acquisition of the 

target device without error then call logs (incoming/outgoing/missed) 

shall be presented in a useable format. 

1 

SPT–CA–16 If a cellular forensic tool completes acquisition of the 

target device without error then the corresponding date/time stamps and 

the duration of the call for call logs shall be presented in a useable 

format. 

1 3.6 

SPT–CA–17 If a cellular forensic tool completes acquisition of the 

target device without error then ASCII text messages (i.e., SMS, EMS) 

shall be presented in a useable format. 

1 

SPT–CA–18 If a cellular forensic tool completes acquisition of the 

target device without error then the corresponding date/time stamps for 

text messages shall be presented in a useable format. 

1 

SPT–CA–19 If a cellular forensic tool completes acquisition of the 

target device without error then the corresponding status (i.e., read, 

unread) for text messages shall be presented in a useable format. 

1 

SPT–CA–20 If a cellular forensic tool completes acquisition of the 

target device without error then the corresponding sender / recipient 

phone numbers for text messages shall be presented in a useable format. 

1 

SPT–CA–21 If a cellular forensic tool completes acquisition of the 

target device without error then MMS messages and associated audio 

1 

November 2010 15 of 196 Results of Device Seizure 4.0 
Assertions Tested Tests Anomaly 

shall be presented in a useable format. 

SPT–CA–22 If a cellular forensic tool completes acquisition of the 

target device without error then MMS messages and associated graphic 

files shall be presented in a useable format. 

1 

SPT–CA–23 If a cellular forensic tool completes acquisition of the 

target device without error then MMS messages and associated video 

shall be presented in a useable format. 

1 

SPT–CA–24 If a cellular forensic tool completes acquisition of the 

target device without error then stand–alone audio files shall be 

presented in a useable format via either an internal application or 

suggested third–party application. 

1 

SPT–CA–25 If a cellular forensic tool completes acquisition of the 

target device without error then stand–alone graphic files shall be 

presented in a useable format via either an internal application or 

suggested third–party application. 

1 

SPT–CA–26 If a cellular forensic tool completes acquisition of the 

target device without error then stand–alone video files shall be 

presented in a useable format via either an internal application or 

suggested third–party application. 

1 

SPT–CA–27 If a cellular forensic tool completes acquisition of the 

target device without error then device specific application related data 

shall be acquired and presented in a useable format via either an internal 

application or suggested third–party application. 

1 3.10 

SPT–CA–28 If a cellular forensic tool completes acquisition of the 

target device without error then Internet related data (i.e., bookmarks, 

visited sites) cached to the device shall be acquired and presented in a 

useable format. 

1 

SPT–CA–29 If a cellular forensic tool provides the user with an 

“Acquire All” device data objects acquisition option then the tool shall 

complete the acquisition of all data objects without error. 

2 

SPT–CA–32 If a cellular forensic tool completes two consecutive 

logical acquisitions of the target device without error then the payload 

(data objects) on the mobile device shall remain consistent. 

1 

SPT–AO–01 If a cellular forensic tool provides support for connectivity 

of the target SIM then the tool shall successfully recognize the target 

SIM via all tool–supported interfaces (e.g., PC/SC reader, proprietary 

reader, smart phone itself). 

2 

SPT–AO–02 If a cellular forensic tool attempts to connect to a non– 

supported SIM then the tool shall notify the user that the SIM is not 

supported. 

1 

SPT–AO–03 If a cellular forensic tool loses connectivity with the SIM 

reader then the tool shall notify the user that connectivity has been 

disrupted. 

1 

SPT–AO–04 If a cellular forensic tool completes acquisition of the 

target SIM without error then the SPN shall be presented in a useable 

1 

November 2010 16 of 196 Results of Device Seizure 4.0 
Assertions Tested Tests Anomaly 

format. 

SPT–AO–05 If a cellular forensic tool completes acquisition of the 

target SIM without error then the ICCID shall be presented in a useable 

format. 

1 

SPT–AO–06 If a cellular forensic tool completes acquisition of the 

target SIM without error then the IMSI shall be presented in a useable 

format. 

1 

SPT–AO–07 If a cellular forensic tool completes acquisition of the 

target SIM without error then the MSISDN shall be presented in a 

useable format. 

1 

SPT–AO–08 If a cellular forensic tool completes acquisition of the 

target SIM without error then ASCII Abbreviated Dialing Numbers 

(ADN) shall be presented in a useable format. 

1 

SPT–AO–09 If a cellular forensic tool completes acquisition of the 

target SIM without error then maximum length ADNs shall be presented 

in a useable format. 

1 

SPT–AO–10 If a cellular forensic tool completes acquisition of the SIM 

without error then ADNs containing special characters shall be 

presented in a useable format. 

1 

SPT–AO–11 If a cellular forensic tool completes acquisition of the SIM 

without error then ADNs containing blank names shall be presented in a 

useable format. 

1 

SPT–AO–12 If a cellular forensic tool completes acquisition of the 

target SIM without error then Last Numbers Dialed (LND) shall be 

presented in a useable format. 

1 

SPT–AO–13 If a cellular forensic tool completes acquisition of the 

target SIM without error then the corresponding date/time stamps for 

LNDs shall be presented in a useable format. 

1 

SPT–AO–14 If a cellular forensic tool completes acquisition of the 

target SIM without error then ASCII SMS text messages shall be 

presented in a useable format. 

1 

SPT–AO–15 If a cellular forensic tool completes acquisition of the 

target SIM without error then ASCII EMS text messages shall be 

presented in a useable format. 

1 

SPT–AO–16 If a cellular forensic tool completes acquisition of the 

target SIM without error then the corresponding date/time stamps for all 

text messages shall be presented in a useable format. 

1 

SPT–AO–17 If a cellular forensic tool completes acquisition of the 

target SIM without error then the corresponding status (i.e., read, 

unread) for text messages shall be presented in a useable format. 

1 

SPT–AO–18 If a cellular forensic tool completes acquisition of the 

target SIM without error then the corresponding sender / recipient phone 

numbers for text messages shall be presented in a useable format. 

1 

SPT–AO–19 If the cellular forensic tool completes acquisition of the 

target SIM without error then deleted text messages that have not been 

1 

November 2010 17 of 196 Results of Device Seizure 4.0 
Assertions Tested Tests Anomaly 

overwritten shall be presented in a useable format. 

SPT–AO–20 If a cellular forensic tool completes acquisition of the 

target SIM without error then location related data (i.e., LOCI) shall be 

presented in a useable format. 

1 

SPT–AO–21 If a cellular forensic tool completes acquisition of the 

target SIM without error then location related data (i.e., GRPSLOCI) 

shall be presented in a useable format. 

1 

SPT–AO–22 If a cellular forensic tool provides the user with an 

“Acquire All” SIM data objects acquisition option then the tool shall 

complete the acquisition of all data objects without error. 

1 

SPT–AO–25 If a cellular forensic tool completes acquisition without 

error then the tool shall present the acquired data in a useable format via 

supported generated report formats. 

2 

SPT–AO–26 If a cellular forensic tool completes acquisition without 

error then the tool shall present the acquired data in a useable format in 

a preview–pane view. 

2 

SPT–AO–27 If the case file or individual data objects are modified via 

third–party means then the tool shall provide protection mechanisms 

disallowing or reporting data modification. 

2 

SPT–AO–28 If the SIM is password–protected then the cellular forensic 

tool shall provide the examiner with the opportunity to input the PIN 

before acquisition. 

1 3.13 

SPT–AO–40 If the cellular forensic tool supports display of non–ASCII 

characters then the application should present ADNs in their native 

format. 

2 

SPT–AO–41 If the cellular forensic tool supports proper display of non– 

ASCII characters then the application should present text messages in 

their native format. 

2 

SPT–AO–43 If the cellular forensic tool supports hashing for individual 

data objects then the tool shall present the user with a hash value for 

each supported data object. 

2 

SPT–AO–44 If the cellular forensic tool supports acquisition of GPS 

data then the tool shall present the user with the longitude and latitude 

coordinates for all GPS–related data in a useable format. 

1 

Table 3b: Assertions Tested: (Blackberry Bold 9700) 

Assertions Tested Tests Anomaly 

SPT–CA–01 If a cellular forensic tool provides support for connectivity 

of the target device then the tool shall successfully recognize the target 

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA). 

1 

SPT–CA–02 If a cellular forensic tool attempts to connect to a non– 

supported device then the tool shall notify the user that the device is not 

supported. 

1 

SPT–CA–03 If connectivity between the mobile device and cellular 

forensic tool is disrupted then the tool shall notify the user that 

1 3.2 

November 2010 18 of 196 Results of Device Seizure 4.0 
Assertions Tested Tests Anomaly 

connectivity has been disrupted. 

SPT–CA–04 If a cellular forensic tool completes acquisition of the 

target device without error then the tool shall have the ability to present 

acquired data objects in a useable format via either a preview–pane or 

generated report. 

2 

SPT–CA–05 If a cellular forensic tool completes acquisition of the 

target device without error then subscriber–related information shall be 

presented in a useable format. 

1 

SPT–CA–06 If a cellular forensic tool completes acquisition of the 

target device without error then equipment related information shall be 

presented in a useable format. 

1 

SPT–CA–07 If a cellular forensic tool completes acquisition of the 

target device without error then address book entries shall be presented 

in a useable format. 

1 

SPT–CA–08 If a cellular forensic tool completes acquisition of the 

target device without error then maximum length address book entries 

shall be presented in a useable format. 

1 

SPT–CA–09 If a cellular forensic tool completes acquisition of the 

target device without error then address book entries containing special 

characters shall be presented in a useable format. 

1 

SPT–CA–10 If a cellular forensic tool completes acquisition of the 

target device without error then address book entries containing blank 

names shall be presented in a useable format. 

1 

SPT–CA–11 If a cellular forensic tool completes acquisition of the 

target device without error then email addresses associated with address 

book entries shall be presented in a useable format. 

1 

SPT–CA–12 If a cellular forensic tool completes acquisition of the 

target device without error then graphics associated with address book 

entries shall be presented in a useable format. 

1 3.5 

SPT–CA–13 If a cellular forensic tool completes acquisition of the 

target device without error then datebook, calendar, note entries shall be 

presented in a useable format. 

1 

SPT–CA–14 If a cellular forensic tool completes acquisition of the 

target device without error then maximum length datebook, calendar, 

note entries shall be presented in a useable format. 

1 

SPT–CA–15 If a cellular forensic tool completes acquisition of the 

target device without error then call logs (incoming/outgoing/missed) 

shall be presented in a useable format. 

1 

SPT–CA–16 If a cellular forensic tool completes acquisition of the 

target device without error then the corresponding date/time stamps and 

the duration of the call for call logs shall be presented in a useable 

format. 

1 

SPT–CA–17 If a cellular forensic tool completes acquisition of the 

target device without error then ASCII text messages (i.e., SMS, EMS) 

shall be presented in a useable format. 

1 

November 2010 19 of 196 Results of Device Seizure 4.0 
Assertions Tested Tests Anomaly 

SPT–CA–18 If a cellular forensic tool completes acquisition of the 

target device without error then the corresponding date/time stamps for 

text messages shall be presented in a useable format. 

1 

SPT–CA–19 If a cellular forensic tool completes acquisition of the 

target device without error then the corresponding status (i.e., read, 

unread) for text messages shall be presented in a useable format. 

1 

SPT–CA–20 If a cellular forensic tool completes acquisition of the 

target device without error then the corresponding sender / recipient 

phone numbers for text messages shall be presented in a useable format. 

1 

SPT–CA–21 If a cellular forensic tool completes acquisition of the 

target device without error then MMS messages and associated audio 

shall be presented in a useable format. 

1 3.8 

SPT–CA–22 If a cellular forensic tool completes acquisition of the 

target device without error then MMS messages and associated graphic 

files shall be presented in a useable format. 

1 3.8 

SPT–CA–23 If a cellular forensic tool completes acquisition of the 

target device without error then MMS messages and associated video 

shall be presented in a useable format. 

1 3.8 

SPT–CA–24 If a cellular forensic tool completes acquisition of the 

target device without error then stand–alone audio files shall be 

presented in a useable format via either an internal application or 

suggested third–party application. 

1 3.9 

SPT–CA–25 If a cellular forensic tool completes acquisition of the 

target device without error then stand–alone graphic files shall be 

presented in a useable format via either an internal application or 

suggested third–party application. 

1 3.9 

SPT–CA–26 If a cellular forensic tool completes acquisition of the 

target device without error then stand–alone video files shall be 

presented in a useable format via either an internal application or 

suggested third–party application. 

1 3.9 

SPT–CA–27 If a cellular forensic tool completes acquisition of the 

target device without error then device specific application related data 

shall be acquired and presented in a useable format via either an internal 

application or suggested third–party application. 

1 3.10 

SPT–CA–28 If a cellular forensic tool completes acquisition of the 

target device without error then Internet related data (i.e., bookmarks, 

visited sites) cached to the device shall be acquired and presented in a 

useable format. 

1 

SPT–CA–29 If a cellular forensic tool provides the user with an 

“Acquire All” device data objects acquisition option then the tool shall 

complete the acquisition of all data objects without error. 

2 

SPT–CA–32 If a cellular forensic tool completes two consecutive 

logical acquisitions of the target device without error then the payload 

(data objects) on the mobile device shall remain consistent. 

1 

SPT–AO–01 If a cellular forensic tool provides support for connectivity 2 

November 2010 20 of 196 Results of Device Seizure 4.0 
Assertions Tested Tests Anomaly 

of the target SIM then the tool shall successfully recognize the target 

SIM via all tool–supported interfaces (e.g., PC/SC reader, proprietary 

reader, smart phone itself). 

SPT–AO–02 If a cellular forensic tool attempts to connect to a non– 

supported SIM then the tool shall notify the user that the SIM is not 

supported. 

1 

SPT–AO–03 If a cellular forensic tool loses connectivity with the SIM 

reader then the tool shall notify the user that connectivity has been 

disrupted. 

1 

SPT–AO–04 If a cellular forensic tool completes acquisition of the 

target SIM without error then the SPN shall be presented in a useable 

format. 

1 

SPT–AO–05 If a cellular forensic tool completes acquisition of the 

target SIM without error then the ICCID shall be presented in a useable 

format. 

1 

SPT–AO–06 If a cellular forensic tool completes acquisition of the 

target SIM without error then the IMSI shall be presented in a useable 

format. 

1 

SPT–AO–07 If a cellular forensic tool completes acquisition of the 

target SIM without error then the MSISDN shall be presented in a 

useable format. 

1 

SPT–AO–08 If a cellular forensic tool completes acquisition of the 

target SIM without error then ASCII Abbreviated Dialing Numbers 

(ADN) shall be presented in a useable format. 

1 

SPT–AO–09 If a cellular forensic tool completes acquisition of the 

target SIM without error then maximum length ADNs shall be presented 

in a useable format. 

1 

SPT–AO–10 If a cellular forensic tool completes acquisition of the SIM 

without error then ADNs containing special characters shall be 

presented in a useable format. 

1 

SPT–AO–11 If a cellular forensic tool completes acquisition of the SIM 

without error then ADNs containing blank names shall be presented in a 

useable format. 

1 

SPT–AO–12 If a cellular forensic tool completes acquisition of the 

target SIM without error then Last Numbers Dialed (LND) shall be 

presented in a useable format. 

1 

SPT–AO–13 If a cellular forensic tool completes acquisition of the 

target SIM without error then the corresponding date/time stamps for 

LNDs shall be presented in a useable format. 

1 

SPT–AO–14 If a cellular forensic tool completes acquisition of the 

target SIM without error then ASCII SMS text messages shall be 

presented in a useable format. 

1 

SPT–AO–15 If a cellular forensic tool completes acquisition of the 

target SIM without error then ASCII EMS text messages shall be 

presented in a useable format. 

1 

November 2010 21 of 196 Results of Device Seizure 4.0 
Assertions Tested Tests Anomaly 

SPT–AO–16 If a cellular forensic tool completes acquisition of the 

target SIM without error then the corresponding date/time stamps for all 

text messages shall be presented in a useable format. 

1 

SPT–AO–17 If a cellular forensic tool completes acquisition of the 

target SIM without error then the corresponding status (i.e., read, 

unread) for text messages shall be presented in a useable format. 

1 

SPT–AO–18 If a cellular forensic tool completes acquisition of the 

target SIM without error then the corresponding sender / recipient phone 

numbers for text messages shall be presented in a useable format. 

1 

SPT–AO–19 If the cellular forensic tool completes acquisition of the 

target SIM without error then deleted text messages that have not been 

overwritten shall be presented in a useable format. 

1 

SPT–AO–20 If a cellular forensic tool completes acquisition of the 

target SIM without error then location related data (i.e., LOCI) shall be 

presented in a useable format. 

1 

SPT–AO–21 If a cellular forensic tool completes acquisition of the 

target SIM without error then location related data (i.e., GRPSLOCI) 

shall be presented in a useable format. 

1 

SPT–AO–22 If a cellular forensic tool provides the user with an 

“Acquire All” SIM data objects acquisition option then the tool shall 

complete the acquisition of all data objects without error. 

1 

SPT–AO–25 If a cellular forensic tool completes acquisition without 

error then the tool shall present the acquired data in a useable format via 

supported generated report formats. 

2 

SPT–AO–26 If a cellular forensic tool completes acquisition without 

error then the tool shall present the acquired data in a useable format in 

a preview–pane view. 

2 

SPT–AO–27 If the case file or individual data objects are modified via 

third–party means then the tool shall provide protection mechanisms 

disallowing or reporting data modification. 

2 

SPT–AO–28 If the SIM is password–protected then the cellular forensic 

tool shall provide the examiner with the opportunity to input the PIN 

before acquisition. 

1 3.13 

SPT–AO–40 If the cellular forensic tool supports display of non–ASCII 

characters then the application should present ADNs in their native 

format. 

2 

SPT–AO–41 If the cellular forensic tool supports proper display of non– 

ASCII characters then the application should present text messages in 

their native format. 

2 

SPT–AO–43 If the cellular forensic tool supports hashing for individual 

data objects then the tool shall present the user with a hash value for 

each supported data object. 

2 

Table 3c: Assertions Tested: (Nokia 6790) 

Assertions Tested Tests Anomaly 

November 2010 22 of 196 Results of Device Seizure 4.0 
Assertions Tested Tests Anomaly 

SPT–CA–01 If a cellular forensic tool provides support for connectivity 

of the target device then the tool shall successfully recognize the target 

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA). 

1 3.1 

SPT–CA–04 If a cellular forensic tool completes acquisition of the 

target device without error then the tool shall have the ability to present 

acquired data objects in a useable format via either a preview–pane or 

generated report. 

1 

SPT–CA–29 If a cellular forensic tool provides the user with an 

“Acquire All” device data objects acquisition option then the tool shall 

complete the acquisition of all data objects without error. 

1 

SPT–CA–30 If a cellular forensic tool provides the user with a “Select 

All” individual device data objects then the tool shall complete the 

acquisition of all individually selected data objects without error. 

1 

SPT–CA–31 If a cellular forensic tool provides the user with the ability 

to “Select Individual” device data objects for acquisition then the tool 

shall acquire each exclusive data object without error. 

1 

SPT–CA–32 If a cellular forensic tool completes two consecutive 

logical acquisitions of the target device without error then the payload 

(data objects) on the mobile device shall remain consistent. 

1 

SPT–AO–01 If a cellular forensic tool provides support for connectivity 

of the target SIM then the tool shall successfully recognize the target 

SIM via all tool–supported interfaces (e.g., PC/SC reader, proprietary 

reader, smart phone itself). 

1 

SPT–AO–01 If a cellular forensic tool provides support for connectivity 

of the target SIM then the tool shall successfully recognize the target 

SIM via all tool–supported interfaces (e.g., PC/SC reader, proprietary 

reader, smart phone itself). 

1 

SPT–AO–02 If a cellular forensic tool attempts to connect to a non– 

supported SIM then the tool shall notify the user that the SIM is not 

supported. 

1 

SPT–AO–03 If a cellular forensic tool loses connectivity with the SIM 

reader then the tool shall notify the user that connectivity has been 

disrupted. 

1 

SPT–AO–04 If a cellular forensic tool completes acquisition of the 

target SIM without error then the SPN shall be presented in a useable 

format. 

1 

SPT–AO–05 If a cellular forensic tool completes acquisition of the 

target SIM without error then the ICCID shall be presented in a useable 

format. 

1 

SPT–AO–06 If a cellular forensic tool completes acquisition of the 

target SIM without error then the IMSI shall be presented in a useable 

format. 

1 

SPT–AO–07 If a cellular forensic tool completes acquisition of the 

target SIM without error then the MSISDN shall be presented in a 

useable format. 

1 

November 2010 23 of 196 Results of Device Seizure 4.0 
Assertions Tested Tests Anomaly 

SPT–AO–08 If a cellular forensic tool completes acquisition of the 

target SIM without error then ASCII Abbreviated Dialing Numbers 

(ADN) shall be presented in a useable format. 

1 

SPT–AO–09 If a cellular forensic tool completes acquisition of the 

target SIM without error then maximum length ADNs shall be presented 

in a useable format. 

1 

SPT–AO–10 If a cellular forensic tool completes acquisition of the SIM 

without error then ADNs containing special characters shall be 

presented in a useable format. 

1 

SPT–AO–11 If a cellular forensic tool completes acquisition of the SIM 

without error then ADNs containing blank names shall be presented in a 

useable format. 

1 

SPT–AO–12 If a cellular forensic tool completes acquisition of the 

target SIM without error then Last Numbers Dialed (LND) shall be 

presented in a useable format. 

1 

SPT–AO–13 If a cellular forensic tool completes acquisition of the 

target SIM without error then the corresponding date/time stamps for 

LNDs shall be presented in a useable format. 

1 

SPT–AO–14 If a cellular forensic tool completes acquisition of the 

target SIM without error then ASCII SMS text messages shall be 

presented in a useable format. 

1 

SPT–AO–15 If a cellular forensic tool completes acquisition of the 

target SIM without error then ASCII EMS text messages shall be 

presented in a useable format. 

1 

SPT–AO–16 If a cellular forensic tool completes acquisition of the 

target SIM without error then the corresponding date/time stamps for all 

text messages shall be presented in a useable format. 

1 

SPT–AO–17 If a cellular forensic tool completes acquisition of the 

target SIM without error then the corresponding status (i.e., read, 

unread) for text messages shall be presented in a useable format. 

1 

SPT–AO–18 If a cellular forensic tool completes acquisition of the 

target SIM without error then the corresponding sender / recipient phone 

numbers for text messages shall be presented in a useable format. 

1 

SPT–AO–19 If the cellular forensic tool completes acquisition of the 

target SIM without error then deleted text messages that have not been 

overwritten shall be presented in a useable format. 

1 

SPT–AO–20 If a cellular forensic tool completes acquisition of the 

target SIM without error then location related data (i.e., LOCI) shall be 

presented in a useable format. 

1 

SPT–AO–21 If a cellular forensic tool completes acquisition of the 

target SIM without error then location related data (i.e., GRPSLOCI) 

shall be presented in a useable format. 

1 

SPT–AO–22 If a cellular forensic tool provides the user with an 

“Acquire All” SIM data objects acquisition option then the tool shall 

complete the acquisition of all data objects without error. 

1 

November 2010 24 of 196 Results of Device Seizure 4.0 
Assertions Tested Tests Anomaly 

SPT–AO–25 If a cellular forensic tool completes acquisition without 

error then the tool shall present the acquired data in a useable format via 

supported generated report formats. 

1 

SPT–AO–26 If a cellular forensic tool completes acquisition without 

error then the tool shall present the acquired data in a useable format in 

a preview–pane view. 

1 

SPT–AO–27 If the case file or individual data objects are modified via 

third–party means then the tool shall provide protection mechanisms 

disallowing or reporting data modification. 

1 

SPT–AO–28 If the SIM is password–protected then the cellular forensic 

tool shall provide the examiner with the opportunity to input the PIN 

before acquisition. 

1 3.13 

SPT–AO–40 If the cellular forensic tool supports display of non–ASCII 

characters then the application should present ADNs in their native 

format. 

1 

SPT–AO–41 If the cellular forensic tool supports proper display of non– 

ASCII characters then the application should present text messages in 

their native format. 

1 

SPT–AO–43 If the cellular forensic tool supports hashing for individual 

data objects then the tool shall present the user with a hash value for 

each supported data object. 

1 

Table 3d: Assertions Tested: (HTC Touch Pro 2) 

Assertions Tested Tests Anomaly 

SPT–CA–01 If a cellular forensic tool provides support for connectivity 

of the target device then the tool shall successfully recognize the target 

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA). 

1 

SPT–CA–02 If a cellular forensic tool attempts to connect to a non– 

supported device then the tool shall notify the user that the device is not 

supported. 

1 

SPT–CA–03 If connectivity between the mobile device and cellular 

forensic tool is disrupted then the tool shall notify the user that 

connectivity has been disrupted. 

1 

SPT–CA–04 If a cellular forensic tool completes acquisition of the 

target device without error then the tool shall have the ability to present 

acquired data objects in a useable format via either a preview–pane or 

generated report. 

2 3.3 

SPT–CA–05 If a cellular forensic tool completes acquisition of the 

target device without error then subscriber–related information shall be 

presented in a useable format. 

1 

SPT–CA–06 If a cellular forensic tool completes acquisition of the 

target device without error then equipment related information shall be 

presented in a useable format. 

1 

SPT–CA–07 If a cellular forensic tool completes acquisition of the 1 

November 2010 25 of 196 Results of Device Seizure 4.0 
Assertions Tested Tests Anomaly 

target device without error then address book entries shall be presented 

in a useable format. 

SPT–CA–08 If a cellular forensic tool completes acquisition of the 

target device without error then maximum length address book entries 

shall be presented in a useable format. 

1 

SPT–CA–09 If a cellular forensic tool completes acquisition of the 

target device without error then address book entries containing special 

characters shall be presented in a useable format. 

1 

SPT–CA–10 If a cellular forensic tool completes acquisition of the 

target device without error then address book entries containing blank 

names shall be presented in a useable format. 

1 

SPT–CA–11 If a cellular forensic tool completes acquisition of the 

target device without error then email addresses associated with address 

book entries shall be presented in a useable format. 

1 

SPT–CA–12 If a cellular forensic tool completes acquisition of the 

target device without error then graphics associated with address book 

entries shall be presented in a useable format. 

1 3.5 

SPT–CA–13 If a cellular forensic tool completes acquisition of the 

target device without error then datebook, calendar, note entries shall be 

presented in a useable format. 

1 

SPT–CA–14 If a cellular forensic tool completes acquisition of the 

target device without error then maximum length datebook, calendar, 

note entries shall be presented in a useable format. 

1 

SPT–CA–15 If a cellular forensic tool completes acquisition of the 

target device without error then call logs (incoming/outgoing/missed) 

shall be presented in a useable format. 

1 

SPT–CA–16 If a cellular forensic tool completes acquisition of the 

target device without error then the corresponding date/time stamps and 

the duration of the call for call logs shall be presented in a useable 

format. 

1 

SPT–CA–17 If a cellular forensic tool completes acquisition of the 

target device without error then ASCII text messages (i.e., SMS, EMS) 

shall be presented in a useable format. 

1 3.7 

SPT–CA–18 If a cellular forensic tool completes acquisition of the 

target device without error then the corresponding date/time stamps for 

text messages shall be presented in a useable format. 

1 

SPT–CA–19 If a cellular forensic tool completes acquisition of the 

target device without error then the corresponding status (i.e., read, 

unread) for text messages shall be presented in a useable format. 

1 

SPT–CA–20 If a cellular forensic tool completes acquisition of the 

target device without error then the corresponding sender / recipient 

phone numbers for text messages shall be presented in a useable format. 

1 

SPT–CA–21 If a cellular forensic tool completes acquisition of the 

target device without error then MMS messages and associated audio 

shall be presented in a useable format. 

1 3.8 

November 2010 26 of 196 Results of Device Seizure 4.0 
Assertions Tested Tests Anomaly 

SPT–CA–22 If a cellular forensic tool completes acquisition of the 

target device without error then MMS messages and associated graphic 

files shall be presented in a useable format. 

1 3.8 

SPT–CA–23 If a cellular forensic tool completes acquisition of the 

target device without error then MMS messages and associated video 

shall be presented in a useable format. 

1 3.8 

SPT–CA–24 If a cellular forensic tool completes acquisition of the 

target device without error then stand–alone audio files shall be 

presented in a useable format via either an internal application or 

suggested third–party application. 

1 3.9 

SPT–CA–25 If a cellular forensic tool completes acquisition of the 

target device without error then stand–alone graphic files shall be 

presented in a useable format via either an internal application or 

suggested third–party application. 

1 3.9 

SPT–CA–26 If a cellular forensic tool completes acquisition of the 

target device without error then stand–alone video files shall be 

presented in a useable format via either an internal application or 

suggested third–party application. 

1 3.9 

SPT–CA–27 If a cellular forensic tool completes acquisition of the 

target device without error then device specific application related data 

shall be acquired and presented in a useable format via either an internal 

application or suggested third–party application. 

1 

SPT–CA–28 If a cellular forensic tool completes acquisition of the 

target device without error then Internet related data (i.e., bookmarks, 

visited sites) cached to the device shall be acquired and presented in a 

useable format. 

1 

SPT–CA–29 If a cellular forensic tool provides the user with an 

“Acquire All” device data objects acquisition option then the tool shall 

complete the acquisition of all data objects without error. 

2 

SPT–CA–30 If a cellular forensic tool provides the user with a “Select 

All” individual device data objects then the tool shall complete the 

acquisition of all individually selected data objects without error. 

2 

SPT–CA–31 If a cellular forensic tool provides the user with the ability 

to “Select Individual” device data objects for acquisition then the tool 

shall acquire each exclusive data object without error. 

2 

SPT–CA–32 If a cellular forensic tool completes two consecutive 

logical acquisitions of the target device without error then the payload 

(data objects) on the mobile device shall remain consistent. 

1 

SPT–AO–25 If a cellular forensic tool completes acquisition without 

error then the tool shall present the acquired data in a useable format via 

supported generated report formats. 

1 3.12 

SPT–AO–26 If a cellular forensic tool completes acquisition without 

error then the tool shall present the acquired data in a useable format in 

a preview–pane view. 

1 

SPT–AO–27 If the case file or individual data objects are modified via 1 

November 2010 27 of 196 Results of Device Seizure 4.0 
Assertions Tested Tests Anomaly 

third–party means then the tool shall provide protection mechanisms 

disallowing or reporting data modification. 

SPT–AO–31 If the cellular forensic tool supports a physical acquisition 

of the target device then the tool shall complete the acquisition without 

error. 

1 3.14 

SPT–AO–40 If the cellular forensic tool supports display of non–ASCII 

characters then the application should present address book entries in 

their native format. 

1 

SPT–AO–41 If the cellular forensic tool supports proper display of non– 

ASCII characters then the application should present text messages in 

their native format. 

1 

SPT–AO–43 If the cellular forensic tool supports hashing for individual 

data objects then the tool shall present the user with a hash value for 

each supported data object. 

1 

Table 3e: Assertions Tested: (Blackberry 9630) 

Assertions Tested Tests Anomaly 

SPT–CA–01 If a cellular forensic tool provides support for connectivity 

of the target device then the tool shall successfully recognize the target 

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA). 

1 

SPT–CA–02 If a cellular forensic tool attempts to connect to a non– 

supported device then the tool shall notify the user that the device is not 

supported. 

1 

SPT–CA–03 If connectivity between the mobile device and cellular 

forensic tool is disrupted then the tool shall notify the user that 

connectivity has been disrupted. 

1 3.2 

SPT–CA–04 If a cellular forensic tool completes acquisition of the 

target device without error then the tool shall have the ability to present 

acquired data objects in a useable format via either a preview–pane or 

generated report. 

2 

SPT–CA–05 If a cellular forensic tool completes acquisition of the 

target device without error then subscriber–related information shall be 

presented in a useable format. 

1 3.4 

SPT–CA–06 If a cellular forensic tool completes acquisition of the 

target device without error then equipment related information shall be 

presented in a useable format. 

1 3.4 

SPT–CA–07 If a cellular forensic tool completes acquisition of the 

target device without error then address book entries shall be presented 

in a useable format. 

1 

SPT–CA–08 If a cellular forensic tool completes acquisition of the 

target device without error then maximum length address book entries 

shall be presented in a useable format. 

1 

SPT–CA–09 If a cellular forensic tool completes acquisition of the 

target device without error then address book entries containing special 

1 

November 2010 28 of 196 Results of Device Seizure 4.0 
Assertions Tested Tests Anomaly 

characters shall be presented in a useable format. 

SPT–CA–10 If a cellular forensic tool completes acquisition of the 

target device without error then address book entries containing blank 

names shall be presented in a useable format. 

1 

SPT–CA–11 If a cellular forensic tool completes acquisition of the 

target device without error then email addresses associated with address 

book entries shall be presented in a useable format. 

1 

SPT–CA–12 If a cellular forensic tool completes acquisition of the 

target device without error then graphics associated with address book 

entries shall be presented in a useable format. 

1 3.5 

SPT–CA–13 If a cellular forensic tool completes acquisition of the 

target device without error then datebook, calendar, note entries shall be 

presented in a useable format. 

1 

SPT–CA–14 If a cellular forensic tool completes acquisition of the 

target device without error then maximum length datebook, calendar, 

note entries shall be presented in a useable format. 

1 

SPT–CA–15 If a cellular forensic tool completes acquisition of the 

target device without error then call logs (incoming/outgoing/missed) 

shall be presented in a useable format. 

1 

SPT–CA–16 If a cellular forensic tool completes acquisition of the 

target device without error then the corresponding date/time stamps and 

the duration of the call for call logs shall be presented in a useable 

format. 

1 

SPT–CA–17 If a cellular forensic tool completes acquisition of the 

target device without error then ASCII text messages (i.e., SMS, EMS) 

shall be presented in a useable format. 

1 

SPT–CA–18 If a cellular forensic tool completes acquisition of the 

target device without error then the corresponding date/time stamps for 

text messages shall be presented in a useable format. 

1 

SPT–CA–19 If a cellular forensic tool completes acquisition of the 

target device without error then the corresponding status (i.e., read, 

unread) for text messages shall be presented in a useable format. 

1 

SPT–CA–20 If a cellular forensic tool completes acquisition of the 

target device without error then the corresponding sender / recipient 

phone numbers for text messages shall be presented in a useable format. 

1 

SPT–CA–21 If a cellular forensic tool completes acquisition of the 

target device without error then MMS messages and associated audio 

shall be presented in a useable format. 

1 3.8 

SPT–CA–22 If a cellular forensic tool completes acquisition of the 

target device without error then MMS messages and associated graphic 

files shall be presented in a useable format. 

1 3.8 

SPT–CA–23 If a cellular forensic tool completes acquisition of the 

target device without error then MMS messages and associated video 

shall be presented in a useable format. 

1 3.8 

SPT–CA–24 If a cellular forensic tool completes acquisition of the 1 3.9 

November 2010 29 of 196 Results of Device Seizure 4.0 
Assertions Tested Tests Anomaly 

target device without error then stand–alone audio files shall be 

presented in a useable format via either an internal application or 

suggested third–party application. 

SPT–CA–25 If a cellular forensic tool completes acquisition of the 

target device without error then stand–alone graphic files shall be 

presented in a useable format via either an internal application or 

suggested third–party application. 

1 3.9 

SPT–CA–26 If a cellular forensic tool completes acquisition of the 

target device without error then stand–alone video files shall be 

presented in a useable format via either an internal application or 

suggested third–party application. 

1 3.9 

SPT–CA–27 If a cellular forensic tool completes acquisition of the 

target device without error then device specific application related data 

shall be acquired and presented in a useable format via either an internal 

application or suggested third–party application. 

1 3.10 

SPT–CA–28 If a cellular forensic tool completes acquisition of the 

target device without error then Internet related data (i.e., bookmarks, 

visited sites) cached to the device shall be acquired and presented in a 

useable format. 

1 3.11 

SPT–CA–29 If a cellular forensic tool provides the user with an 

“Acquire All” device data objects acquisition option then the tool shall 

complete the acquisition of all data objects without error. 

2 

SPT–CA–30 If a cellular forensic tool provides the user with a “Select 

All” individual device data objects then the tool shall complete the 

acquisition of all individually selected data objects without error. 

2 

SPT–CA–31 If a cellular forensic tool provides the user with the ability 

to “Select Individual” device data objects for acquisition then the tool 

shall acquire each exclusive data object without error. 

2 

SPT–CA–32 If a cellular forensic tool completes two consecutive 

logical acquisitions of the target device without error then the payload 

(data objects) on the mobile device shall remain consistent. 

1 

SPT–AO–25 If a cellular forensic tool completes acquisition without 

error then the tool shall present the acquired data in a useable format via 

supported generated report formats. 

1 

SPT–AO–26 If a cellular forensic tool completes acquisition without 

error then the tool shall present the acquired data in a useable format in 

a preview–pane view. 

1 

SPT–AO–27 If the case file or individual data objects are modified via 

third–party means then the tool shall provide protection mechanisms 

disallowing or reporting data modification. 

1 

SPT–AO–40 If the cellular forensic tool supports display of non–ASCII 

characters then the application should present address book entries in 

their native format. 

1 

SPT–AO–41 If the cellular forensic tool supports proper display of non– 

ASCII characters then the application should present text messages in 

1 3.15 

November 2010 30 of 196 Results of Device Seizure 4.0 
Assertions Tested Tests Anomaly 

their native format. 

SPT–AO–43 If the cellular forensic tool supports hashing for individual 

data objects then the tool shall present the user with a hash value for 

each supported data object. 

1 3.15 

Table 3f: Assertions Tested: (Palm pixi) 

Assertions Tested Tests Anomaly 

SPT–CA–01 If a cellular forensic tool provides support for connectivity 

of the target device then the tool shall successfully recognize the target 

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA). 

1 

SPT–CA–02 If a cellular forensic tool attempts to connect to a non– 

supported device then the tool shall notify the user that the device is not 

supported. 

1 

SPT–CA–03 If connectivity between the mobile device and cellular 

forensic tool is disrupted then the tool shall notify the user that 

connectivity has been disrupted. 

1 

SPT–CA–04 If a cellular forensic tool completes acquisition of the 

target device without error then the tool shall have the ability to present 

acquired data objects in a useable format via either a preview–pane or 

generated report. 

2 

SPT–CA–05 If a cellular forensic tool completes acquisition of the 

target device without error then subscriber–related information shall be 

presented in a useable format. 

1 3.4 

SPT–CA–06 If a cellular forensic tool completes acquisition of the 

target device without error then equipment related information shall be 

presented in a useable format. 

1 3.4 

SPT–CA–07 If a cellular forensic tool completes acquisition of the 

target device without error then address book entries shall be presented 

in a useable format. 

1 

SPT–CA–08 If a cellular forensic tool completes acquisition of the 

target device without error then maximum length address book entries 

shall be presented in a useable format. 

1 

SPT–CA–09 If a cellular forensic tool completes acquisition of the 

target device without error then address book entries containing special 

characters shall be presented in a useable format. 

1 

SPT–CA–10 If a cellular forensic tool completes acquisition of the 

target device without error then address book entries containing blank 

names shall be presented in a useable format. 

1 

SPT–CA–11 If a cellular forensic tool completes acquisition of the 

target device without error then email addresses associated with address 

book entries shall be presented in a useable format. 

1 

SPT–CA–12 If a cellular forensic tool completes acquisition of the 

target device without error then graphics associated with address book 

entries shall be presented in a useable format. 

1 3.5 

SPT–CA–13 If a cellular forensic tool completes acquisition of the 1 

November 2010 31 of 196 Results of Device Seizure 4.0 
Assertions Tested Tests Anomaly 

target device without error then datebook, calendar, note entries shall be 

presented in a useable format. 

SPT–CA–14 If a cellular forensic tool completes acquisition of the 

target device without error then maximum length datebook, calendar, 

note entries shall be presented in a useable format. 

1 

SPT–CA–15 If a cellular forensic tool completes acquisition of the 

target device without error then call logs (incoming/outgoing/missed) 

shall be presented in a useable format. 

1 

SPT–CA–16 If a cellular forensic tool completes acquisition of the 

target device without error then the corresponding date/time stamps and 

the duration of the call for call logs shall be presented in a useable 

format. 

1 3.6 

SPT–CA–17 If a cellular forensic tool completes acquisition of the 

target device without error then ASCII text messages (i.e., SMS, EMS) 

shall be presented in a useable format. 

1 

SPT–CA–18 If a cellular forensic tool completes acquisition of the 

target device without error then the corresponding date/time stamps for 

text messages shall be presented in a useable format. 

1 

SPT–CA–19 If a cellular forensic tool completes acquisition of the 

target device without error then the corresponding status (i.e., read, 

unread) for text messages shall be presented in a useable format. 

1 

SPT–CA–20 If a cellular forensic tool completes acquisition of the 

target device without error then the corresponding sender / recipient 

phone numbers for text messages shall be presented in a useable format. 

1 

SPT–CA–21 If a cellular forensic tool completes acquisition of the 

target device without error then MMS messages and associated audio 

shall be presented in a useable format. 

1 3.8 

SPT–CA–22 If a cellular forensic tool completes acquisition of the 

target device without error then MMS messages and associated graphic 

files shall be presented in a useable format. 

1 3.8 

SPT–CA–23 If a cellular forensic tool completes acquisition of the 

target device without error then MMS messages and associated video 

shall be presented in a useable format. 

1 3.8 

SPT–CA–24 If a cellular forensic tool completes acquisition of the 

target device without error then stand–alone audio files shall be 

presented in a useable format via either an internal application or 

suggested third–party application. 

1 

SPT–CA–25 If a cellular forensic tool completes acquisition of the 

target device without error then stand–alone graphic files shall be 

presented in a useable format via either an internal application or 

suggested third–party application. 

1 

SPT–CA–26 If a cellular forensic tool completes acquisition of the 

target device without error then stand–alone video files shall be 

presented in a useable format via either an internal application or 

suggested third–party application. 

1 

November 2010 32 of 196 Results of Device Seizure 4.0 
Assertions Tested Tests Anomaly 

SPT–CA–27 If a cellular forensic tool completes acquisition of the 

target device without error then device specific application related data 

shall be acquired and presented in a useable format via either an internal 

application or suggested third–party application. 

1 3.10 

SPT–CA–28 If a cellular forensic tool completes acquisition of the 

target device without error then Internet related data (i.e., bookmarks, 

visited sites) cached to the device shall be acquired and presented in a 

useable format. 

1 

SPT–CA–30 If a cellular forensic tool provides the user with a “Select 

All” individual device data objects then the tool shall complete the 

acquisition of all individually selected data objects without error. 

2 

SPT–CA–32 If a cellular forensic tool completes two consecutive 

logical acquisitions of the target device without error then the payload 

(data objects) on the mobile device shall remain consistent. 

1 

SPT–AO–25 If a cellular forensic tool completes acquisition of the 

target device without error then the tool shall present the acquired data 

in a useable format via supported generated report formats. 

1 

SPT–AO–26 If a cellular forensic tool completes acquisition of the 

target device without error then the tool shall present the acquired data 

in a useable format in a preview–pane view. 

1 

SPT–AO–27 If the case file or individual data objects are modified via 

third–party means then the tool shall provide protection mechanisms 

disallowing or reporting data modification. 

1 

SPT–AO–40 If the cellular forensic tool supports display of non–ASCII 

characters then the application should present address book entries in 

their native format. 

1 

SPT–AO–41 If the cellular forensic tool supports proper display of non– 

ASCII characters then the application should present text messages in 

their native format. 

1 

SPT–AO–43 If the cellular forensic tool supports hashing for individual 

data objects then the tool shall present the user with a hash value for 

each supported data object. 

1 

Table 4a–4f lists the assertions that were not tested, usually due to the tool not supporting 

an optional feature. 

Table 4a: Assertions Not Tested (iPhone 3Gs) 

Assertions Not Tested 

SPT–CA–30 If a cellular forensic tool provides the user with a “Select All” individual 

device data objects then the tool shall complete the acquisition of all individually selected 

data objects without error. 

SPT–CA–31 If a cellular forensic tool provides the user with the ability to “Select 

Individual” device data objects for acquisition then the tool shall acquire each exclusive 

data object without error. 

November 2010 33 of 196 Results of Device Seizure 4.0 
Assertions Not Tested 

SPT–AO–23 If a cellular forensic tool provides the user with an “Select All” individual 

SIM data objects then the tool shall complete the acquisition of all individually selected 

data objects without error. 

SPT–AO–24 If a cellular forensic tool provides the user with the ability to “Select 

Individual” SIM data objects for acquisition then the tool shall acquire each exclusive 

data object without error. 

SPT–AO–29 If a cellular forensic tool provides the examiner with the remaining number 

of authentication attempts then the application should provide an accurate count of the 

remaining PIN attempts. 

SPT–AO–30 If a cellular forensic tool provides the examiner with the remaining number 

of PUK attempts then the application should provide an accurate count of the remaining 

PUK attempts. 

SPT–AO–31 If the cellular forensic tool supports a physical acquisition of the target 

device then the tool shall complete the acquisition without error. 

SPT–AO–32 If the cellular forensic tool supports the interpretation of address book 

entries present on the target device then the tool shall report recoverable active and 

deleted data or address book data remnants in a useable format. 

SPT–AO–33 If the cellular forensic tool supports the interpretation of calendar, tasks, or 

notes present on the target device then the tool shall report recoverable active and deleted 

calendar, tasks, or note data remnants in a useable format. 

SPT–AO–34 If the cellular forensic tool supports the interpretation of call logs present on 

the target device then the tool shall report recoverable active and deleted call or call log 

data remnants in a useable format. 

SPT–AO–35 If the cellular forensic tool supports the interpretation of SMS messages 

present on the target device then the tool shall report recoverable active and deleted SMS 

messages or SMS message data remnants in a useable format. 

SPT–AO–36 If the cellular forensic tool supports the interpretation of EMS messages 

present on the target device then the tool shall report recoverable active and deleted EMS 

messages or EMS message data remnants in a useable format. 

SPT–AO–37 If the cellular forensic tool supports the interpretation of audio files present 

on the target device then the tool shall report recoverable active and deleted audio data or 

audio file data remnants in a useable format. 

SPT–AO–38 If the cellular forensic tool supports the interpretation of graphic files 

present on the target device then the tool shall report recoverable active and deleted 

graphic file data or graphic file data remnants in a useable format. 

SPT–AO–39 If the cellular forensic tool supports the interpretation of video files present 

on the target device then the tool shall report recoverable active and deleted video file 

data or video file data remnants in a useable format. 

SPT–AO–42 If the cellular forensic tool supports stand–alone acquisition of internal 

memory with the SIM present, then the contents of the SIM shall not be modified during 

internal memory acquisition. 

Table 4b: Assertions Not Tested (Blackberry Bold 9700) 

Assertions Not Tested 

November 2010 34 of 196 Results of Device Seizure 4.0 
Assertions Not Tested 

SPT–CA–30 If a cellular forensic tool provides the user with a “Select All” individual 

device data objects then the tool shall complete the acquisition of all individually selected 

data objects without error. 

SPT–CA–31 If a cellular forensic tool provides the user with the ability to “Select 

Individual” device data objects for acquisition then the tool shall acquire each exclusive 

data object without error. 

SPT–AO–23 If a cellular forensic tool provides the user with an “Select All” individual 

SIM data objects then the tool shall complete the acquisition of all individually selected 

data objects without error. 

SPT–AO–24 If a cellular forensic tool provides the user with the ability to “Select 

Individual” SIM data objects for acquisition then the tool shall acquire each exclusive 

data object without error. 

SPT–AO–29 If a cellular forensic tool provides the examiner with the remaining number 

of authentication attempts then the application should provide an accurate count of the 

remaining PIN attempts. 

SPT–AO–30 If a cellular forensic tool provides the examiner with the remaining number 

of PUK attempts then the application should provide an accurate count of the remaining 

PUK attempts. 

SPT–AO–31 If the cellular forensic tool supports a physical acquisition of the target 

device then the tool shall complete the acquisition without error. 

SPT–AO–32 If the cellular forensic tool supports the interpretation of address book 

entries present on the target device then the tool shall report recoverable active and 

deleted data or address book data remnants in a useable format. 

SPT–AO–33 If the cellular forensic tool supports the interpretation of calendar, tasks, or 

notes present on the target device then the tool shall report recoverable active and deleted 

calendar, tasks, or note data remnants in a useable format. 

SPT–AO–34 If the cellular forensic tool supports the interpretation of call logs present on 

the target device then the tool shall report recoverable active and deleted call or call log 

data remnants in a useable format. 

SPT–AO–35 If the cellular forensic tool supports the interpretation of SMS messages 

present on the target device then the tool shall report recoverable active and deleted SMS 

messages or SMS message data remnants in a useable format. 

SPT–AO–36 If the cellular forensic tool supports the interpretation of EMS messages 

present on the target device then the tool shall report recoverable active and deleted EMS 

messages or EMS message data remnants in a useable format. 

SPT–AO–37 If the cellular forensic tool supports the interpretation of audio files present 

on the target device then the tool shall report recoverable active and deleted audio data or 

audio file data remnants in a useable format. 

SPT–AO–38 If the cellular forensic tool supports the interpretation of graphic files 

present on the target device then the tool shall report recoverable active and deleted 

graphic file data or graphic file data remnants in a useable format. 

SPT–AO–39 If the cellular forensic tool supports the interpretation of video files present 

on the target device then the tool shall report recoverable active and deleted video file 

data or video file data remnants in a useable format. 

SPT–AO–42 If the cellular forensic tool supports stand–alone acquisition of internal 

November 2010 35 of 196 Results of Device Seizure 4.0 
Assertions Not Tested 

memory with the SIM present, then the contents of the SIM shall not be modified during 

internal memory acquisition. 

SPT–AO–44 If the cellular forensic tool supports acquisition of GPS data then the tool 

shall present the user with the longitude and latitude coordinates for all GPS–related data 

in a useable format. 

Table 4c: Assertions Not Tested (Nokia 6790) 

Assertions Not Tested 

SPT–CA–02 If a cellular forensic tool attempts to connect to a non–supported device 

then the tool shall notify the user that the device is not supported. 

SPT–CA–03 If connectivity between the mobile device and cellular forensic tool is 

disrupted then the tool shall notify the user that connectivity has been disrupted. 

SPT–CA–05 If a cellular forensic tool completes acquisition of the target device without 

error then subscriber–related information shall be presented in a useable format. 

SPT–CA–06 If a cellular forensic tool completes acquisition of the target device without 

error then equipment related information shall be presented in a useable format. 

SPT–CA–07 If a cellular forensic tool completes acquisition of the target device without 

error then address book entries shall be presented in a useable format. 

SPT–CA–08 If a cellular forensic tool completes acquisition of the target device without 

error then maximum length address book entries shall be presented in a useable format. 

SPT–CA–09 If a cellular forensic tool completes acquisition of the target device without 

error then address book entries containing special characters shall be presented in a 

useable format. 

SPT–CA–10 If a cellular forensic tool completes acquisition of the target device without 

error then address book entries containing blank names shall be presented in a useable 

format. 

SPT–CA–11 If a cellular forensic tool completes acquisition of the target device without 

error then email addresses associated with address book entries shall be presented in a 

useable format. 

SPT–CA–12 If a cellular forensic tool completes acquisition of the target device without 

error then graphics associated with address book entries shall be presented in a useable 

format. 

SPT–CA–13 If a cellular forensic tool completes acquisition of the target device without 

error then datebook, calendar, note entries shall be presented in a useable format. 

SPT–CA–14 If a cellular forensic tool completes acquisition of the target device without 

error then maximum length datebook, calendar, note entries shall be presented in a 

useable format. 

SPT–CA–15 If a cellular forensic tool completes acquisition of the target device without 

error then call logs (incoming/outgoing/missed) shall be presented in a useable format. 

SPT–CA–16 If a cellular forensic tool completes acquisition of the target device without 

error then the corresponding date/time stamps and the duration of the call for call logs 

shall be presented in a useable format. 

SPT–CA–17 If a cellular forensic tool completes acquisition of the target device without 

error then ASCII text messages (i.e., SMS, EMS) shall be presented in a useable format. 

November 2010 36 of 196 Results of Device Seizure 4.0 
Assertions Not Tested 

SPT–CA–18 If a cellular forensic tool completes acquisition of the target device without 

error then the corresponding date/time stamps for text messages shall be presented in a 

useable format. 

SPT–CA–19 If a cellular forensic tool completes acquisition of the target device without 

error then the corresponding status (i.e., read, unread) for text messages shall be 

presented in a useable format. 

SPT–CA–20 If a cellular forensic tool completes acquisition of the target device without 

error then the corresponding sender / recipient phone numbers for text messages shall be 

presented in a useable format. 

SPT–CA–21 If a cellular forensic tool completes acquisition of the target device without 

error then MMS messages and associated audio shall be presented in a useable format. 

SPT–CA–22 If a cellular forensic tool completes acquisition of the target device without 

error then MMS messages and associated graphic files shall be presented in a useable 

format. 

SPT–CA–23 If a cellular forensic tool completes acquisition of the target device without 

error then MMS messages and associated video shall be presented in a useable format. 

SPT–CA–24 If a cellular forensic tool completes acquisition of the target device without 

error then stand–alone audio files shall be presented in a useable format via either an 

internal application or suggested third–party application. 

SPT–CA–25 If a cellular forensic tool completes acquisition of the target device without 

error then stand–alone graphic files shall be presented in a useable format via either an 

internal application or suggested third–party application. 

SPT–CA–26 If a cellular forensic tool completes acquisition of the target device without 

error then stand–alone video files shall be presented in a useable format via either an 

internal application or suggested third–party application. 

SPT–CA–27 If a cellular forensic tool completes acquisition of the target device without 

error then device specific application related data shall be acquired and presented in a 

useable format via either an internal application or suggested third–party application. 

SPT–CA–28 If a cellular forensic tool completes acquisition of the target device without 

error then Internet related data (i.e., bookmarks, visited sites) cached to the device shall 

be acquired and presented in a useable format. 

SPT–AO–23 If a cellular forensic tool provides the user with an “Select All” individual 

SIM data objects then the tool shall complete the acquisition of all individually selected 

data objects without error. 

SPT–AO–24 If a cellular forensic tool provides the user with the ability to “Select 

Individual” SIM data objects for acquisition then the tool shall acquire each exclusive 

data object without error. 

SPT–AO–29 If a cellular forensic tool provides the examiner with the remaining number 

of authentication attempts then the application should provide an accurate count of the 

remaining PIN attempts. 

SPT–AO–30 If a cellular forensic tool provides the examiner with the remaining number 

of PUK attempts then the application should provide an accurate count of the remaining 

PUK attempts. 

SPT–AO–31 If the cellular forensic tool supports a physical acquisition of the target 

device then the tool shall complete the acquisition without error. 

November 2010 37 of 196 Results of Device Seizure 4.0 
Assertions Not Tested 

SPT–AO–32 If the cellular forensic tool supports the interpretation of address book 

entries present on the target device then the tool shall report recoverable active and 

deleted data or address book data remnants in a useable format. 

SPT–AO–33 If the cellular forensic tool supports the interpretation of calendar, tasks, or 

notes present on the target device then the tool shall report recoverable active and deleted 

calendar, tasks, or note data remnants in a useable format. 

SPT–AO–34 If the cellular forensic tool supports the interpretation of call logs present on 

the target device then the tool shall report recoverable active and deleted call or call log 

data remnants in a useable format. 

SPT–AO–35 If the cellular forensic tool supports the interpretation of SMS messages 

present on the target device then the tool shall report recoverable active and deleted SMS 

messages or SMS message data remnants in a useable format. 

SPT–AO–36 If the cellular forensic tool supports the interpretation of EMS messages 

present on the target device then the tool shall report recoverable active and deleted EMS 

messages or EMS message data remnants in a useable format. 

SPT–AO–37 If the cellular forensic tool supports the interpretation of audio files present 

on the target device then the tool shall report recoverable active and deleted audio data or 

audio file data remnants in a useable format. 

SPT–AO–38 If the cellular forensic tool supports the interpretation of graphic files 

present on the target device then the tool shall report recoverable active and deleted 

graphic file data or graphic file data remnants in a useable format. 

SPT–AO–39 If the cellular forensic tool supports the interpretation of video files present 

on the target device then the tool shall report recoverable active and deleted video file 

data or video file data remnants in a useable format. 

SPT–AO–42 If the cellular forensic tool supports stand–alone acquisition of internal 

memory with the SIM present, then the contents of the SIM shall not be modified during 

internal memory acquisition. 

SPT–AO–44 If the cellular forensic tool supports acquisition of GPS data then the tool 

shall present the user with the longitude and latitude coordinates for all GPS–related data 

in a useable format. 

Table 4d: Assertions Not Tested (HTC Touch Pro 2) 

Assertions Not Tested 

SPT–AO–01 If a cellular forensic tool provides support for connectivity of the target SIM 

then the tool shall successfully recognize the target SIM via all tool–supported interfaces 

(e.g., PC/SC reader, proprietary reader, smart phone itself). 

SPT–AO–02 If a cellular forensic tool attempts to connect to a non–supported SIM then 

the tool shall notify the user that the SIM is not supported. 

SPT–AO–03 If a cellular forensic tool loses connectivity with the SIM reader then the 

tool shall notify the user that connectivity has been disrupted. 

SPT–AO–04 If a cellular forensic tool completes acquisition of the target SIM without 

error then the SPN shall be presented in a useable format. 

SPT–AO–05 If a cellular forensic tool completes acquisition of the target SIM without 

error then the ICCID shall be presented in a useable format. 

SPT–AO–06 If a cellular forensic tool completes acquisition of the target SIM without 

November 2010 38 of 196 Results of Device Seizure 4.0 
Assertions Not Tested 

error then the IMSI shall be presented in a useable format. 

SPT–AO–07 If a cellular forensic tool completes acquisition of the target SIM without 

error then the MSISDN shall be presented in a useable format. 

SPT–AO–08 If a cellular forensic tool completes acquisition of the target SIM without 

error then ASCII Abbreviated Dialing Numbers (ADN) shall be presented in a useable 

format. 

SPT–AO–09 If a cellular forensic tool completes acquisition of the target SIM without 

error then maximum length ADNs shall be presented in a useable format. 

SPT–AO–10 If a cellular forensic tool completes acquisition of the SIM without error 

then ADNs containing special characters shall be presented in a useable format. 

SPT–AO–11 If a cellular forensic tool completes acquisition of the SIM without error 

then ADNs containing blank names shall be presented in a useable format. 

SPT–AO–12 If a cellular forensic tool completes acquisition of the target SIM without 

error then Last Numbers Dialed (LND) shall be presented in a useable format. 

SPT–AO–13 If a cellular forensic tool completes acquisition of the target SIM without 

error then the corresponding date/time stamps for LNDs shall be presented in a useable 

format. 

SPT–AO–14 If a cellular forensic tool completes acquisition of the target SIM without 

error then ASCII SMS text messages shall be presented in a useable format. 

SPT–AO–15 If a cellular forensic tool completes acquisition of the target SIM without 

error then ASCII EMS text messages shall be presented in a useable format. 

SPT–AO–16 If a cellular forensic tool completes acquisition of the target SIM without 

error then the corresponding date/time stamps for all text messages shall be presented in a 

useable format. 

SPT–AO–17 If a cellular forensic tool completes acquisition of the target SIM without 

error then the corresponding status (i.e., read, unread) for text messages shall be 

presented in a useable format. 

SPT–AO–18 If a cellular forensic tool completes acquisition of the target SIM without 

error then the corresponding sender / recipient phone numbers for text messages shall be 

presented in a useable format. 

SPT–AO–19 If the cellular forensic tool completes acquisition of the target SIM without 

error then deleted text messages that have not been overwritten shall be presented in a 

useable format. 

SPT–AO–20 If a cellular forensic tool completes acquisition of the target SIM without 

error then location related data (i.e., LOCI) shall be presented in a useable format. 

SPT–AO–21 If a cellular forensic tool completes acquisition of the target SIM without 

error then location related data (i.e., GRPSLOCI) shall be presented in a useable format. 

SPT–AO–22 If a cellular forensic tool provides the user with an “Acquire All” SIM data 

objects acquisition option then the tool shall complete the acquisition of all data objects 

without error. 

SPT–AO–23 If a cellular forensic tool provides the user with a “Select All” individual 

SIM data objects then the tool shall complete the acquisition of all individually selected 

data objects without error. 

SPT–AO–24 If a cellular forensic tool provides the user with the ability to “Select 

Individual” SIM data objects for acquisition then the tool shall acquire each exclusive 

November 2010 39 of 196 Results of Device Seizure 4.0 
Assertions Not Tested 

data object without error. 

SPT–AO–28 If the SIM is password–protected then the cellular forensic tool shall 

provide the examiner with the opportunity to input the PIN before acquisition. 

SPT–AO–29 If a cellular forensic tool provides the examiner with the remaining number 

of authentication attempts then the application should provide an accurate count of the 

remaining PIN attempts. 

SPT–AO–30 If a cellular forensic tool provides the examiner with the remaining number 

of PUK attempts then the application should provide an accurate count of the remaining 

PUK attempts. 

SPT–AO–32 If the cellular forensic tool supports the interpretation of address book 

entries present on the target device then the tool shall report recoverable active and 

deleted data or address book data remnants in a useable format. 

SPT–AO–33 If the cellular forensic tool supports the interpretation of calendar, tasks, or 

notes present on the target device then the tool shall report recoverable active and deleted 

calendar, tasks, or note data remnants in a useable format. 

SPT–AO–34 If the cellular forensic tool supports the interpretation of call logs present on 

the target device then the tool shall report recoverable active and deleted call or call log 

data remnants in a useable format. 

SPT–AO–35 If the cellular forensic tool supports the interpretation of SMS messages 

present on the target device then the tool shall report recoverable active and deleted SMS 

messages or SMS message data remnants in a useable format. 

SPT–AO–36 If the cellular forensic tool supports the interpretation of EMS messages 

present on the target device then the tool shall report recoverable active and deleted EMS 

messages or EMS message data remnants in a useable format. 

SPT–AO–37 If the cellular forensic tool supports the interpretation of audio files present 

on the target device then the tool shall report recoverable active and deleted audio data or 

audio file data remnants in a useable format. 

SPT–AO–38 If the cellular forensic tool supports the interpretation of graphic files 

present on the target device then the tool shall report recoverable active and deleted 

graphic file data or graphic file data remnants in a useable format. 

SPT–AO–39 If the cellular forensic tool supports the interpretation of video files present 

on the target device then the tool shall report recoverable active and deleted video file 

data or video file data remnants in a useable format. 

SPT–AO–42 If the cellular forensic tool supports stand–alone acquisition of internal 

memory with the SIM present, then the contents of the SIM shall not be modified during 

internal memory acquisition. 

SPT–AO–44 If the cellular forensic tool supports acquisition of GPS data then the tool 

shall present the user with the longitude and latitude coordinates for all GPS–related data 

in a useable format. 

Table 4e: Assertions Not Tested (Blackberry 9630) 

Assertions Not Tested
 

SPT–AO–01 If a cellular forensic tool provides support for connectivity of the target SIM 

then the tool shall successfully recognize the target SIM via all tool–supported interfaces 

November 2010 40 of 196 Results of Device Seizure 4.0 
Assertions Not Tested 

(e.g., PC/SC reader, proprietary reader, smart phone itself). 

SPT–AO–02 If a cellular forensic tool attempts to connect to a non–supported SIM then 

the tool shall notify the user that the SIM is not supported. 

SPT–AO–03 If a cellular forensic tool loses connectivity with the SIM reader then the 

tool shall notify the user that connectivity has been disrupted. 

SPT–AO–04 If a cellular forensic tool completes acquisition of the target SIM without 

error then the SPN shall be presented in a useable format. 

SPT–AO–05 If a cellular forensic tool completes acquisition of the target SIM without 

error then the ICCID shall be presented in a useable format. 

SPT–AO–06 If a cellular forensic tool completes acquisition of the target SIM without 

error then the IMSI shall be presented in a useable format. 

SPT–AO–07 If a cellular forensic tool completes acquisition of the target SIM without 

error then the MSISDN shall be presented in a useable format. 

SPT–AO–08 If a cellular forensic tool completes acquisition of the target SIM without 

error then ASCII Abbreviated Dialing Numbers (ADN) shall be presented in a useable 

format. 

SPT–AO–09 If a cellular forensic tool completes acquisition of the target SIM without 

error then maximum length ADNs shall be presented in a useable format. 

SPT–AO–10 If a cellular forensic tool completes acquisition of the SIM without error 

then ADNs containing special characters shall be presented in a useable format. 

SPT–AO–11 If a cellular forensic tool completes acquisition of the SIM without error 

then ADNs containing blank names shall be presented in a useable format. 

SPT–AO–12 If a cellular forensic tool completes acquisition of the target SIM without 

error then Last Numbers Dialed (LND) shall be presented in a useable format. 

SPT–AO–13 If a cellular forensic tool completes acquisition of the target SIM without 

error then the corresponding date/time stamps for LNDs shall be presented in a useable 

format. 

SPT–AO–14 If a cellular forensic tool completes acquisition of the target SIM without 

error then ASCII SMS text messages shall be presented in a useable format. 

SPT–AO–15 If a cellular forensic tool completes acquisition of the target SIM without 

error then ASCII EMS text messages shall be presented in a useable format. 

SPT–AO–16 If a cellular forensic tool completes acquisition of the target SIM without 

error then the corresponding date/time stamps for all text messages shall be presented in a 

useable format. 

SPT–AO–17 If a cellular forensic tool completes acquisition of the target SIM without 

error then the corresponding status (i.e., read, unread) for text messages shall be 

presented in a useable format. 

SPT–AO–18 If a cellular forensic tool completes acquisition of the target SIM without 

error then the corresponding sender / recipient phone numbers for text messages shall be 

presented in a useable format. 

SPT–AO–19 If the cellular forensic tool completes acquisition of the target SIM without 

error then deleted text messages that have not been overwritten shall be presented in a 

useable format. 

SPT–AO–20 If a cellular forensic tool completes acquisition of the target SIM without 

error then location related data (i.e., LOCI) shall be presented in a useable format. 

November 2010 41 of 196 Results of Device Seizure 4.0 
Assertions Not Tested 

SPT–AO–21 If a cellular forensic tool completes acquisition of the target SIM without 

error then location related data (i.e., GRPSLOCI) shall be presented in a useable format. 

SPT–AO–22 If a cellular forensic tool provides the user with an “Acquire All” SIM data 

objects acquisition option then the tool shall complete the acquisition of all data objects 

without error. 

SPT–AO–23 If a cellular forensic tool provides the user with a “Select All” individual 

SIM data objects then the tool shall complete the acquisition of all individually selected 

data objects without error. 

SPT–AO–24 If a cellular forensic tool provides the user with the ability to “Select 

Individual” SIM data objects for acquisition then the tool shall acquire each exclusive 

data object without error. 

SPT–AO–28 If the SIM is password–protected then the cellular forensic tool shall 

provide the examiner with the opportunity to input the PIN before acquisition. 

SPT–AO–29 If a cellular forensic tool provides the examiner with the remaining number 

of authentication attempts then the application should provide an accurate count of the 

remaining PIN attempts. 

SPT–AO–30 If a cellular forensic tool provides the examiner with the remaining number 

of PUK attempts then the application should provide an accurate count of the remaining 

PUK attempts. 

SPT–AO–31 If the cellular forensic tool supports a physical acquisition of the target 

device then the tool shall complete the acquisition without error. 

SPT–AO–32 If the cellular forensic tool supports the interpretation of address book 

entries present on the target device then the tool shall report recoverable active and 

deleted data or address book data remnants in a useable format. 

SPT–AO–33 If the cellular forensic tool supports the interpretation of calendar, tasks, or 

notes present on the target device then the tool shall report recoverable active and deleted 

calendar, tasks, or note data remnants in a useable format. 

SPT–AO–34 If the cellular forensic tool supports the interpretation of call logs present on 

the target device then the tool shall report recoverable active and deleted call or call log 

data remnants in a useable format. 

SPT–AO–35 If the cellular forensic tool supports the interpretation of SMS messages 

present on the target device then the tool shall report recoverable active and deleted SMS 

messages or SMS message data remnants in a useable format. 

SPT–AO–36 If the cellular forensic tool supports the interpretation of EMS messages 

present on the target device then the tool shall report recoverable active and deleted EMS 

messages or EMS message data remnants in a useable format. 

SPT–AO–37 If the cellular forensic tool supports the interpretation of audio files present 

on the target device then the tool shall report recoverable active and deleted audio data or 

audio file data remnants in a useable format. 

SPT–AO–38 If the cellular forensic tool supports the interpretation of graphic files 

present on the target device then the tool shall report recoverable active and deleted 

graphic file data or graphic file data remnants in a useable format. 

SPT–AO–39 If the cellular forensic tool supports the interpretation of video files present 

on the target device then the tool shall report recoverable active and deleted video file 

data or video file data remnants in a useable format. 

November 2010 42 of 196 Results of Device Seizure 4.0 
Assertions Not Tested 

SPT–AO–42 If the cellular forensic tool supports stand–alone acquisition of internal 

memory with the SIM present, then the contents of the SIM shall not be modified during 

internal memory acquisition. 

SPT–AO–44 If the cellular forensic tool supports acquisition of GPS data then the tool 

shall present the user with the longitude and latitude coordinates for all GPS–related data 

in a useable format. 

Table 4f: Assertions Not Tested (Palm pixi) 

Assertions Not Tested 

SPT–CA–29 If a cellular forensic tool provides the user with an “Acquire All” device 

data objects acquisition option then the tool shall complete the acquisition of all data 

objects without error. 

SPT–CA–31 If a cellular forensic tool provides the user with the ability to “Select 

Individual” device data objects for acquisition then the tool shall acquire each exclusive 

data object without error. 

SPT–AO–01 If a cellular forensic tool provides support for connectivity of the target SIM 

then the tool shall successfully recognize the target SIM via all tool–supported interfaces 

(e.g., PC/SC reader, proprietary reader, smart phone itself). 

SPT–AO–02 If a cellular forensic tool attempts to connect to a non–supported SIM then 

the tool shall notify the user that the SIM is not supported. 

SPT–AO–03 If a cellular forensic tool loses connectivity with the SIM reader then the 

tool shall notify the user that connectivity has been disrupted. 

SPT–AO–04 If a cellular forensic tool completes acquisition of the target SIM without 

error then the SPN shall be presented in a useable format. 

SPT–AO–05 If a cellular forensic tool completes acquisition of the target SIM without 

error then the ICCID shall be presented in a useable format. 

SPT–AO–06 If a cellular forensic tool completes acquisition of the target SIM without 

error then the IMSI shall be presented in a useable format. 

SPT–AO–07 If a cellular forensic tool completes acquisition of the target SIM without 

error then the MSISDN shall be presented in a useable format. 

SPT–AO–08 If a cellular forensic tool completes acquisition of the target SIM without 

error then ASCII Abbreviated Dialing Numbers (ADN) shall be presented in a useable 

format. 

SPT–AO–09 If a cellular forensic tool completes acquisition of the target SIM without 

error then maximum length ADNs shall be presented in a useable format. 

SPT–AO–10 If a cellular forensic tool completes acquisition of the SIM without error 

then ADNs containing special characters shall be presented in a useable format. 

SPT–AO–11 If a cellular forensic tool completes acquisition of the SIM without error 

then ADNs containing blank names shall be presented in a useable format. 

SPT–AO–12 If a cellular forensic tool completes acquisition of the target SIM without 

error then Last Numbers Dialed (LND) shall be presented in a useable format. 

SPT–AO–13 If a cellular forensic tool completes acquisition of the target SIM without 

error then the corresponding date/time stamps for LNDs shall be presented in a useable 

format. 

November 2010 43 of 196 Results of Device Seizure 4.0 
Assertions Not Tested 

SPT–AO–14 If a cellular forensic tool completes acquisition of the target SIM without 

error then ASCII SMS text messages shall be presented in a useable format. 

SPT–AO–15 If a cellular forensic tool completes acquisition of the target SIM without 

error then ASCII EMS text messages shall be presented in a useable format. 

SPT–AO–16 If a cellular forensic tool completes acquisition of the target SIM without 

error then the corresponding date/time stamps for all text messages shall be presented in a 

useable format. 

SPT–AO–17 If a cellular forensic tool completes acquisition of the target SIM without 

error then the corresponding status (i.e., read, unread) for text messages shall be 

presented in a useable format. 

SPT–AO–18 If a cellular forensic tool completes acquisition of the target SIM without 

error then the corresponding sender / recipient phone numbers for text messages shall be 

presented in a useable format. 

SPT–AO–19 If the cellular forensic tool completes acquisition of the target SIM without 

error then deleted text messages that have not been overwritten shall be presented in a 

useable format. 

SPT–AO–20 If a cellular forensic tool completes acquisition of the target SIM without 

error then location related data (i.e., LOCI) shall be presented in a useable format. 

SPT–AO–21 If a cellular forensic tool completes acquisition of the target SIM without 

error then location related data (i.e., GRPSLOCI) shall be presented in a useable format. 

SPT–AO–22 If a cellular forensic tool provides the user with an “Acquire All” SIM data 

objects acquisition option then the tool shall complete the acquisition of all data objects 

without error. 

SPT–AO–23 If a cellular forensic tool provides the user with a “Select All” individual 

SIM data objects then the tool shall complete the acquisition of all individually selected 

data objects without error. 

SPT–AO–24 If a cellular forensic tool provides the user with the ability to “Select 

Individual” SIM data objects for acquisition then the tool shall acquire each exclusive 

data object without error. 

SPT–AO–28 If the SIM is password–protected then the cellular forensic tool shall 

provide the examiner with the opportunity to input the PIN before acquisition. 

SPT–AO–29 If a cellular forensic tool provides the examiner with the remaining number 

of authentication attempts then the application should provide an accurate count of the 

remaining PIN attempts. 

SPT–AO–30 If a cellular forensic tool provides the examiner with the remaining number 

of PUK attempts then the application should provide an accurate count of the remaining 

PUK attempts. 

SPT–AO–31 If the cellular forensic tool supports a physical acquisition of the target 

device then the tool shall complete the acquisition without error. 

SPT–AO–32 If the cellular forensic tool supports the interpretation of address book 

entries present on the target device then the tool shall report recoverable active and 

deleted data or address book data remnants in a useable format. 

SPT–AO–33 If the cellular forensic tool supports the interpretation of calendar, tasks, or 

notes present on the target device then the tool shall report recoverable active and deleted 

calendar, tasks, or note data remnants in a useable format. 

November 2010 44 of 196 Results of Device Seizure 4.0 
Assertions Not Tested 

SPT–AO–34 If the cellular forensic tool supports the interpretation of call logs present on 

the target device then the tool shall report recoverable active and deleted call or call log 

data remnants in a useable format. 

SPT–AO–35 If the cellular forensic tool supports the interpretation of SMS messages 

present on the target device then the tool shall report recoverable active and deleted SMS 

messages or SMS message data remnants in a useable format. 

SPT–AO–36 If the cellular forensic tool supports the interpretation of EMS messages 

present on the target device then the tool shall report recoverable active and deleted EMS 

messages or EMS message data remnants in a useable format. 

SPT–AO–37 If the cellular forensic tool supports the interpretation of audio files present 

on the target device then the tool shall report recoverable active and deleted audio data or 

audio file data remnants in a useable format. 

SPT–AO–38 If the cellular forensic tool supports the interpretation of graphic files 

present on the target device then the tool shall report recoverable active and deleted 

graphic file data or graphic file data remnants in a useable format. 

SPT–AO–39 If the cellular forensic tool supports the interpretation of video files present 

on the target device then the tool shall report recoverable active and deleted video file 

data or video file data remnants in a useable format. 

SPT–AO–42 If the cellular forensic tool supports stand–alone acquisition of internal 

memory with the SIM present, then the contents of the SIM shall not be modified during 

internal memory acquisition. 

SPT–AO–44 If the cellular forensic tool supports acquisition of GPS data then the tool 

shall present the user with the longitude and latitude coordinates for all GPS–related data 

in a useable format. 

The following sections provide detailed information for the anomalies specified in Tables 

3a – 3f. 

3.1 Device connectivity 

Connectivity to the Nokia 6790 by the supported cable interface was not successful for 

test case SPT–01. The following message was displayed: “Acquisition process has failed. 

Status: Failed, Action: Connecting..., Result: Connection error, Advice: Try to reacquire 

the device. If the error persists, please submit log to the Paraben support team.” 

3.2 Acquisition disruption 

Notification of device acquisition disruption was not successful for test case SPT–03 for 

the iPhone 3Gs, Blackberry Bold 9700 and the Blackberry 9630. The acquisition was 

disrupted by removing the cable from the mobile device during acquisition. 

3.3 Data acquisition review 

For test case SPT–04, data acquired from the HTC Touch Pro 2 was not viewable in the 

preview–pane. When acquiring memory image and file system data the reported data is 

only viewable through Paraben’s sorter tab. No data is displayed in the case tab. When 

attempting to save the case file the following error occurs: “Error, Unknown error.” 

November 2010 45 of 196 Results of Device Seizure 4.0 
3.4 Acquisition of subscriber related information 

Subscriber related data (MSISDN, IMEI, ESN) was not reported for test case SPT–05 for 

the following devices: Blackberry 9630, and the Palm pixi. 

3.5 Acquisition of PIM related data 

For test case SPT–06, graphics files associated with address book entries were not 

reported for the following devices: iPhone 3Gs, Blackberry Bold 9700, HTC Touch Pro 2, 

Blackberry 9630 and the Palm pixi. 

3.6 Acquisition of call log data / time stamp data 

Call duration data (i.e., seconds, minutes, hours) was not reported on test case SPT–07 

for the iPhone 3Gs and the Palm pixi. 

3.7 Acquisition of text message data 

Text messages (i.e., SMS, EMS) were not acquired on test case SPT–08 for the HTC 

Touch Pro 2. 

3.8 Acquisition of MMS related data 

For test case SPT–09, MMS messages or associated attachments (i.e., graphic, audio or 

video files) were not acquired from the HTC Touch Pro 2. Files associated with MMS 

messages were not acquired on test case SPT–09 for the Blackberry Bold 9700, 

Blackberry 9630 or the Palm pixi. 

3.9 Acquisition of stand–alone data files 

Acquisition of stand–alone data files (i.e., graphic, audio, or video files) on test case 

SPT–10 was not successful for the following devices: Blackberry Bold 9700, HTC Touch 

Pro 2, and the Blackberry 9630. 

3.10 Acquisition of application related data 

For test case SPT–11, acquisition of application related data was not successful for the 

following devices; iPhone 3Gs, Blackberry Bold 9700, Blackberry 9630 and the Palm 

pixi. 

3.11 Acquisition of Internet related data 

Internet related data was not acquired for test case SPT–12 for the Blackberry 9630. 

3.12 Report generation 

When attempting to generate the report on test case SPT–24 for the HTC Touch Pro 2 the 

following error occurred: “Reporting error: Object reference not set to an instance of an 

object.” 

3.13 Acquisition of password protected SIM 

For test case SPT–28 acquisition of AT&T password–protected SIMs contained in 

iPhone 3Gs, Blackberry Bold 9700, and the Nokia 6790 was unsuccessful. The ability to 

November 2010 46 of 196 Results of Device Seizure 4.0 
enter the PIN before acquisition was not available. The dialog box does not allow the user 

to proceed with the acquisition of SIM data after inputting the PIN. The "Next" button is 

not available for selection. 

3.14 Physical acquisition 

The data acquired from the HTC Touch Pro 2 using the physical acquisition plug–in was 

not decoded for test case SPT–31. 

3.15 Acquisition of non–ASCII data 

For test case SPT–33, address book entries and text messages containing non–ASCII 

characters were not reported in their native format for the Blackberry 9630. The non– 

ASCII data was reported as ‘? ? ? ?’. 

4 Testing Environment 

The tests were run in the NIST CFTT lab. This section describes the test computers 

available for testing. 

4.1 Test Computers 

One test computer was used. 

Morrisy has the following configuration: 

Intel® D975XBX2 Motherboard 

BIOS Version BX97520J.86A.2674.2007.0315.1546 

Intel® CoreTM2 Duo CPU 6700 @ 2.66Ghz 

3.25 GB RAM 

1.44 MB floppy drive 

LITE–ON CD H LH52N1P 

LITE–ON DVDRW LH–20A1P 

2 slots for removable SATA hard disk drive 

8 USB 2.0 slots 

2 IEEE 1394 ports 

3 IEEE 1394 ports (mini) 

4.2 Mobile Devices 

The following table contains the mobile devices used. 

Make Model OS Network 

Apple iPhone 3Gs iPhone AT&T 

Blackberry Bold 9700 Blackberry AT&T 

Nokia 6790 Symbian AT&T 

HTC Touch Pro 2 Windows Mobile 6.1 Sprint 

Blackberry Tour 9630 Blackberry Sprint 

November 2010 47 of 196 Results of Device Seizure 4.0 
 

 

 

Make Model OS Network 

Samsung Moment Android Sprint 

Palm pixi Palm OS Sprint 

4.3 Internal Memory Data Objects 

The following data objects were used to populate the internal memory of the smart 

phones. 

Data Objects Data Elements 

Address Book Entries 

Regular Length 

Maximum Length 

Special Character 

Blank Name 

 Regular Length, email 

Regular Length, graphic 

Deleted Entry 

 Non–ASCII Entry 

PIM Data 

Regular Length 

Maximum Length 

Deleted Entry 

Special Character 

Call Logs 

 Incoming 

Outgoing 

Missed

 Incoming – Deleted 

Outgoing – Deleted 

Missed – Deleted 

Text Messages 

 Incoming SMS – Read 

 Incoming SMS – Unread 

Outgoing SMS 

 Incoming EMS – Read 

 Incoming EMS – Unread 

Outgoing EMS 

 Incoming SMS – Deleted 

Outgoing SMS – Deleted 

 Incoming EMS – Deleted 

Outgoing EMS – Deleted 

 Non–ASCII EMS 

MMS Messages 

 Incoming Audio 

November 2010 48 of 196 Results of Device Seizure 4.0 
 

 

 

Data Objects Data Elements 

 Incoming Graphic 

 Incoming Video 

Outgoing Audio 

Outgoing Graphic 

Outgoing Video 

Stand–alone data files 

Audio 

Graphic 

Video 

Audio – Deleted 

Graphic – Deleted 

Video – Deleted 

Application Data 

Device Specific App Data 

Location Data 

GPS Coordinates 

4.4 Subscriber Identity Module Data Objects 

The following data objects were used to populate the Subscriber Identity Modules. 

Data Objects Data Elements 

Abbreviated Dialing Numbers (ADN) 

Maximum Length 

Special Character 

Blank Name 

 Non–ASCII Entry 

 Regular Length – Deleted Number 

Call Logs 

 Last Numbers Dialed (LND) 

Text Messages 

 Incoming SMS – Read 

 Incoming SMS – Unread 

 Non–ASCII SMS 

 Incoming SMS – Deleted 

 Non–ASCII EMS 

 Incoming EMS – Deleted 

5 Test Results 

The main item of interest for interpreting the test results is determining the conformance 

of the device with the test assertions. Conformance with each assertion tested by a given 

test case is evaluated by examining the Results box of the test case details. 

November 2010 49 of 196 Results of Device Seizure 4.0 
 

5.1 Test Results Report Key 

A summary of the actual test results is presented in this report. The following table 

presents a description of each section of the test report summary. 

Table 5 Test Results Report Key 

Heading Description 

First Line: Test case ID, name, and version of tool tested. 

Case Summary: Test case summary from Smart Phone Tool Test Assertion 

and Test Plan. 

Assertions: The test assertions applicable to the test case, selected from 

Smart Phone Tool Test Assertion and Test Plan. 

Tester Name: Name or initials of person executing test procedure. 

Test Host: Host computer executing the test. 

Test Date: Time and date that test was started. 

Device: Source mobile device, media (i.e., SIM). 

Source Setup: Acquisition interface. 

Log Highlights: Information extracted from various log files to illustrate 

conformance or non–conformance to the test assertions. 

Results Expected and actual results for each assertion tested. 

Analysis Whether or not the expected results were achieved. 

5.2 Test Details 

5.2.1 SPT–01 (iPhone 3Gs) 

Test Case SPT–01 Device Seizure 4.0 

Case 

Summary: 

SPT–01 Acquire mobile device internal memory over tool–supported interfaces

(e.g., cable, Bluetooth, IrDA).

Assertions: SPT–CA–01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

SPT–CA–04 If a cellular forensic tool completes acquisition of the target

device without error then the tool shall have the ability to present

acquired data objects in a useable format via either a preview–pane or

generated report.

SPT–CA–29 If a cellular forensic tool provides the user with an “Acquire

All” device data objects acquisition option then the tool shall complete

the acquisition of all data objects without error.

SPT–CA–30 If a cellular forensic tool provides the user with a “Select All”

individual device data objects then the tool shall complete the acquisition

of all individually selected data objects without error.

SPT–CA–31 If a cellular forensic tool provides the user with the ability to

“Select Individual” device data objects for acquisition then the tool shall

acquire each exclusive data object without error.

SPT–CA–32 If a cellular forensic tool completes two consecutive logical

acquisitions of the target device without error then the payload (data

objects) on the mobile device shall remain consistent. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Mon Jul 19 08:44:09 EDT 2010 

Device: iPhone3Gs 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

November 2010 50 of 196 Results of Device Seizure 4.0 
 

Test Case SPT–01 Device Seizure 4.0 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 08:44:09 EDT 2010

Acquisition finished: Mon Jul 19 08:51:43 EDT 2010 

Device connectivity was established via supported interface 

Notes: 

iPhone advanced logical acquisition was selected. 

Results: 

Assertion & Expected Result 

SPT–CA–01 Device connectivity via supported interfaces.

SPT–CA–04 Readability and completeness of acquired data via

supported reports.

SPT–CA–29 Acquire–All data objects acquisition.

SPT–CA–30 Select–All data objects acquisition.

SPT–CA–31 Select–Individual data objects acquisition.

SPT–CA–32 Perform back–to–back acquisitions, check device

payload for modifications. 

Actual 

Result 

as expected

as expected 

as expected

as expected

as expected

as expected 

Analysis: Expected results achieved 

November 2010 51 of 196 Results of Device Seizure 4.0 
 

5.2.2 SPT–02 (iPhone 3Gs) 

Test Case SPT–02 Device Seizure 4.0 

Case 

Summary: 

SPT–02 Attempt internal memory acquisition of a non–supported mobile

device. 

Assertions: SPT–CA–02 If a cellular forensic tool attempts to connect to a non–

supported device then the tool shall notify the user that the device is not

supported. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 09:00:25 EDT 2010 

Device: unsupported_device

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 09:00:25 EDT 2010

Acquisition finished: Mon Jul 19 09:02:12 EDT 2010 

Identification of non–supported devices was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–02 Identification of non–supported devices. as expected 

Analysis: Expected results achieved 

November 2010 52 of 196 Results of Device Seizure 4.0 
 

5.2.3 SPT–03 (iPhone 3Gs) 

Test Case SPT–03 Device Seizure 4.0 

Case 

Summary: 

SPT–03 Begin mobile device internal memory acquisition and interrupt

connectivity by interface disengagement.

Assertions: SPT–CA–03 If connectivity between the mobile device and cellular forensic

tool is disrupted then the tool shall notify the user that connectivity has

been disrupted. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 09:02:42 EDT 2010 

Device: iPhone3Gs 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 09:02:42 EDT 2010

Acquisition finished: Mon Jul 19 09:04:12 EDT 2010 

Device acquisition disruption notification was not successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–03 Notification of device acquisition

disruption. 

Not as 

expected 

Analysis: Expected results Not achieved 

November 2010 53 of 196 Results of Device Seizure 4.0 
 

5.2.4 SPT–04 (iPhone 3Gs) 

Test Case SPT–04 Device Seizure 4.0 

Case 

Summary: 

SPT–04 Acquire mobile device internal memory and review reported data via

the preview–pane or generated reports for readability.

Assertions: SPT–CA–04 If a cellular forensic tool completes acquisition of the target

device without error then the tool shall have the ability to present

acquired data objects in a useable format via either a preview–pane or

generated report. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Mon Jul 19 09:10:33 EDT 2010 

Device: iPhone3Gs 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 09:10:33 EDT 2010

Acquisition finished: Mon Jul 19 09:18:38 EDT 2010 

Readability and completeness of acquired data was successful 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–CA–04 Readability and completeness of acquired data

via supported reports. 

as expected 

Analysis: Expected results achieved 

November 2010 54 of 196 Results of Device Seizure 4.0 
 

5.2.5 SPT–05 (iPhone 3Gs) 

Test Case SPT–05 Device Seizure 4.0 

Case 

Summary: 

SPT–05 Acquire mobile device internal memory and review reported subscriber

and equipment related information (e.g., IMEI/MEID/ESN, MSISDN).

Assertions: SPT–CA–05 If a cellular forensic tool completes acquisition of the target

device without error then subscriber–related information shall be presented

in a useable format. 

SPT–CA–06 If a cellular forensic tool completes acquisition of the target

device without error then equipment related information shall be presented

in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 09:21:30 EDT 2010 

Device: iPhone3Gs 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 09:21:30 EDT 2010

Acquisition finished: Mon Jul 19 09:24:25 EDT 2010 

Subscriber and Equipment related data (i.e., MSISDN, IMEI) were acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–05 Acquisition of MSISDN, IMSI. as expected

SPT–CA–06 Acquisition of IMEI/MEID/ESN. as expected 

Analysis: Expected results achieved 

November 2010 55 of 196 Results of Device Seizure 4.0 
5.2.6 SPT–06 (iPhone 3Gs) 

Test Case SPT–06 Device Seizure 4.0 

Case SPT–06 Acquire mobile device internal memory and review reported PIM

Summary: related data. 

Assertions: SPT–CA–07 If a cellular forensic tool completes acquisition of the target

device without error then address book entries shall be presented in a

useable format. 

SPT–CA–08 If a cellular forensic tool completes acquisition of the target

device without error then maximum length address book entries shall be

presented in a useable format.

SPT–CA–09 If a cellular forensic tool completes acquisition of the target

device without error then address book entries containing special

characters shall be presented in a useable format.

SPT–CA–10 If a cellular forensic tool completes acquisition of the target

device without error then address book entries containing blank names shall

be presented in a useable format.

SPT–CA–11 If a cellular forensic tool completes acquisition of the target

device without error then email addresses associated with address book 

entries shall be presented in a useable format.

SPT–CA–12 If a cellular forensic tool completes acquisition of the target

device without error then graphics associated with address book entries

shall be presented in a useable format.

SPT–CA–13 If a cellular forensic tool completes acquisition of the target

device without error then datebook, calendar, note entries shall be

presented in a useable format.

SPT–CA–14 If a cellular forensic tool completes acquisition of the target

device without error then maximum length datebook, calendar, note entries

shall be presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 09:39:04 EDT 2010 

Device: iPhone3Gs 

Source OS: WIN XP 

Setup: Interface: cable 

Log Created by Device Seizure Version 4.0

Highlights: Acquisition started: Mon Jul 19 09:39:04 EDT 2010

Acquisition finished: Mon Jul 19 09:51:51 EDT 2010 

Regular Length Address Book entries were acquired

Maximum Length Address Book entries were acquired

Special Character Address Book entries were acquired

Blank Name Address Book entries were acquired

Email addresses within Address Book entries were acquired

Embedded graphics within Address Book entries were not acquired

ALL PIM related data was acquired 

Notes: 

Graphic files associated with address book entries were acquired but not

decoded. 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–CA–07 Acquisition of address book entries. as expected

SPT–CA–08 Acquisition of maximum length address book as expected

entries. 

SPT–CA–09 Acquisition of address book entries containing as expected

special characters.

SPT–CA–10 Acquisition of address book entries containing a as expected

blank name entry.

SPT–CA–11 Acquisition of embedded email addresses within as expected

address book entries. 

SPT–CA–12 Acquisition of embedded graphics within address partial

book entries. 

SPT–CA–13 Acquisition of PIM data (i.e., as expected

datebook/calendar, notes). 

November 2010 56 of 196 Results of Device Seizure 4.0 
 

Test Case SPT–06 Device Seizure 4.0 

SPT–CA–14 Acquisition of maximum length PIM data. as expected 

Analysis: Partial results achieved 

November 2010 57 of 196 Results of Device Seizure 4.0 
 

5.2.7 SPT–07 (iPhone 3Gs) 

Test Case SPT–07 Device Seizure 4.0 

Case 

Summary: 

SPT–07 Acquire mobile device internal memory and review reported call logs. 

Assertions: SPT–CA–15 If a cellular forensic tool completes acquisition of the target

device without error then call logs (incoming/outgoing/missed) shall be

presented in a useable format.

SPT–CA–16 If a cellular forensic tool completes acquisition of the target

device without error then the corresponding date/time stamps and the

duration of the call for call logs shall be presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 09:56:26 EDT 2010 

Device: iPhone3Gs 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 09:56:26 EDT 2010

Acquisition finished: Mon Jul 19 10:02:26 EDT 2010 

All Call Logs (incoming, outgoing, missed) were acquired

All Call Log date/time stamps data were not correctly reported 

Notes: 

The duration of the call is not specified if it is seconds, minutes, or

hours. 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–15 Acquisition of call logs. as expected

SPT–CA–16 Acquisition of call log date/time stamps. partial 

Analysis: Partial results achieved 

November 2010 58 of 196 Results of Device Seizure 4.0 
 

5.2.8 SPT–08 (iPhone 3Gs) 

Test Case SPT–08 Device Seizure 4.0 

Case 

Summary: 

SPT–08 Acquire mobile device internal memory and review reported text

messages.

Assertions: SPT–CA–17 If a cellular forensic tool completes acquisition of the target

device without error then ASCII text messages (i.e., SMS, EMS) shall be

presented in a useable format.

SPT–CA–18 If a cellular forensic tool completes acquisition of the target

device without error then the corresponding date/time stamps for text

messages shall be presented in a useable format.

SPT–CA–19 If a cellular forensic tool completes acquisition of the target

device without error then the corresponding status (i.e., read, unread) for

text messages shall be presented in a useable format.

SPT–CA–20 If a cellular forensic tool completes acquisition of the target

device without error then the corresponding sender / recipient phone

numbers for text messages shall be presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 10:05:00 EDT 2010 

Device: iPhone3Gs 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 10:05:00 EDT 2010

Acquisition finished: Mon Jul 19 10:10:30 EDT 2010 

ALL text messages (SMS, EMS) were acquired

Correct date/time stamps were reported for all text messages

Correct status flags were reported for all text messages

Sender and Recipient phone numbers associated with text messages were

correctly reported 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–CA–17 Acquisition of text messages. as expected

SPT–CA–18 Acquisition of text message date/time stamps. as expected

SPT–CA–19 Acquisition of text message status flags. as expected

SPT–CA–20 Acquisition of sender/recipient phone number

associated with text messages. 

as expected 

Analysis: Expected results achieved 

November 2010 59 of 196 Results of Device Seizure 4.0 
 

5.2.9 SPT–09 (iPhone 3Gs) 

Test Case SPT–09 Device Seizure 4.0 

Case 

Summary: 

SPT–09 Acquire mobile device internal memory and review reported MMS multi–

media related data (i.e., text, audio, graphics, video).

Assertions: SPT–CA–21 If a cellular forensic tool completes acquisition of the target

device without error then MMS messages and associated audio shall be

presented in a useable format.

SPT–CA–22 If a cellular forensic tool completes acquisition of the target

device without error then MMS messages and associated graphic files shall

be presented in a useable format.

SPT–CA–23 If a cellular forensic tool completes acquisition of the target

device without error then MMS messages and associated video shall be

presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 10:25:25 EDT 2010 

Device: iPhone3Gs 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 10:25:25 EDT 2010

Acquisition finished: Mon Jul 19 10:44:00 EDT 2010 

ALL MMS messages (Audio, Image, Video) were acquired 

Notes: 

The MMS embedded objects (i.e., graphics, audio, video) are not associated

or linked to the MMS text. 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–CA–21 Acquisition of audio MMS messages. as expected

SPT–CA–22 Acquisition of graphic data image MMS

messages. 

as expected 

SPT–CA–23 Acquisition of video MMS messages. as expected 

Analysis: Expected results achieved 

November 2010 60 of 196 Results of Device Seizure 4.0 
 

5.2.10 SPT–10 (iPhone 3Gs) 

Test Case SPT–10 Device Seizure 4.0 

Case 

Summary: 

SPT–10 Acquire mobile device internal memory and review reported stand–

alone multi–media data (i.e., audio, graphics, video).

Assertions: SPT–CA–24 If a cellular forensic tool completes acquisition of the target

device without error then stand–alone audio files shall be presented in a

useable format via either an internal application or suggested third–party

application.

SPT–CA–25 If a cellular forensic tool completes acquisition of the target

device without error then stand–alone graphic files shall be presented in a

useable format via either an internal application or suggested third–party

application.

SPT–CA–26 If a cellular forensic tool completes acquisition of the target

device without error then stand–alone video files shall be presented in a

useable format via either an internal application or suggested third–party

application. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Mon Jul 19 10:45:59 EDT 2010 

Device: iPhone3Gs 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 10:45:59 EDT 2010

Acquisition finished: Mon Jul 19 11:02:46 EDT 2010 

ALL stand–alone data files (Audio, Image, Video) were acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–24 Acquisition of stand–alone audio files. as expected

SPT–CA–25 Acquisition of stand–alone graphic files. as expected

SPT–CA–26 Acquisition of stand–alone video files. as expected 

Analysis: Expected results achieved 

November 2010 61 of 196 Results of Device Seizure 4.0 
 

5.2.11 SPT–11 (iPhone 3Gs) 

Test Case SPT–11 Device Seizure 4.0 

Case 

Summary: 

SPT–11 Acquire mobile device internal memory and review application related

data (i.e., word documents, spreadsheet, presentation documents).

Assertions: SPT–CA–27 If a cellular forensic tool completes acquisition of the target

device without error then device specific application related data shall be

acquired and presented in a useable format via either an internal

application or suggested third–party application. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Mon Jul 19 11:03:31 EDT 2010 

Device: iPhone3Gs 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 11:03:31 EDT 2010

Acquisition finished: Mon Jul 19 11:20:34 EDT 2010 

Application data was not acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–27 Acquisition of application related data. Not as expected 

Analysis: Expected results Not achieved 

November 2010 62 of 196 Results of Device Seizure 4.0 
 

5.2.12 SPT–12 (iPhone 3Gs) 

Test Case SPT–12 Device Seizure 4.0 

Case 

Summary: 

SPT–12 Acquire mobile device internal memory and review Internet related

data (i.e., bookmarks, visited sites.

Assertions: SPT–CA–28 If a cellular forensic tool completes acquisition of the target

device without error then Internet related data (i.e., bookmarks, visited

sites) cached to the device shall be acquired and presented in a useable

format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 11:21:12 EDT 2010 

Device: iPhone3Gs 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 11:21:12 EDT 2010

Acquisition finished: Mon Jul 19 11:25:27 EDT 2010 

All Internet related data was acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–28 Acquisition of Internet related data. as expected 

Analysis: Expected results achieved 

November 2010 63 of 196 Results of Device Seizure 4.0 
 

5.2.13 SPT–13 (iPhone 3Gs) 

Test Case SPT–13 Device Seizure 4.0 

Case 

Summary: 

SPT–13 Acquire mobile device internal memory by selecting a combination of

supported data elements.

Assertions: SPT–CA–29 If a cellular forensic tool provides the user with an “Acquire

All” device data objects acquisition option then the tool shall complete

the acquisition of all data objects without error. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 11:25:50 EDT 2010 

Device: iPhone3Gs 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 11:25:50 EDT 2010

Acquisition finished: Mon Jul 19 11:29:37 EDT 2010 

Acquire All acquisition was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–29 Acquire–All data objects acquisition. as expected 

Analysis: Expected results achieved 

November 2010 64 of 196 Results of Device Seizure 4.0 
 

5.2.14 SPT–14 (iPhone 3Gs) 

Test Case SPT–14 Device Seizure 4.0 

Case 

Summary: 

SPT–14 Acquire SIM memory over supported interfaces (e.g., PC/SC reader). 

Assertions: SPT–AO–01 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all tool–supported interfaces (e.g., PC/SC reader, proprietary reader,

smart phone itself). 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Mon Jul 19 11:56:16 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 11:56:16 EDT 2010

Acquisition finished: Mon Jul 19 11:59:52 EDT 2010 

Media connectivity was established via supported interface 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–01 SIM connectivity via supported interfaces. as expected 

Analysis: Expected results achieved 

November 2010 65 of 196 Results of Device Seizure 4.0 
 

5.2.15 SPT–15 (iPhone 3Gs) 

Test Case SPT–15 Device Seizure 4.0 

Case 

Summary: 

SPT–15 Attempt acquisition of a non–supported SIM. 

Assertions: SPT–AO–02 If a cellular forensic tool attempts to connect to a non–

supported SIM then the tool shall notify the user that the SIM is not

supported. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 12:12:53 EDT 2010 

Device: non_supported

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 12:12:53 EDT 2010

Acquisition finished: Mon Jul 19 12:15:47 EDT 2010 

Identification of non–supported media was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–02 Identification of non–supported SIMs. as expected 

Analysis: Expected results achieved 

November 2010 66 of 196 Results of Device Seizure 4.0 
 

5.2.16 SPT–16 (iPhone 3Gs) 

Test Case SPT–16 Device Seizure 4.0 

Case 

Summary: 

SPT–16 Begin SIM acquisition and interrupt connectivity by interface

disengagement.

Assertions: SPT–AO–03 If a cellular forensic tool loses connectivity with the SIM

reader then the tool shall notify the user that connectivity has been

disrupted. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 12:17:43 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 12:17:43 EDT 2010

Acquisition finished: Mon Jul 19 12:19:00 EDT 2010 

Media acquisition disruption notification was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–03 Notification of SIM acquisition disruption. as expected 

Analysis: Expected results achieved 

November 2010 67 of 196 Results of Device Seizure 4.0 
 

5.2.17 SPT–17 (iPhone 3Gs) 

Test Case SPT–17 Device Seizure 4.0 

Case 

Summary: 

SPT–17 Acquire SIM memory and review reported subscriber and equipment

related information (i.e., SPN, ICCID, IMSI, MSISDN).

Assertions: SPT–AO–04 If a cellular forensic tool completes acquisition of the target

SIM without error then the SPN shall be presented in a useable format.

SPT–AO–05 If a cellular forensic tool completes acquisition of the target

SIM without error then the ICCID shall be presented in a useable format.

SPT–AO–06 If a cellular forensic tool completes acquisition of the target

SIM without error then the IMSI shall be presented in a useable format.

SPT–AO–07 If a cellular forensic tool completes acquisition of the target

SIM without error then the MSISDN shall be presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 12:31:21 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 12:31:21 EDT 2010

Acquisition finished: Mon Jul 19 12:35:07 EDT 2010 

All subscriber–related data (i.e., SPN, ICCID, IMSI, MSISDN) was acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–04 Acquisition of SPN. as expected

SPT–AO–05 Acquisition of ICCID. as expected

SPT–AO–06 Acquisition of IMSI. as expected

SPT–AO–07 Acquisition of MSISDN. as expected 

Analysis: Expected results achieved 

November 2010 68 of 196 Results of Device Seizure 4.0 
 

5.2.18 SPT–18 (iPhone 3Gs) 

Test Case SPT–18 Device Seizure 4.0 

Case 

Summary: 

SPT–18 Acquire SIM memory and review reported Abbreviated Dialing Numbers

(ADN).

Assertions: SPT–AO–08 If a cellular forensic tool completes acquisition of the target

SIM without error then ASCII Abbreviated Dialing Numbers (ADN) shall be

presented in a useable format.

SPT–AO–09 If a cellular forensic tool completes acquisition of the target

SIM without error then maximum length ADNs shall be presented in a useable

format. 

SPT–AO–10 If a cellular forensic tool completes acquisition of the SIM

without error then ADNs containing special characters shall be presented in

a useable format. 

SPT–AO–11 If a cellular forensic tool completes acquisition of the SIM

without error then ADNs containing blank names shall be presented in a

useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 12:35:33 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 12:35:33 EDT 2010

Acquisition finished: Mon Jul 19 12:50:11 EDT 2010 

All ADNs were acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–08 Acquisition of ADNs. as expected

SPT–AO–09 Acquisition of maximum length ADNs. as expected

SPT–AO–10 Acquisition of special character ADNs. as expected

SPT–AO–11 Acquisition of blank name ADNs. as expected 

Analysis: Expected results achieved 

November 2010 69 of 196 Results of Device Seizure 4.0 
 

5.2.19 SPT–19 (iPhone 3Gs) 

Test Case SPT–19 Device Seizure 4.0 

Case 

Summary: 

SPT–19 Acquire SIM memory and review reported Last Numbers Dialed (LND). 

Assertions: SPT–AO–12 If a cellular forensic tool completes acquisition of the target

SIM without error then Last Numbers Dialed (LND) shall be presented in a

useable format. 

SPT–AO–13 If a cellular forensic tool completes acquisition of the target

SIM without error then the corresponding date/time stamps for LNDs shall be

presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 12:50:41 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 12:50:41 EDT 2010

Acquisition finished: Mon Jul 19 12:52:59 EDT 2010 

LNDs were acquired

Date/Time Stamps correctly reported for LNDs 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–12 Acquisition of LNDs. as expected

SPT–AO–13 Acquisition of LND date/time stamps. as expected 

Analysis: Expected results achieved 

November 2010 70 of 196 Results of Device Seizure 4.0 
 

5.2.20 SPT–20 (iPhone 3Gs) 

Test Case SPT–20 Device Seizure 4.0 

Case 

Summary: 

SPT–20 Acquire SIM memory and review reported text messages (SMS, EMS). 

Assertions: SPT–AO–14 If a cellular forensic tool completes acquisition of the target

SIM without error then ASCII SMS text messages shall be presented in a

useable format. 

SPT–AO–15 If a cellular forensic tool completes acquisition of the target

SIM without error then ASCII EMS text messages shall be presented in a

useable format. 

SPT–AO–16 If a cellular forensic tool completes acquisition of the target

SIM without error then the corresponding date/time stamps for all text

messages shall be presented in a useable format.

SPT–AO–17 If a cellular forensic tool completes acquisition of the target

SIM without error then the corresponding status (i.e., read, unread) for

text messages shall be presented in a useable format.

SPT–AO–18 If a cellular forensic tool completes acquisition of the target

SIM without error then the corresponding sender / recipient phone numbers

for text messages shall be presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 12:53:24 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 12:53:24 EDT 2010

Acquisition finished: Mon Jul 19 13:08:45 EDT 2010 

ALL text messages (SMS, EMS) were acquired

All date/time stamps were reported for text messages

Correct status flags were reported for text messages

Sender and Recipient phone numbers associated with text messages were

correctly reported 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–14 Acquisition of SMS messages. as expected

SPT–AO–15 Acquisition of EMS messages. as expected

SPT–AO–16 Acquisition of text message date/time stamps. as expected

SPT–AO–17 Acquisition of text message status flags. as expected

SPT–AO–18 Acquisition of sender/recipient phone number

associated with text messages. 

as expected 

Analysis: Expected results achieved 

November 2010 71 of 196 Results of Device Seizure 4.0 
 

5.2.21 SPT–21 (iPhone 3Gs) 

Test Case SPT–21 Device Seizure 4.0 

Case 

Summary: 

SPT–21 Acquire SIM memory and review recoverable deleted text messages

(SMS, EMS).

Assertions: SPT–AO–19 If the cellular forensic tool completes acquisition of the target

SIM without error then deleted text messages that have not been overwritten

shall be presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 13:09:10 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 13:09:10 EDT 2010

Acquisition finished: Mon Jul 19 13:12:41 EDT 2010 

Deleted text message data was recovered 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–19 Acquisition of non–overwritten deleted text

messages. 

as expected 

Analysis: Expected results achieved 

November 2010 72 of 196 Results of Device Seizure 4.0 
 

5.2.22 SPT–22 (iPhone 3Gs) 

Test Case SPT–22 Device Seizure 4.0 

Case 

Summary: 

SPT–22 Acquire SIM memory and review reported location related data (i.e.,

LOCI, GPRSLOCI).

Assertions: SPT–AO–20 If a cellular forensic tool completes acquisition of the target

SIM without error then location related data (i.e., LOCI) shall be

presented in a useable format.

SPT–AO–21 If a cellular forensic tool completes acquisition of the target

SIM without error then location related data (i.e., GRPSLOCI) shall be

presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 13:23:05 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 13:23:05 EDT 2010

Acquisition finished: Mon Jul 19 13:26:22 EDT 2010 

LOCI data was acquired

GPRSLOCI data was acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–20 Acquisition of LOCI information. as expected

SPT–AO–21 Acquisition of GPRSLOCI information. as expected 

Analysis: Expected results achieved 

November 2010 73 of 196 Results of Device Seizure 4.0 
 

5.2.23 SPT–23 (iPhone 3Gs) 

Test Case SPT–23 Device Seizure 4.0 

Case 

Summary: 

SPT–23 Acquire SIM memory by selecting a combination of supported data

elements. 

Assertions: SPT–AO–01 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all tool–supported interfaces (e.g., PC/SC reader, proprietary reader,

smart phone itself).

SPT–AO–22 If a cellular forensic tool provides the user with an “Acquire

All” SIM data objects acquisition option then the tool shall complete the

acquisition of all data objects without error. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Mon Jul 19 13:26:44 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 13:26:44 EDT 2010

Acquisition finished: Mon Jul 19 13:30:58 EDT 2010 

Acquire All acquisition was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–01 SIM connectivity via supported interfaces. as expected

SPT–AO–22 Acquire–All data objects acquisition. as expected 

Analysis: Expected results achieved 

November 2010 74 of 196 Results of Device Seizure 4.0 
 

5.2.24 SPT–24 (iPhone 3Gs) 

Test Case SPT–24 Device Seizure 4.0 

Case 

Summary: 

SPT–24 Acquire mobile device internal memory and review reported data via

supported generated report formats.

Assertions: SPT–AO–25 If a cellular forensic tool completes acquisition of the target

device without error then the tool shall present the acquired data in a

useable format via supported generated report formats. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 13:45:59 EDT 2010 

Device: iPhone3Gs 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 13:45:59 EDT 2010

Acquisition finished: Mon Jul 19 13:47:54 EDT 2010 

Complete representation of known data via generated reports was successful 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–25 Comparison of known device data elements via

generated reports. 

as expected 

Analysis: Expected results achieved 

November 2010 75 of 196 Results of Device Seizure 4.0 
 

5.2.25 SPT–25 (iPhone 3Gs) 

Test Case SPT–25 Device Seizure 4.0 

Case 

Summary: 

SPT–25 Acquire mobile device internal memory and review reported data via

the preview pane.

Assertions: SPT–AO–26 If a cellular forensic tool completes acquisition of the target

device without error then the tool shall present the acquired data in a

useable format in a preview–pane view. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 13:48:15 EDT 2010 

Device: iPhone3Gs 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 13:48:15 EDT 2010

Acquisition finished: Mon Jul 19 13:50:12 EDT 2010 

Complete representation of known data via preview–pane was successful 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–26 Comparison of known device data elements via

preview–pane. 

as expected 

Analysis: Expected results achieved 

November 2010 76 of 196 Results of Device Seizure 4.0 
 

5.2.26 SPT–26 (iPhone 3Gs) 

Test Case SPT–26 Device Seizure 4.0 

Case 

Summary: 

SPT–26 Acquire SIM memory and review reported data via supported generated

report formats.

Assertions: SPT–AO–25 If a cellular forensic tool completes acquisition of the SIM

without error then the tool shall present the acquired data in a useable

format via supported generated report formats. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 13:50:37 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 13:50:37 EDT 2010

Acquisition finished: Mon Jul 19 13:53:07 EDT 2010 

Complete representation of known data via generated reports was successful 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–25 Comparison of known device data elements via

generated reports. 

as expected 

Analysis: Expected results achieved 

November 2010 77 of 196 Results of Device Seizure 4.0 
 

5.2.27 SPT–27 (iPhone 3Gs) 

Test Case SPT–27 Device Seizure 4.0 

Case 

Summary: 

SPT–27 Acquire SIM memory and review reported data via the preview–pane. 

Assertions: SPT–AO–26 If a cellular forensic tool completes acquisition of the SIM

without error then the tool shall present the acquired data in a useable

format in a preview–pane view. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 13:55:30 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 13:55:30 EDT 2010

Acquisition finished: Mon Jul 19 13:57:08 EDT 2010 

Complete representation of known data via preview–pane was successful 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–26 Comparison of known device data elements via

preview–pane. 

as expected 

Analysis: Expected results achieved 

November 2010 78 of 196 Results of Device Seizure 4.0 
 

5.2.28 SPT–28 (iPhone 3Gs) 

Test Case SPT–28 Device Seizure 4.0 

Case 

Summary: 

SPT–28 Attempt acquisition of a password–protected SIM. 

Assertions: SPT–AO–28 If the SIM is password–protected then the cellular forensic tool

shall provide the examiner with the opportunity to input the PIN before

acquisition. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 13:57:45 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 13:57:45 EDT 2010

Acquisition finished: Mon Jul 19 14:01:39 EDT 2010 

Ability to enter PIN on protected media before acquisition was not

successful 

Notes: 

The dialog box does not allow the user to proceed with the acquisition of

SIM data after inputting the PIN. The "Next" button is not available for

selection. 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–28 Acquisition of password protected SIM. Not as expected 

Analysis: Expected results Not achieved 

November 2010 79 of 196 Results of Device Seizure 4.0 
 

5.2.29 SPT–29 (iPhone 3Gs) 

Test Case SPT–29 Device Seizure 4.0 

Case 

Summary: 

SPT–29 After a successful mobile device internal memory, alter the case

file via third–party means and attempt to re–open the case.

Assertions: SPT–AO–27 If the case file or individual data objects are modified via

third–party means then the tool shall provide protection mechanisms

disallowing or reporting data modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 14:06:59 EDT 2010 

Device: iPhone3Gs 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 14:06:59 EDT 2010

Acquisition finished: Mon Jul 19 14:08:48 EDT 2010 

Notification of modified device memory data was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–27 Notification of modified device case data. as expected 

Analysis: Expected results achieved 

November 2010 80 of 196 Results of Device Seizure 4.0 
 

5.2.30 SPT–30 (iPhone 3Gs) 

Test Case SPT–30 Device Seizure 4.0 

Case 

Summary: 

SPT–30 After a successful SIM acquisition, alter the case file via third–

party means and attempt to re–open the case.

Assertions: SPT–AO–27 If the case file or individual data objects are modified via

third–party means then the tool shall provide protection mechanisms

disallowing or reporting data modification. 

Tester Name: Rpa

Test Host: Morrisy

Test Date: Mon Jul 19 14:09:43 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 14:09:43 EDT 2010

Acquisition finished: Mon Jul 19 14:10:36 EDT 2010 

Notification of modified SIM data was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–27 Notification of modified device case data. as expected 

Analysis: Expected results achieved 

November 2010 81 of 196 Results of Device Seizure 4.0 
 

5.2.31 SPT–33 (iPhone 3Gs) 

Test Case SPT–33 Device Seizure 4.0 

Case 

Summary: 

SPT–33 Acquire mobile device internal memory and review data containing

non–ASCII characters. 

Assertions: SPT–AO–40 If the cellular forensic tool supports display of non–ASCII

characters then the application should present address book entries in

their native format. 

SPT–AO–41 If the cellular forensic tool supports proper display of non–

ASCII characters then the application should present text messages in their

native format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 14:15:58 EDT 2010 

Device: iPhone3Gs 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 14:15:58 EDT 2010

Acquisition finished: Mon Jul 19 14:17:56 EDT 2010 

Non–ASCII Address book entries were acquired and properly displayed

Non–ASCII text messages were acquired and properly displayed 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–40 Acquisition of non–ASCII address book

entries/ADNs. 

as expected 

SPT–AO–41 Acquisition of non–ASCII text messages. as expected 

Analysis: Expected results achieved 

November 2010 82 of 196 Results of Device Seizure 4.0 
 

5.2.32 SPT–34 (iPhone 3Gs) 

Test Case SPT–34 Device Seizure 4.0 

Case 

Summary: 

SPT–34 Acquire SIM memory and review data containing non–ASCII characters. 

Assertions: SPT–AO–40 If the cellular forensic tool supports display of non–ASCII

characters then the application should present ADNs in their native format.

SPT–AO–41 If the cellular forensic tool supports proper display of non–

ASCII characters then the application should present text messages in their

native format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 14:18:23 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 14:18:23 EDT 2010

Acquisition finished: Mon Jul 19 14:21:38 EDT 2010 

Non–ASCII ADNs were acquired and properly displayed

Non–ASCII text messages were acquired and properly displayed 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–40 Acquisition of non–ASCII address book

entries/ADNs. 

as expected 

SPT–AO–41 Acquisition of non–ASCII text messages. as expected 

Analysis: Expected results achieved 

November 2010 83 of 196 Results of Device Seizure 4.0 
 

5.2.33 SPT–38 (iPhone 3Gs) 

Test Case SPT–38 Device Seizure 4.0 

Case 

Summary: 

SPT–38 Acquire mobile device internal memory and review hash values for

vendor supported data objects.

Assertions: SPT–AO–43 If the cellular forensic tool supports hashing for individual

data objects then the tool shall present the user with a hash value for

each supported data object. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 14:25:07 EDT 2010 

Device: iPhone3Gs 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 14:25:07 EDT 2010

Acquisition finished: Mon Jul 19 14:26:55 EDT 2010 

Hash values were properly reported for individually acquired device data

elements 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–43 Acquire data, check known hash values for

consistency. 

as expected 

Analysis: Expected results achieved 

November 2010 84 of 196 Results of Device Seizure 4.0 
 

5.2.34 SPT–39 (iPhone 3Gs) 

Test Case SPT–39 Device Seizure 4.0 

Case 

Summary: 

SPT–39 Acquire SIM memory and review hash values for vendor supported data

objects.

Assertions: SPT–AO–43 If the cellular forensic tool supports hashing for individual

data objects then the tool shall present the user with a hash value for

each supported data object. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 14:27:23 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 14:27:23 EDT 2010

Acquisition finished: Mon Jul 19 14:28:43 EDT 2010 

Hash values were properly reported for individually acquired SIM data

elements 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–43 Acquire data, check known hash values for

consistency. 

as expected 

Analysis: Expected results achieved 

November 2010 85 of 196 Results of Device Seizure 4.0 
 

5.2.35 SPT–40 (iPhone 3Gs) 

Test Case SPT–40 Device Seizure 4.0 

Case 

Summary: 

SPT–40 Acquire mobile device internal memory and review data containing GPS

longitude and latitude coordinates.

Assertions: SPT–AO–44 If the cellular forensic tool supports acquisition of GPS data

then the tool shall present the user with the longitude and latitude

coordinates for all GPS–related data in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Jul 19 14:29:20 EDT 2010 

Device: iPhone3Gs 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Mon Jul 19 14:29:20 EDT 2010

Acquisition finished: Mon Jul 19 14:36:34 EDT 2010 

GPS Coordinate data was successfully acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–44 Acquire data, check GPS data for consistency. as expected 

Analysis: Expected results achieved 

November 2010 86 of 196 Results of Device Seizure 4.0 
 

5.2.36 SPT–01 (Blackberry Bold 9700) 

Test Case SPT–01 Device Seizure 4.0 

Case 

Summary: 

SPT–01 Acquire mobile device internal memory over tool–supported interfaces

(e.g., cable, Bluetooth, IrDA).

Assertions: SPT–CA–01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

SPT–CA–04 If a cellular forensic tool completes acquisition of the target

device without error then the tool shall have the ability to present

acquired data objects in a useable format via either a preview–pane or

generated report.

SPT–CA–29 If a cellular forensic tool provides the user with an “Acquire

All” device data objects acquisition option then the tool shall complete

the acquisition of all data objects without error.

SPT–CA–32 If a cellular forensic tool completes two consecutive logical

acquisitions of the target device without error then the payload (data

objects) on the mobile device shall remain consistent. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Tue Jul 20 07:30:28 EDT 2010 

Device: Blackberry_bold9700

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 07:30:28 EDT 2010

Acquisition finished: Tue Jul 20 07:35:16 EDT 2010 

Device connectivity was established via supported interface 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–CA–01 Device connectivity via supported interfaces. as expected

SPT–CA–04 Readability and completeness of acquired data via

supported reports. 

as expected 

SPT–CA–29 Acquire–All data objects acquisition. as expected

SPT–CA–32 Perform back–to–back acquisitions, check device

payload for modifications. 

as expected 

Analysis: Expected results achieved 

November 2010 87 of 196 Results of Device Seizure 4.0 
 

5.2.37 SPT–02 (Blackberry Bold 9700) 

Test Case SPT–02 Device Seizure 4.0 

Case 

Summary: 

SPT–02 Attempt internal memory acquisition of a non–supported mobile

device. 

Assertions: SPT–CA–02 If a cellular forensic tool attempts to connect to a non–

supported device then the tool shall notify the user that the device is not

supported. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 07:35:42 EDT 2010 

Device: unsupported_device

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 07:35:42 EDT 2010

Acquisition finished: Tue Jul 20 07:38:24 EDT 2010 

Identification of non–supported devices was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–02 Identification of non–supported devices. as expected 

Analysis: Expected results achieved 

November 2010 88 of 196 Results of Device Seizure 4.0 
 

5.2.38 SPT–03 (Blackberry Bold 9700) 

Test Case SPT–03 Device Seizure 4.0 

Case 

Summary: 

SPT–03 Begin mobile device internal memory acquisition and interrupt

connectivity by interface disengagement.

Assertions: SPT–CA–03 If connectivity between the mobile device and cellular forensic

tool is disrupted then the tool shall notify the user that connectivity has

been disrupted. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 07:38:56 EDT 2010 

Device: Blackberry_bold9700

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 07:38:56 EDT 2010

Acquisition finished: Tue Jul 20 07:48:15 EDT 2010 

Device acquisition disruption notification was not successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–03 Notification of device acquisition

disruption. 

Not as 

expected 

Analysis: Expected results Not achieved 

November 2010 89 of 196 Results of Device Seizure 4.0 
 

5.2.39 SPT–04 (Blackberry Bold 9700) 

Test Case SPT–04 Device Seizure 4.0 

Case 

Summary: 

SPT–04 Acquire mobile device internal memory and review reported data via

the preview–pane or generated reports for readability.

Assertions: SPT–CA–04 If a cellular forensic tool completes acquisition of the target

device without error then the tool shall have the ability to present

acquired data objects in a useable format via either a preview–pane or

generated report. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Tue Jul 20 07:56:38 EDT 2010 

Device: Blackberry_bold9700

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 07:56:38 EDT 2010

Acquisition finished: Tue Jul 20 08:12:47 EDT 2010 

Readability and completeness of acquired data was successful 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–CA–04 Readability and completeness of acquired data

via supported reports. 

as expected 

Analysis: Expected results achieved 

November 2010 90 of 196 Results of Device Seizure 4.0 
 

5.2.40 SPT–05 (Blackberry Bold 9700) 

Test Case SPT–05 Device Seizure 4.0 

Case 

Summary: 

SPT–05 Acquire mobile device internal memory and review reported subscriber

and equipment related information (e.g., IMEI/MEID/ESN, MSISDN).

Assertions: SPT–CA–05 If a cellular forensic tool completes acquisition of the target

device without error then subscriber–related information shall be presented

in a useable format. 

SPT–CA–06 If a cellular forensic tool completes acquisition of the target

device without error then equipment related information shall be presented

in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 08:13:18 EDT 2010 

Device: Blackberry_bold9700

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 08:13:18 EDT 2010

Acquisition finished: Tue Jul 20 08:33:41 EDT 2010 

Subscriber and Equipment related data (i.e., MSISDN, IMEI) were acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–05 Acquisition of MSISDN, IMSI. as expected

SPT–CA–06 Acquisition of IMEI/MEID/ESN. as expected 

Analysis: Expected results achieved 

November 2010 91 of 196 Results of Device Seizure 4.0 
 

5.2.41 SPT–06 (Blackberry Bold 9700) 

Test Case SPT–06 Device Seizure 4.0 

Case 

Summary: 

SPT–06 Acquire mobile device internal memory and review reported PIM

related data. 

Assertions: SPT–CA–07 If a cellular forensic tool completes acquisition of the target

device without error then address book entries shall be presented in a

useable format. 

SPT–CA–08 If a cellular forensic tool completes acquisition of the target

device without error then maximum length address book entries shall be

presented in a useable format.

SPT–CA–09 If a cellular forensic tool completes acquisition of the target

device without error then address book entries containing special

characters shall be presented in a useable format.

SPT–CA–10 If a cellular forensic tool completes acquisition of the target

device without error then address book entries containing blank names shall

be presented in a useable format.

SPT–CA–11 If a cellular forensic tool completes acquisition of the target

device without error then email addresses associated with address book 

entries shall be presented in a useable format.

SPT–CA–12 If a cellular forensic tool completes acquisition of the target

device without error then graphics associated with address book entries

shall be presented in a useable format.

SPT–CA–13 If a cellular forensic tool completes acquisition of the target

device without error then datebook, calendar, note entries shall be

presented in a useable format.

SPT–CA–14 If a cellular forensic tool completes acquisition of the target

device without error then maximum length datebook, calendar, note entries

shall be presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 08:34:21 EDT 2010 

Device: Blackberry_bold9700

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log Created by Device Seizure Version 4.0

Highlights: Acquisition started: Tue Jul 20 08:34:21 EDT 2010

Acquisition finished: Tue Jul 20 08:47:25 EDT 2010 

Regular Length Address Book entries were acquired

Maximum Length Address Book entries were acquired

Special Character Address Book entries were acquired

Blank Name Address Book entries were acquired

Email addresses within Address Book entries were acquired

Embedded graphics within Address Book entries were not acquired

ALL PIM related data was acquired 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–CA–07 Acquisition of address book entries. as expected

SPT–CA–08 Acquisition of maximum length address book

entries. 

as expected 

SPT–CA–09 Acquisition of address book entries containing

special characters. 

as expected 

SPT–CA–10 Acquisition of address book entries containing a

blank name entry. 

as expected 

SPT–CA–11 Acquisition of embedded email addresses within

address book entries. 

as expected 

SPT–CA–12 Acquisition of embedded graphics within address

book entries. 

Not as 

expected

SPT–CA–13 Acquisition of PIM data (i.e.,

datebook/calendar, notes). 

as expected 

SPT–CA–14 Acquisition of maximum length PIM data. as expected 

November 2010 92 of 196 Results of Device Seizure 4.0 
Test Case SPT–06 Device Seizure 4.0 

Analysis: Partial results achieved 

November 2010 93 of 196 Results of Device Seizure 4.0 
 

5.2.42 SPT–07 (Blackberry Bold 9700) 

Test Case SPT–07 Device Seizure 4.0 

Case 

Summary: 

SPT–07 Acquire mobile device internal memory and review reported call logs. 

Assertions: SPT–CA–15 If a cellular forensic tool completes acquisition of the target

device without error then call logs (incoming/outgoing/missed) shall be

presented in a useable format.

SPT–CA–16 If a cellular forensic tool completes acquisition of the target

device without error then the corresponding date/time stamps and the

duration of the call for call logs shall be presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 08:48:31 EDT 2010 

Device: Blackberry_bold9700

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 08:48:31 EDT 2010

Acquisition finished: Tue Jul 20 08:51:16 EDT 2010 

All Call Logs (incoming, outgoing, missed) were acquired

All Call Log date/time stamps data were correctly reported 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–15 Acquisition of call logs. as expected

SPT–CA–16 Acquisition of call log date/time stamps. as expected 

Analysis: Expected results achieved 

November 2010 94 of 196 Results of Device Seizure 4.0 
 

5.2.43 SPT–08 (Blackberry Bold 9700) 

Test Case SPT–08 Device Seizure 4.0 

Case 

Summary: 

SPT–08 Acquire mobile device internal memory and review reported text

messages.

Assertions: SPT–CA–17 If a cellular forensic tool completes acquisition of the target

device without error then ASCII text messages (i.e., SMS, EMS) shall be

presented in a useable format.

SPT–CA–18 If a cellular forensic tool completes acquisition of the target

device without error then the corresponding date/time stamps for text

messages shall be presented in a useable format.

SPT–CA–19 If a cellular forensic tool completes acquisition of the target

device without error then the corresponding status (i.e., read, unread) for

text messages shall be presented in a useable format.

SPT–CA–20 If a cellular forensic tool completes acquisition of the target

device without error then the corresponding sender / recipient phone

numbers for text messages shall be presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 08:56:57 EDT 2010 

Device: Blackberry_bold9700

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 08:56:57 EDT 2010

Acquisition finished: Tue Jul 20 09:01:47 EDT 2010 

ALL text messages (SMS, EMS) were acquired

Correct date/time stamps were reported for all text messages

Correct status flags were reported for all text messages

Sender and Recipient phone numbers associated with text messages were

correctly reported 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–CA–17 Acquisition of text messages. as expected

SPT–CA–18 Acquisition of text message date/time stamps. as expected

SPT–CA–19 Acquisition of text message status flags. as expected

SPT–CA–20 Acquisition of sender/recipient phone number

associated with text messages. 

as expected 

Analysis: Expected results achieved 

November 2010 95 of 196 Results of Device Seizure 4.0 
 

5.2.44 SPT–09 (Blackberry Bold 9700) 

Test Case SPT–09 Device Seizure 4.0 

Case 

Summary: 

SPT–09 Acquire mobile device internal memory and review reported MMS multi–

media related data (i.e., text, audio, graphics, video).

Assertions: SPT–CA–21 If a cellular forensic tool completes acquisition of the target

device without error then MMS messages and associated audio shall be

presented in a useable format.

SPT–CA–22 If a cellular forensic tool completes acquisition of the target

device without error then MMS messages and associated graphic files shall

be presented in a useable format.

SPT–CA–23 If a cellular forensic tool completes acquisition of the target

device without error then MMS messages and associated video shall be

presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 09:03:14 EDT 2010 

Device: Blackberry_bold9700

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 09:03:14 EDT 2010

Acquisition finished: Tue Jul 20 09:08:46 EDT 2010 

Partial audio MMS messages were acquired

Partial image MMS messages were acquired

Partial video MMS messages were acquired 

Notes: 

The MMS embedded objects (i.e., graphics, audio, video) are not reported. 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–CA–21 Acquisition of audio MMS messages. partial

SPT–CA–22 Acquisition of graphic data image MMS

messages. 

partial 

SPT–CA–23 Acquisition of video MMS messages. partial 

Analysis: Partial results Not achieved 

November 2010 96 of 196 Results of Device Seizure 4.0 
 

5.2.45 SPT–10 (Blackberry Bold 9700) 

Test Case SPT–10 Device Seizure 4.0 

Case 

Summary: 

SPT–10 Acquire mobile device internal memory and review reported stand–

alone multi–media data (i.e., audio, graphics, video).

Assertions: SPT–CA–24 If a cellular forensic tool completes acquisition of the target

device without error then stand–alone audio files shall be presented in a

useable format via either an internal application or suggested third–party

application.

SPT–CA–25 If a cellular forensic tool completes acquisition of the target

device without error then stand–alone graphic files shall be presented in a

useable format via either an internal application or suggested third–party

application.

SPT–CA–26 If a cellular forensic tool completes acquisition of the target

device without error then stand–alone video files shall be presented in a

useable format via either an internal application or suggested third–party

application. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Tue Jul 20 09:10:58 EDT 2010 

Device: Blackberry_bold9700

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 09:10:58 EDT 2010

Acquisition finished: Tue Jul 20 11:01:09 EDT 2010 

Audio files were not acquired

Image files were not acquired

Video files were not acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–24 Acquisition of stand–alone audio files. partial

SPT–CA–25 Acquisition of stand–alone graphic files. partial

SPT–CA–26 Acquisition of stand–alone video files. partial 

Analysis: Expected results Not achieved 

November 2010 97 of 196 Results of Device Seizure 4.0 
 

5.2.46 SPT–11 (Blackberry Bold 9700) 

Test Case SPT–11 Device Seizure 4.0 

Case 

Summary: 

SPT–11 Acquire mobile device internal memory and review application related

data (i.e., word documents, spreadsheet, presentation documents).

Assertions: SPT–CA–27 If a cellular forensic tool completes acquisition of the target

device without error then device specific application related data shall be

acquired and presented in a useable format via either an internal

application or suggested third–party application. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Tue Jul 20 11:02:53 EDT 2010 

Device: Blackberry_bold9700

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 11:02:53 EDT 2010

Acquisition finished: Tue Jul 20 11:13:17 EDT 2010 

Application data was not acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–27 Acquisition of application related data. Not as expected 

Analysis: Expected results achieved 

November 2010 98 of 196 Results of Device Seizure 4.0 
 

5.2.47 SPT–12 (Blackberry Bold 9700) 

Test Case SPT–12 Device Seizure 4.0 

Case 

Summary: 

SPT–12 Acquire mobile device internal memory and review Internet related

data (i.e., bookmarks, visited sites.

Assertions: SPT–CA–28 If a cellular forensic tool completes acquisition of the target

device without error then Internet related data (i.e., bookmarks, visited

sites) cached to the device shall be acquired and presented in a useable

format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 11:13:55 EDT 2010 

Device: Blackberry_bold9700

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 11:13:55 EDT 2010

Acquisition finished: Tue Jul 20 12:17:32 EDT 2010 

All Internet related data was acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–28 Acquisition of Internet related data. as expected 

Analysis: Expected results achieved 

November 2010 99 of 196 Results of Device Seizure 4.0 
 

5.2.48 SPT–13 (Blackberry Bold 9700) 

Test Case SPT–13 Device Seizure 4.0 

Case 

Summary: 

SPT–13 Acquire mobile device internal memory by selecting a combination of

supported data elements.

Assertions: SPT–CA–29 If a cellular forensic tool provides the user with an “Acquire

All” device data objects acquisition option then the tool shall complete

the acquisition of all data objects without error. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 12:17:57 EDT 2010 

Device: Blackberry_bold9700

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 12:17:57 EDT 2010

Acquisition finished: Tue Jul 20 12:19:18 EDT 2010 

Select All acquisition was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–29 Acquire–All data objects acquisition. as expected 

Analysis: Expected results achieved 

November 2010 100 of 196 Results of Device Seizure 4.0 
 

5.2.49 SPT–14 (Blackberry Bold 9700) 

Test Case SPT–14 Device Seizure 4.0 

Case 

Summary: 

SPT–14 Acquire SIM memory over supported interfaces (e.g., PC/SC reader). 

Assertions: SPT–AO–01 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all tool–supported interfaces (e.g., PC/SC reader, proprietary reader,

smart phone itself). 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Tue Jul 20 12:18:43 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 12:18:43 EDT 2010

Acquisition finished: Tue Jul 20 12:20:28 EDT 2010 

Media connectivity was established via supported interface 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–01 SIM connectivity via supported interfaces. as expected 

Analysis: Expected results achieved 

November 2010 101 of 196 Results of Device Seizure 4.0 
 

5.2.50 SPT–15 (Blackberry Bold 9700) 

Test Case SPT–15 Device Seizure 4.0 

Case 

Summary: 

SPT–15 Attempt acquisition of a non–supported SIM. 

Assertions: SPT–AO–02 If a cellular forensic tool attempts to connect to a non–

supported SIM then the tool shall notify the user that the SIM is not

supported. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 12:20:47 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 12:20:47 EDT 2010

Acquisition finished: Tue Jul 20 12:28:30 EDT 2010 

Identification of non–supported media was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–02 Identification of non–supported SIMs. as expected 

Analysis: Expected results achieved 

November 2010 102 of 196 Results of Device Seizure 4.0 
 

5.2.51 SPT–16 (Blackberry Bold 9700) 

Test Case SPT–16 Device Seizure 4.0 

Case 

Summary: 

SPT–16 Begin SIM acquisition and interrupt connectivity by interface

disengagement.

Assertions: SPT–AO–03 If a cellular forensic tool loses connectivity with the SIM

reader then the tool shall notify the user that connectivity has been

disrupted. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 12:28:51 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 12:28:51 EDT 2010

Acquisition finished: Tue Jul 20 12:38:27 EDT 2010 

Media acquisition disruption notification was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–03 Notification of SIM acquisition disruption. as expected 

Analysis: Expected results achieved 

November 2010 103 of 196 Results of Device Seizure 4.0 
 

5.2.52 SPT–17 (Blackberry Bold 9700) 

Test Case SPT–17 Device Seizure 4.0 

Case 

Summary: 

SPT–17 Acquire SIM memory and review reported subscriber and equipment

related information (i.e., SPN, ICCID, IMSI, MSISDN).

Assertions: SPT–AO–04 If a cellular forensic tool completes acquisition of the target

SIM without error then the SPN shall be presented in a useable format.

SPT–AO–05 If a cellular forensic tool completes acquisition of the target

SIM without error then the ICCID shall be presented in a useable format.

SPT–AO–06 If a cellular forensic tool completes acquisition of the target

SIM without error then the IMSI shall be presented in a useable format.

SPT–AO–07 If a cellular forensic tool completes acquisition of the target

SIM without error then the MSISDN shall be presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 12:38:51 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 12:38:51 EDT 2010

Acquisition finished: Tue Jul 20 12:44:28 EDT 2010 

All subscriber–related data (i.e., SPN, ICCID, IMSI, MSISDN) was acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–04 Acquisition of SPN. as expected

SPT–AO–05 Acquisition of ICCID. as expected

SPT–AO–06 Acquisition of IMSI. as expected

SPT–AO–07 Acquisition of MSISDN. as expected 

Analysis: Expected results achieved 

November 2010 104 of 196 Results of Device Seizure 4.0 
 

5.2.53 SPT–18 (Blackberry Bold 9700) 

Test Case SPT–18 Device Seizure 4.0 

Case 

Summary: 

SPT–18 Acquire SIM memory and review reported Abbreviated Dialing Numbers

(ADN).

Assertions: SPT–AO–08 If a cellular forensic tool completes acquisition of the target

SIM without error then ASCII Abbreviated Dialing Numbers (ADN) shall be

presented in a useable format.

SPT–AO–09 If a cellular forensic tool completes acquisition of the target

SIM without error then maximum length ADNs shall be presented in a useable

format. 

SPT–AO–10 If a cellular forensic tool completes acquisition of the SIM

without error then ADNs containing special characters shall be presented in

a useable format. 

SPT–AO–11 If a cellular forensic tool completes acquisition of the SIM

without error then ADNs containing blank names shall be presented in a

useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 12:44:48 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 12:44:48 EDT 2010

Acquisition finished: Tue Jul 20 12:48:42 EDT 2010 

All ADNs were acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–08 Acquisition of ADNs. as expected

SPT–AO–09 Acquisition of maximum length ADNs. as expected

SPT–AO–10 Acquisition of special character ADNs. as expected

SPT–AO–11 Acquisition of blank name ADNs. as expected 

Analysis: Expected results achieved 

November 2010 105 of 196 Results of Device Seizure 4.0 
 

5.2.54 SPT–19 (Blackberry Bold 9700) 

Test Case SPT–19 Device Seizure 4.0 

Case 

Summary: 

SPT–19 Acquire SIM memory and review reported Last Numbers Dialed (LND). 

Assertions: SPT–AO–12 If a cellular forensic tool completes acquisition of the target

SIM without error then Last Numbers Dialed (LND) shall be presented in a

useable format. 

SPT–AO–13 If a cellular forensic tool completes acquisition of the target

SIM without error then the corresponding date/time stamps for LNDs shall be

presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 12:49:01 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 12:49:01 EDT 2010

Acquisition finished: Tue Jul 20 12:52:59 EDT 2010 

LNDs were acquired

Date/Time Stamps correctly reported for LNDs 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–12 Acquisition of LNDs. as expected

SPT–AO–13 Acquisition of LND date/time stamps. as expected 

Analysis: Expected results achieved 

November 2010 106 of 196 Results of Device Seizure 4.0 
 

5.2.55 SPT–20 (Blackberry Bold 9700) 

Test Case SPT–20 Device Seizure 4.0 

Case 

Summary: 

SPT–20 Acquire SIM memory and review reported text messages (SMS, EMS). 

Assertions: SPT–AO–14 If a cellular forensic tool completes acquisition of the target

SIM without error then ASCII SMS text messages shall be presented in a

useable format. 

SPT–AO–15 If a cellular forensic tool completes acquisition of the target

SIM without error then ASCII EMS text messages shall be presented in a

useable format. 

SPT–AO–16 If a cellular forensic tool completes acquisition of the target

SIM without error then the corresponding date/time stamps for all text

messages shall be presented in a useable format.

SPT–AO–17 If a cellular forensic tool completes acquisition of the target

SIM without error then the corresponding status (i.e., read, unread) for

text messages shall be presented in a useable format.

SPT–AO–18 If a cellular forensic tool completes acquisition of the target

SIM without error then the corresponding sender / recipient phone numbers

for text messages shall be presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 12:53:25 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 12:53:25 EDT 2010

Acquisition finished: Tue Jul 20 12:55:04 EDT 2010 

ALL text messages (SMS, EMS) were acquired

All date/time stamps were reported for text messages

Correct status flags were reported for text messages

Sender and Recipient phone numbers associated with text messages were

correctly reported 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–14 Acquisition of SMS messages. as expected

SPT–AO–15 Acquisition of EMS messages. as expected

SPT–AO–16 Acquisition of text message date/time stamps. as expected

SPT–AO–17 Acquisition of text message status flags. as expected

SPT–AO–18 Acquisition of sender/recipient phone number

associated with text messages. 

as expected 

Analysis: Expected results achieved 

November 2010 107 of 196 Results of Device Seizure 4.0 
 

5.2.56 SPT–21 (Blackberry Bold 9700) 

Test Case SPT–21 Device Seizure 4.0 

Case 

Summary: 

SPT–21 Acquire SIM memory and review recoverable deleted text messages

(SMS, EMS).

Assertions: SPT–AO–19 If the cellular forensic tool completes acquisition of the target

SIM without error then deleted text messages that have not been overwritten

shall be presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 12:55:27 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 12:55:27 EDT 2010

Acquisition finished: Tue Jul 20 12:59:49 EDT 2010 

Deleted text message data was recovered 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–19 Acquisition of non–overwritten deleted text

messages. 

as expected 

Analysis: Expected results achieved 

November 2010 108 of 196 Results of Device Seizure 4.0 
 

5.2.57 SPT–22 (Blackberry Bold 9700) 

Test Case SPT–22 Device Seizure 4.0 

Case 

Summary: 

SPT–22 Acquire SIM memory and review reported location related data (i.e.,

LOCI, GPRSLOCI).

Assertions: SPT–AO–20 If a cellular forensic tool completes acquisition of the target

SIM without error then location related data (i.e., LOCI) shall be

presented in a useable format.

SPT–AO–21 If a cellular forensic tool completes acquisition of the target

SIM without error then location related data (i.e., GRPSLOCI) shall be

presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 13:00:13 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 13:00:13 EDT 2010

Acquisition finished: Tue Jul 20 13:02:01 EDT 2010 

LOCI data was acquired

GPRSLOCI data was acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–20 Acquisition of LOCI information. as expected

SPT–AO–21 Acquisition of GPRSLOCI information. as expected 

Analysis: Expected results achieved 

November 2010 109 of 196 Results of Device Seizure 4.0 
 

5.2.58 SPT–23 (Blackberry Bold 9700) 

Test Case SPT–23 Device Seizure 4.0 

Case 

Summary: 

SPT–23 Acquire SIM memory by selecting a combination of supported data

elements. 

Assertions: SPT–AO–01 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all tool–supported interfaces (e.g., PC/SC reader, proprietary reader,

smart phone itself).

SPT–AO–22 If a cellular forensic tool provides the user with an “Acquire

All” SIM data objects acquisition option then the tool shall complete the

acquisition of all data objects without error. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Tue Jul 20 13:02:20 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 13:02:20 EDT 2010

Acquisition finished: Tue Jul 20 13:04:01 EDT 2010 

Acquire All acquisition was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–01 SIM connectivity via supported interfaces. as expected

SPT–AO–22 Acquire–All data objects acquisition. as expected 

Analysis: Expected results achieved 

November 2010 110 of 196 Results of Device Seizure 4.0 
 

5.2.59 SPT–24 (Blackberry Bold 9700) 

Test Case SPT–24 Device Seizure 4.0 

Case 

Summary: 

SPT–24 Acquire mobile device internal memory and review reported data via

supported generated report formats.

Assertions: SPT–AO–25 If a cellular forensic tool completes acquisition of the target

device without error then the tool shall present the acquired data in a

useable format via supported generated report formats. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 14:30:30 EDT 2010 

Device: Blackberry_bold9700

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 14:30:30 EDT 2010

Acquisition finished: Tue Jul 20 14:32:28 EDT 2010 

Complete representation of known data via generated reports was successful 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–25 Comparison of known device data elements via

generated reports. 

as expected 

Analysis: Expected results achieved 

November 2010 111 of 196 Results of Device Seizure 4.0 
 

5.2.60 SPT–25 (Blackberry Bold 9700) 

Test Case SPT–25 Device Seizure 4.0 

Case 

Summary: 

SPT–25 Acquire mobile device internal memory and review reported data via

the preview pane.

Assertions: SPT–AO–26 If a cellular forensic tool completes acquisition of the target

device without error then the tool shall present the acquired data in a

useable format in a preview–pane view. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 14:33:25 EDT 2010 

Device: Blackberry_bold9700

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 14:33:25 EDT 2010

Acquisition finished: Tue Jul 20 14:34:36 EDT 2010 

Complete representation of known data via preview–pane was successful 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–26 Comparison of known device data elements via

preview–pane. 

as expected 

Analysis: Expected results achieved 

November 2010 112 of 196 Results of Device Seizure 4.0 
 

5.2.61 SPT–26 (Blackberry Bold 9700) 

Test Case SPT–26 Device Seizure 4.0 

Case 

Summary: 

SPT–26 Acquire SIM memory and review reported data via supported generated

report formats.

Assertions: SPT–AO–25 If a cellular forensic tool completes acquisition of the SIM

without error then the tool shall present the acquired data in a useable

format via supported generated report formats. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 14:35:07 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 14:35:07 EDT 2010

Acquisition finished: Tue Jul 20 14:37:57 EDT 2010 

Complete representation of known data via generated reports was successful 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–25 Comparison of known device data elements via

generated reports. 

as expected 

Analysis: Expected results achieved 

November 2010 113 of 196 Results of Device Seizure 4.0 
 

5.2.62 SPT–27 (Blackberry Bold 9700) 

Test Case SPT–27 Device Seizure 4.0 

Case 

Summary: 

SPT–27 Acquire SIM memory and review reported data via the preview–pane. 

Assertions: SPT–AO–26 If a cellular forensic tool completes acquisition of the SIM

without error then the tool shall present the acquired data in a useable

format in a preview–pane view. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 14:38:16 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 14:38:16 EDT 2010

Acquisition finished: Tue Jul 20 14:39:44 EDT 2010 

Complete representation of known data via preview–pane was successful 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–26 Comparison of known device data elements via

preview–pane. 

as expected 

Analysis: Expected results achieved 

November 2010 114 of 196 Results of Device Seizure 4.0 
 

5.2.63 SPT–28 (Blackberry Bold 9700) 

Test Case SPT–28 Device Seizure 4.0 

Case 

Summary: 

SPT–28 Attempt acquisition of a password–protected SIM. 

Assertions: SPT–AO–28 If the SIM is password–protected then the cellular forensic tool

shall provide the examiner with the opportunity to input the PIN before

acquisition. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 14:40:21 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 14:40:21 EDT 2010

Acquisition finished: Tue Jul 20 14:41:31 EDT 2010 

Ability to enter PIN on protected media before acquisition was not

successful 

Notes: 

The dialog box does not allow the user to proceed with the acquisition of

SIM data after inputting the PIN. The "Next" button is not available for

selection. 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–28 Acquisition of password protected SIM. Not as expected 

Analysis: Expected results Not achieved 

November 2010 115 of 196 Results of Device Seizure 4.0 
 

5.2.64 SPT–29 (Blackberry Bold 9700) 

Test Case SPT–29 Device Seizure 4.0 

Case 

Summary: 

SPT–29 After a successful mobile device internal memory, alter the case

file via third–party means and attempt to re–open the case.

Assertions: SPT–AO–27 If the case file or individual data objects are modified via

third–party means then the tool shall provide protection mechanisms

disallowing or reporting data modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 14:42:08 EDT 2010 

Device: Blackberry_bold9700

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 14:42:08 EDT 2010

Acquisition finished: Tue Jul 20 14:44:09 EDT 2010 

Notification of modified device memory data was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–27 Notification of modified device case data. as expected 

Analysis: Expected results achieved 

November 2010 116 of 196 Results of Device Seizure 4.0 
 

5.2.65 SPT–30 (Blackberry Bold 9700) 

Test Case SPT–30 Device Seizure 4.0 

Case 

Summary: 

SPT–30 After a successful SIM acquisition, alter the case file via third–

party means and attempt to re–open the case.

Assertions: SPT–AO–27 If the case file or individual data objects are modified via

third–party means then the tool shall provide protection mechanisms

disallowing or reporting data modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 14:44:30 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 14:44:30 EDT 2010

Acquisition finished: Tue Jul 20 14:46:10 EDT 2010 

Notification of modified SIM data was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–27 Notification of modified device case data. as expected 

Analysis: Expected results achieved 

November 2010 117 of 196 Results of Device Seizure 4.0 
 

5.2.66 SPT–33 (Blackberry Bold 9700) 

Test Case SPT–33 Device Seizure 4.0 

Case 

Summary: 

SPT–33 Acquire mobile device internal memory and review data containing

non–ASCII characters. 

Assertions: SPT–AO–40 If the cellular forensic tool supports display of non–ASCII

characters then the application should present address book entries in

their native format. 

SPT–AO–41 If the cellular forensic tool supports proper display of non–

ASCII characters then the application should present text messages in their

native format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 14:56:10 EDT 2010 

Device: Blackberry_bold9700

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 14:56:10 EDT 2010

Acquisition finished: Tue Jul 20 14:57:15 EDT 2010 

Non–ASCII Address book entries were acquired and properly displayed

Non–ASCII text messages were acquired and properly displayed 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–40 Acquisition of non–ASCII address book

entries/ADNs. 

as expected 

SPT–AO–41 Acquisition of non–ASCII text messages. as expected 

Analysis: Expected results achieved 

November 2010 118 of 196 Results of Device Seizure 4.0 
 

5.2.67 SPT–34 (Blackberry Bold 9700) 

Test Case SPT–34 Device Seizure 4.0 

Case 

Summary: 

SPT–34 Acquire SIM memory and review data containing non–ASCII characters. 

Assertions: SPT–AO–40 If the cellular forensic tool supports display of non–ASCII

characters then the application should present ADNs in their native format.

SPT–AO–41 If the cellular forensic tool supports proper display of non–

ASCII characters then the application should present text messages in their

native format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 14:57:37 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 14:57:37 EDT 2010

Acquisition finished: Tue Jul 20 14:59:01 EDT 2010 

Non–ASCII ADNs were acquired and properly displayed

Non–ASCII text messages were acquired and properly displayed 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–40 Acquisition of non–ASCII address book

entries/ADNs. 

as expected 

SPT–AO–41 Acquisition of non–ASCII text messages. as expected 

Analysis: Expected results achieved 

November 2010 119 of 196 Results of Device Seizure 4.0 
 

5.2.68 SPT–38 (Blackberry Bold 9700) 

Test Case SPT–38 Device Seizure 4.0 

Case 

Summary: 

SPT–38 Acquire mobile device internal memory and review hash values for

vendor supported data objects.

Assertions: SPT–AO–43 If the cellular forensic tool supports hashing for individual

data objects then the tool shall present the user with a hash value for

each supported data object. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 14:59:52 EDT 2010 

Device: Blackberry_bold9700

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 14:59:52 EDT 2010

Acquisition finished: Tue Jul 20 15:01:04 EDT 2010 

Hash values were properly reported for individually acquired device data

elements 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–43 Acquire data, check known hash values for

consistency. 

as expected 

Analysis: Expected results achieved 

November 2010 120 of 196 Results of Device Seizure 4.0 
 

5.2.69 SPT–39 (Blackberry Bold 9700) 

Test Case SPT–39 Device Seizure 4.0 

Case 

Summary: 

SPT–39 Acquire SIM memory and review hash values for vendor supported data

objects.

Assertions: SPT–AO–43 If the cellular forensic tool supports hashing for individual

data objects then the tool shall present the user with a hash value for

each supported data object. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 20 15:01:27 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 20 15:01:27 EDT 2010

Acquisition finished: Tue Jul 20 15:02:47 EDT 2010 

Hash values were properly reported for individually acquired SIM data

elements 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–43 Acquire data, check known hash values for

consistency. 

as expected 

Analysis: Expected results achieved 

November 2010 121 of 196 Results of Device Seizure 4.0 
 

5.2.70 SPT–01 (Nokia 6790) 

Test Case SPT–01 Device Seizure 4.0 

Case 

Summary: 

SPT–01 Acquire mobile device internal memory over tool–supported interfaces

(e.g., cable, Bluetooth, IrDA).

Assertions: SPT–CA–01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

SPT–CA–04 If a cellular forensic tool completes acquisition of the target

device without error then the tool shall have the ability to present

acquired data objects in a useable format via either a preview–pane or

generated report.

SPT–CA–29 If a cellular forensic tool provides the user with an “Acquire

All” device data objects acquisition option then the tool shall complete

the acquisition of all data objects without error.

SPT–CA–30 If a cellular forensic tool provides the user with a “Select All”

individual device data objects then the tool shall complete the acquisition

of all individually selected data objects without error.

SPT–CA–31 If a cellular forensic tool provides the user with the ability to

“Select Individual” device data objects for acquisition then the tool shall

acquire each exclusive data object without error.

SPT–CA–32 If a cellular forensic tool completes two consecutive logical

acquisitions of the target device without error then the payload (data

objects) on the mobile device shall remain consistent. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Tue Jul 27 14:16:56 EDT 2010 

Device: Nokia_6790 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log Highlights:

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 27 14:16:56 EDT 2010

Acquisition finished: Tue Jul 27 14:17:05 EDT 2010 

Device Connectivity was not established via supported interface 

Notes: 

Acquisition was not successful. The following message was displayed: Acquisition process

has failed. Status: Failed, Action: Connecting..., Result: Connection error, Advice: Try

to reacquire the device. If the error persists, please submit log to the Paraben support

team. 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–CA–01 Device connectivity via supported interfaces. Not as 

expected

SPT–CA–04 Readability and completeness of acquired data

via supported reports. 

NA 

SPT–CA–29 Acquire–All data objects acquisition. Not as 

expected

SPT–CA–30 Select–All data objects acquisition. Not as 

expected

SPT–CA–31 Select–Individual data objects acquisition. Not as 

expected

SPT–CA–32 Perform back–to–back acquisitions, check device

payload for modifications. 

NA 

Analysis: Expected results Not achieved 

November 2010 122 of 196 Results of Device Seizure 4.0 
 

5.2.71 SPT–14 (Nokia 6790) 

Test Case SPT–14 Device Seizure 4.0 

Case 

Summary: 

SPT–14 Acquire SIM memory over supported interfaces (e.g., PC/SC reader). 

Assertions: SPT–AO–01 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all tool–supported interfaces (e.g., PC/SC reader, proprietary reader,

smart phone itself). 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Tue Jul 27 14:17:55 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 27 14:17:55 EDT 2010

Acquisition finished: Tue Jul 27 14:18:58 EDT 2010 

Media connectivity was established via supported interface 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–01 SIM connectivity via supported interfaces. as expected 

Analysis: Expected results achieved 

November 2010 123 of 196 Results of Device Seizure 4.0 
 

5.2.72 SPT–15 (Nokia 6790) 

Test Case SPT–15 Device Seizure 4.0 

Case 

Summary: 

SPT–15 Attempt acquisition of a non–supported SIM. 

Assertions: SPT–AO–02 If a cellular forensic tool attempts to connect to a non–

supported SIM then the tool shall notify the user that the SIM is not

supported. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 27 14:19:31 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 27 14:19:31 EDT 2010

Acquisition finished: Tue Jul 27 14:20:16 EDT 2010 

Identification of non–supported media was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–02 Identification of non–supported SIMs. as expected 

Analysis: Expected results achieved 

November 2010 124 of 196 Results of Device Seizure 4.0 
 

5.2.73 SPT–16 (Nokia 6790) 

Test Case SPT–16 Device Seizure 4.0 

Case 

Summary: 

SPT–16 Begin SIM acquisition and interrupt connectivity by interface

disengagement.

Assertions: SPT–AO–03 If a cellular forensic tool loses connectivity with the SIM

reader then the tool shall notify the user that connectivity has been

disrupted. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 27 14:20:35 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 27 14:20:35 EDT 2010

Acquisition finished: Tue Jul 27 14:23:14 EDT 2010 

Media acquisition disruption notification was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–03 Notification of SIM acquisition disruption. as expected 

Analysis: Expected results achieved 

November 2010 125 of 196 Results of Device Seizure 4.0 
 

5.2.74 SPT–17 (Nokia 6790) 

Test Case SPT–17 Device Seizure 4.0 

Case 

Summary: 

SPT–17 Acquire SIM memory and review reported subscriber and equipment

related information (i.e., SPN, ICCID, IMSI, MSISDN).

Assertions: SPT–AO–04 If a cellular forensic tool completes acquisition of the target

SIM without error then the SPN shall be presented in a useable format.

SPT–AO–05 If a cellular forensic tool completes acquisition of the target

SIM without error then the ICCID shall be presented in a useable format.

SPT–AO–06 If a cellular forensic tool completes acquisition of the target

SIM without error then the IMSI shall be presented in a useable format.

SPT–AO–07 If a cellular forensic tool completes acquisition of the target

SIM without error then the MSISDN shall be presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 27 14:24:13 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 27 14:24:13 EDT 2010

Acquisition finished: Tue Jul 27 14:26:41 EDT 2010 

All subscriber–related data (i.e., SPN, ICCID, IMSI, MSISDN) was acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–04 Acquisition of SPN. as expected

SPT–AO–05 Acquisition of ICCID. as expected

SPT–AO–06 Acquisition of IMSI. as expected

SPT–AO–07 Acquisition of MSISDN. as expected 

Analysis: Expected results achieved 

November 2010 126 of 196 Results of Device Seizure 4.0 
 

5.2.75 SPT–18 (Nokia 6790) 

Test Case SPT–18 Device Seizure 4.0 

Case 

Summary: 

SPT–18 Acquire SIM memory and review reported Abbreviated Dialing Numbers

(ADN).

Assertions: SPT–AO–08 If a cellular forensic tool completes acquisition of the target

SIM without error then ASCII Abbreviated Dialing Numbers (ADN) shall be

presented in a useable format.

SPT–AO–09 If a cellular forensic tool completes acquisition of the target

SIM without error then maximum length ADNs shall be presented in a useable

format. 

SPT–AO–10 If a cellular forensic tool completes acquisition of the SIM

without error then ADNs containing special characters shall be presented in

a useable format. 

SPT–AO–11 If a cellular forensic tool completes acquisition of the SIM

without error then ADNs containing blank names shall be presented in a

useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 27 14:26:58 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 27 14:26:58 EDT 2010

Acquisition finished: Tue Jul 27 14:29:21 EDT 2010 

All ADNs were acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–08 Acquisition of ADNs. as expected

SPT–AO–09 Acquisition of maximum length ADNs. as expected

SPT–AO–10 Acquisition of special character ADNs. as expected

SPT–AO–11 Acquisition of blank name ADNs. as expected 

Analysis: Expected results achieved 

November 2010 127 of 196 Results of Device Seizure 4.0 
 

5.2.76 SPT–19 (Nokia 6790) 

Test Case SPT–19 Device Seizure 4.0 

Case 

Summary: 

SPT–19 Acquire SIM memory and review reported Last Numbers Dialed (LND). 

Assertions: SPT–AO–12 If a cellular forensic tool completes acquisition of the target

SIM without error then Last Numbers Dialed (LND) shall be presented in a

useable format. 

SPT–AO–13 If a cellular forensic tool completes acquisition of the target

SIM without error then the corresponding date/time stamps for LNDs shall be

presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 27 14:29:41 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 27 14:29:41 EDT 2010

Acquisition finished: Tue Jul 27 14:30:16 EDT 2010 

LNDs were acquired

Date/Time Stamps correctly reported for LNDs 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–12 Acquisition of LNDs. as expected

SPT–AO–13 Acquisition of LND date/time stamps. as expected 

Analysis: Expected results achieved 

November 2010 128 of 196 Results of Device Seizure 4.0 
 

5.2.77 SPT–20 (Nokia 6790) 

Test Case SPT–20 Device Seizure 4.0 

Case 

Summary: 

SPT–20 Acquire SIM memory and review reported text messages (SMS, EMS). 

Assertions: SPT–AO–14 If a cellular forensic tool completes acquisition of the target

SIM without error then ASCII SMS text messages shall be presented in a

useable format. 

SPT–AO–15 If a cellular forensic tool completes acquisition of the target

SIM without error then ASCII EMS text messages shall be presented in a

useable format. 

SPT–AO–16 If a cellular forensic tool completes acquisition of the target

SIM without error then the corresponding date/time stamps for all text

messages shall be presented in a useable format.

SPT–AO–17 If a cellular forensic tool completes acquisition of the target

SIM without error then the corresponding status (i.e., read, unread) for

text messages shall be presented in a useable format.

SPT–AO–18 If a cellular forensic tool completes acquisition of the target

SIM without error then the corresponding sender / recipient phone numbers

for text messages shall be presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 27 14:30:47 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 27 14:30:47 EDT 2010

Acquisition finished: Tue Jul 27 14:31:53 EDT 2010 

ALL text messages (SMS, EMS) were acquired

All date/time stamps were reported for text messages

Correct status flags were reported for text messages

Sender and Recipient phone numbers associated with text messages were

correctly reported 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–14 Acquisition of SMS messages. as expected

SPT–AO–15 Acquisition of EMS messages. as expected

SPT–AO–16 Acquisition of text message date/time stamps. as expected

SPT–AO–17 Acquisition of text message status flags. as expected

SPT–AO–18 Acquisition of sender/recipient phone number

associated with text messages. 

as expected 

Analysis: Expected results achieved 

November 2010 129 of 196 Results of Device Seizure 4.0 
 

5.2.78 SPT–21 (Nokia 6790) 

Test Case SPT–21 Device Seizure 4.0 

Case 

Summary: 

SPT–21 Acquire SIM memory and review recoverable deleted text messages

(SMS, EMS).

Assertions: SPT–AO–19 If the cellular forensic tool completes acquisition of the target

SIM without error then deleted text messages that have not been overwritten

shall be presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 27 14:33:47 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 27 14:33:47 EDT 2010

Acquisition finished: Tue Jul 27 14:34:44 EDT 2010 

Deleted text message data was recovered 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–19 Acquisition of non–overwritten deleted text

messages. 

as expected 

Analysis: Expected results achieved 

November 2010 130 of 196 Results of Device Seizure 4.0 
 

5.2.79 SPT–22 (Nokia 6790) 

Test Case SPT–22 Device Seizure 4.0 

Case 

Summary: 

SPT–22 Acquire SIM memory and review reported location related data (i.e.,

LOCI, GPRSLOCI).

Assertions: SPT–AO–20 If a cellular forensic tool completes acquisition of the target

SIM without error then location related data (i.e., LOCI) shall be

presented in a useable format.

SPT–AO–21 If a cellular forensic tool completes acquisition of the target

SIM without error then location related data (i.e., GRPSLOCI) shall be

presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 27 14:35:00 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 27 14:35:00 EDT 2010

Acquisition finished: Tue Jul 27 14:37:54 EDT 2010 

LOCI data was acquired

GPRSLOCI data was acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–20 Acquisition of LOCI information. as expected

SPT–AO–21 Acquisition of GPRSLOCI information. as expected 

Analysis: Expected results achieved 

November 2010 131 of 196 Results of Device Seizure 4.0 
 

5.2.80 SPT–23 (Nokia 6790) 

Test Case SPT–23 Device Seizure 4.0 

Case 

Summary: 

SPT–23 Acquire SIM memory by selecting a combination of supported data

elements. 

Assertions: SPT–AO–01 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all tool–supported interfaces (e.g., PC/SC reader, proprietary reader,

smart phone itself).

SPT–AO–22 If a cellular forensic tool provides the user with an “Acquire

All” SIM data objects acquisition option then the tool shall complete the

acquisition of all data objects without error. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Tue Jul 27 14:38:12 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 27 14:38:12 EDT 2010

Acquisition finished: Tue Jul 27 14:39:28 EDT 2010 

Acquire All acquisition was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–01 SIM connectivity via supported interfaces. as expected

SPT–AO–22 Acquire–All data objects acquisition. as expected 

Analysis: Expected results achieved 

November 2010 132 of 196 Results of Device Seizure 4.0 
 

5.2.81 SPT–26 (Nokia 6790) 

Test Case SPT–26 Device Seizure 4.0 

Case 

Summary: 

SPT–26 Acquire SIM memory and review reported data via supported generated

report formats.

Assertions: SPT–AO–25 If a cellular forensic tool completes acquisition of the SIM

without error then the tool shall present the acquired data in a useable

format via supported generated report formats. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 27 14:43:50 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 27 14:43:50 EDT 2010

Acquisition finished: Tue Jul 27 14:46:15 EDT 2010 

Complete representation of known data via generated reports was successful 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–25 Comparison of known device data elements via

generated reports. 

as expected 

Analysis: Expected results achieved 

November 2010 133 of 196 Results of Device Seizure 4.0 
 

5.2.82 SPT–27 (Nokia 6790) 

Test Case SPT–27 Device Seizure 4.0 

Case 

Summary: 

SPT–27 Acquire SIM memory and review reported data via the preview–pane. 

Assertions: SPT–AO–26 If a cellular forensic tool completes acquisition of the SIM

without error then the tool shall present the acquired data in a useable

format in a preview–pane view. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 27 14:46:41 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 27 14:46:41 EDT 2010

Acquisition finished: Tue Jul 27 14:47:55 EDT 2010 

Complete representation of known data via preview–pane was successful 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–26 Comparison of known device data elements via

preview–pane. 

as expected 

Analysis: Expected results achieved 

November 2010 134 of 196 Results of Device Seizure 4.0 
 

5.2.83 SPT–28 (Nokia 6790) 

Test Case SPT–28 Device Seizure 4.0 

Case 

Summary: 

SPT–28 Attempt acquisition of a password–protected SIM. 

Assertions: SPT–AO–28 If the SIM is password–protected then the cellular forensic tool

shall provide the examiner with the opportunity to input the PIN before

acquisition. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 27 14:48:29 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 27 14:48:29 EDT 2010

Acquisition finished: Tue Jul 27 14:49:54 EDT 2010 

Ability to enter PIN on protected media before acquisition was not

successful 

Notes: 

The dialog box does not allow the user to proceed with the acquisition of

SIM data after inputting the PIN. The "Next" button is not available for

selection. 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–28 Acquisition of password protected SIM. as expected 

Analysis: Expected results achieved 

November 2010 135 of 196 Results of Device Seizure 4.0 
 

5.2.84 SPT–30 (Nokia 6790) 

Test Case SPT–30 Device Seizure 4.0 

Case 

Summary: 

SPT–30 After a successful SIM acquisition, alter the case file via third–

party means and attempt to re–open the case.

Assertions: SPT–AO–27 If the case file or individual data objects are modified via

third–party means then the tool shall provide protection mechanisms

disallowing or reporting data modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 27 14:50:59 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 27 14:50:59 EDT 2010

Acquisition finished: Tue Jul 27 14:51:52 EDT 2010 

Notification of modified SIM data was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–27 Notification of modified device case data. as expected 

Analysis: Expected results achieved 

November 2010 136 of 196 Results of Device Seizure 4.0 
 

5.2.85 SPT–34 (Nokia 6790) 

Test Case SPT–34 Device Seizure 4.0 

Case 

Summary: 

SPT–34 Acquire SIM memory and review data containing non–ASCII characters. 

Assertions: SPT–AO–40 If the cellular forensic tool supports display of non–ASCII

characters then the application should present ADNs in their native format.

SPT–AO–41 If the cellular forensic tool supports proper display of non–

ASCII characters then the application should present text messages in their

native format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 27 14:52:21 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 27 14:52:21 EDT 2010

Acquisition finished: Tue Jul 27 14:54:06 EDT 2010 

Non–ASCII ADNs were acquired and properly displayed

Non–ASCII text messages were acquired and properly displayed 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–40 Acquisition of non–ASCII address book

entries/ADNs. 

as expected 

SPT–AO–41 Acquisition of non–ASCII text messages. as expected 

Analysis: Expected results achieved 

November 2010 137 of 196 Results of Device Seizure 4.0 
 

5.2.86 SPT–39 (Nokia 6790) 

Test Case SPT–39 Device Seizure 4.0 

Case 

Summary: 

SPT–39 Acquire SIM memory and review hash values for vendor supported data

objects.

Assertions: SPT–AO–43 If the cellular forensic tool supports hashing for individual

data objects then the tool shall present the user with a hash value for

each supported data object. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Jul 27 14:54:27 EDT 2010 

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Tue Jul 27 14:54:27 EDT 2010

Acquisition finished: Tue Jul 27 14:55:38 EDT 2010 

Hash values were properly reported for individually acquired SIM data

elements 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–43 Acquire data, check known hash values for

consistency. 

as expected 

Analysis: Expected results achieved 

November 2010 138 of 196 Results of Device Seizure 4.0 
 

5.2.87 SPT–01 (HTC Touch Pro 2) 

Test Case SPT–01 Device Seizure 4.0 

Case 

Summary: 

SPT–01 Acquire mobile device internal memory over tool–supported interfaces

(e.g., cable, Bluetooth, IrDA).

Assertions: SPT–CA–01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

SPT–CA–04 If a cellular forensic tool completes acquisition of the target

device without error then the tool shall have the ability to present

acquired data objects in a useable format via either a preview–pane or

generated report.

SPT–CA–29 If a cellular forensic tool provides the user with an “Acquire

All” device data objects acquisition option then the tool shall complete

the acquisition of all data objects without error.

SPT–CA–30 If a cellular forensic tool provides the user with a “Select All”

individual device data objects then the tool shall complete the acquisition

of all individually selected data objects without error.

SPT–CA–31 If a cellular forensic tool provides the user with the ability to

“Select Individual” device data objects for acquisition then the tool shall

acquire each exclusive data object without error.

SPT–CA–32 If a cellular forensic tool completes two consecutive logical

acquisitions of the target device without error then the payload (data

objects) on the mobile device shall remain consistent. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Wed Jul 28 07:54:21 EDT 2010 

Device: HTC_TouchPro2 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 07:54:21 EDT 2010

Acquisition finished: Wed Jul 28 07:54:29 EDT 2010 

Device connectivity was established via supported interface 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–CA–01 Device connectivity via supported interfaces. as expected

SPT–CA–04 Readability and completeness of acquired data via

supported reports. 

as expected 

SPT–CA–29 Acquire–All data objects acquisition. as expected

SPT–CA–30 Select–All data objects acquisition. as expected

SPT–CA–31 Select–Individual data objects acquisition. as expected

SPT–CA–32 Perform back–to–back acquisitions, check device

payload for modifications. 

as expected 

Analysis: Expected results achieved 

November 2010 139 of 196 Results of Device Seizure 4.0 
 

5.2.88 SPT–02 (HTC Touch Pro 2) 

Test Case SPT–02 Device Seizure 4.0 

Case 

Summary: 

SPT–02 Attempt internal memory acquisition of a non–supported mobile

device. 

Assertions: SPT–CA–02 If a cellular forensic tool attempts to connect to a non–

supported device then the tool shall notify the user that the device is not

supported. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 07:54:51 EDT 2010 

Device: unsupported_device

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 07:54:51 EDT 2010

Acquisition finished: Wed Jul 28 07:54:56 EDT 2010 

Identification of non–supported devices was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–02 Identification of non–supported devices. as expected 

Analysis: Expected results achieved 

November 2010 140 of 196 Results of Device Seizure 4.0 
 

5.2.89 SPT–03 (HTC Touch Pro 2) 

Test Case SPT–03 Device Seizure 4.0 

Case 

Summary: 

SPT–03 Begin mobile device internal memory acquisition and interrupt

connectivity by interface disengagement.

Assertions: SPT–CA–03 If connectivity between the mobile device and cellular forensic

tool is disrupted then the tool shall notify the user that connectivity has

been disrupted. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 08:00:44 EDT 2010 

Device: HTC_TouchPro2 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 08:00:44 EDT 2010

Acquisition finished: Wed Jul 28 08:12:24 EDT 2010 

Device acquisition disruption notification was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–03 Notification of device acquisition disruption. as expected 

Analysis: Expected results achieved 

November 2010 141 of 196 Results of Device Seizure 4.0 
 

5.2.90 SPT–04 (HTC Touch Pro 2) 

Test Case SPT–04 Device Seizure 4.0 

Case 

Summary: 

SPT–04 Acquire mobile device internal memory and review reported data via

the preview–pane or generated reports for readability.

Assertions: SPT–CA–04 If a cellular forensic tool completes acquisition of the target

device without error then the tool shall have the ability to present

acquired data objects in a useable format via either a preview–pane or

generated report. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Wed Jul 28 08:12:44 EDT 2010 

Device: HTC_TouchPro2 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 08:12:44 EDT 2010

Acquisition finished: Wed Jul 28 08:17:18 EDT 2010 

Readability and completeness of acquired data was not successful 

Notes: 

When acquiring memory image and filesystem data the data is only viewable

through the sorter tab. No data is displayed in the case tab. When 

attempting to save the case file the following error occurs: Error, Unknown

error. 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–CA–04 Readability and completeness of acquired data

via supported reports. 

Not as 

expected 

Analysis: Expected results achieved 

November 2010 142 of 196 Results of Device Seizure 4.0 
 

5.2.91 SPT–05 (HTC Touch Pro 2) 

Test Case SPT–05 Device Seizure 4.0 

Case 

Summary: 

SPT–05 Acquire mobile device internal memory and review reported subscriber

and equipment related information (e.g., IMEI/MEID/ESN, MSISDN).

Assertions: SPT–CA–05 If a cellular forensic tool completes acquisition of the target

device without error then subscriber–related information shall be presented

in a useable format. 

SPT–CA–06 If a cellular forensic tool completes acquisition of the target

device without error then equipment related information shall be presented

in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 08:23:26 EDT 2010 

Device: HTC_TouchPro2 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 08:23:26 EDT 2010

Acquisition finished: Wed Jul 28 08:30:39 EDT 2010 

IMEI, MEID/ESN were acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–05 Acquisition of MSISDN, IMSI. as expected

SPT–CA–06 Acquisition of IMEI/MEID/ESN. as expected 

Analysis: Expected results achieved 

November 2010 143 of 196 Results of Device Seizure 4.0 
 

5.2.92 SPT–06 (HTC Touch Pro 2) 

Test Case SPT–06 Device Seizure 4.0 

Case 

Summary: 

SPT–06 Acquire mobile device internal memory and review reported PIM

related data. 

Assertions: SPT–CA–07 If a cellular forensic tool completes acquisition of the target

device without error then address book entries shall be presented in a

useable format. 

SPT–CA–08 If a cellular forensic tool completes acquisition of the target

device without error then maximum length address book entries shall be

presented in a useable format.

SPT–CA–09 If a cellular forensic tool completes acquisition of the target

device without error then address book entries containing special

characters shall be presented in a useable format.

SPT–CA–10 If a cellular forensic tool completes acquisition of the target

device without error then address book entries containing blank names shall

be presented in a useable format.

SPT–CA–11 If a cellular forensic tool completes acquisition of the target

device without error then email addresses associated with address book 

entries shall be presented in a useable format.

SPT–CA–12 If a cellular forensic tool completes acquisition of the target

device without error then graphics associated with address book entries

shall be presented in a useable format.

SPT–CA–13 If a cellular forensic tool completes acquisition of the target

device without error then datebook, calendar, note entries shall be

presented in a useable format.

SPT–CA–14 If a cellular forensic tool completes acquisition of the target

device without error then maximum length datebook, calendar, note entries

shall be presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 08:31:01 EDT 2010 

Device: HTC_TouchPro2 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log Created by Device Seizure Version 4.0

Highlights: Acquisition started: Wed Jul 28 08:31:01 EDT 2010

Acquisition finished: Wed Jul 28 08:32:33 EDT 2010 

Regular Length Address Book entries were acquired

Maximum Length Address Book entries were acquired

Special Character Address Book entries were acquired

Blank Name Address Book entries were acquire

Email addresses within Address Book entries were acquired

Embedded graphics within Address Book entries were not acquired

Basic PIM related data was acquired

Maximum length PIM related data was not acquired 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–CA–07 Acquisition of address book entries. as expected

SPT–CA–08 Acquisition of maximum length address book

entries. 

as expected 

SPT–CA–09 Acquisition of address book entries containing

special characters. 

as expected 

SPT–CA–10 Acquisition of address book entries containing a

blank name entry. 

as expected 

SPT–CA–11 Acquisition of embedded email addresses within

address book entries. 

as expected 

SPT–CA–12 Acquisition of embedded graphics within address

book entries. 

Not as 

expected

SPT–CA–13 Acquisition of PIM data (i.e.,

datebook/calendar, notes). 

as expected 

SPT–CA–14 Acquisition of maximum length PIM data. Not as 

expected 

November 2010 144 of 196 Results of Device Seizure 4.0 
Test Case SPT–06 Device Seizure 4.0 

Analysis: Partial results achieved 

November 2010 145 of 196 Results of Device Seizure 4.0 
 

5.2.93 SPT–07 (HTC Touch Pro 2) 

Test Case SPT–07 Device Seizure 4.0 

Case 

Summary: 

SPT–07 Acquire mobile device internal memory and review reported call logs. 

Assertions: SPT–CA–15 If a cellular forensic tool completes acquisition of the target

device without error then call logs (incoming/outgoing/missed) shall be

presented in a useable format.

SPT–CA–16 If a cellular forensic tool completes acquisition of the target

device without error then the corresponding date/time stamps and the

duration of the call for call logs shall be presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 08:33:32 EDT 2010 

Device: HTC_TouchPro2 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 08:33:32 EDT 2010

Acquisition finished: Wed Jul 28 08:37:11 EDT 2010 

All Call Logs (incoming, outgoing, missed) were acquired

All Call Log date/time stamps data were correctly reported 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–15 Acquisition of call logs. as expected

SPT–CA–16 Acquisition of call log date/time stamps. as expected 

Analysis: Expected results achieved 

November 2010 146 of 196 Results of Device Seizure 4.0 
 

5.2.94 SPT–08 (HTC Touch Pro 2) 

Test Case SPT–08 Device Seizure 4.0 

Case 

Summary: 

SPT–08 Acquire mobile device internal memory and review reported text

messages.

Assertions: SPT–CA–17 If a cellular forensic tool completes acquisition of the target

device without error then ASCII text messages (i.e., SMS, EMS) shall be

presented in a useable format.

SPT–CA–18 If a cellular forensic tool completes acquisition of the target

device without error then the corresponding date/time stamps for text

messages shall be presented in a useable format.

SPT–CA–19 If a cellular forensic tool completes acquisition of the target

device without error then the corresponding status (i.e., read, unread) for

text messages shall be presented in a useable format.

SPT–CA–20 If a cellular forensic tool completes acquisition of the target

device without error then the corresponding sender / recipient phone

numbers for text messages shall be presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 08:37:51 EDT 2010 

Device: HTC_TouchPro2 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 08:37:51 EDT 2010

Acquisition finished: Wed Jul 28 08:43:43 EDT 2010 

Text messages were not acquired 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–CA–17 Acquisition of text messages. Not as 

expected

SPT–CA–18 Acquisition of text message date/time stamps. NA 

SPT–CA–19 Acquisition of text message status flags. NA 

SPT–CA–20 Acquisition of sender/recipient phone number

associated with text messages. 

NA 

Analysis: Expected results Not achieved 

November 2010 147 of 196 Results of Device Seizure 4.0 
 

5.2.95 SPT–09 (HTC Touch Pro 2) 

Test Case SPT–09 Device Seizure 4.0 

Case 

Summary: 

SPT–09 Acquire mobile device internal memory and review reported MMS multi–

media related data (i.e., text, audio, graphics, video).

Assertions: SPT–CA–21 If a cellular forensic tool completes acquisition of the target

device without error then MMS messages and associated audio shall be

presented in a useable format.

SPT–CA–22 If a cellular forensic tool completes acquisition of the target

device without error then MMS messages and associated graphic files shall

be presented in a useable format.

SPT–CA–23 If a cellular forensic tool completes acquisition of the target

device without error then MMS messages and associated video shall be

presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 08:44:19 EDT 2010 

Device: HTC_TouchPro2 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 08:44:19 EDT 2010

Acquisition finished: Wed Jul 28 08:48:22 EDT 2010 

Audio MMS messages were not acquired

Image MMS messages were not acquired

Video MMS messages were not acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–21 Acquisition of audio MMS messages. Not as 

expected

SPT–CA–22 Acquisition of graphic data image MMS

messages. 

Not as 

expected

SPT–CA–23 Acquisition of video MMS messages. Not as 

expected 

Analysis: Expected results Not achieved 

November 2010 148 of 196 Results of Device Seizure 4.0 
 

5.2.96 SPT–10 (HTC Touch Pro 2) 

Test Case SPT–10 Device Seizure 4.0 

Case 

Summary: 

SPT–10 Acquire mobile device internal memory and review reported stand–

alone multi–media data (i.e., audio, graphics, video).

Assertions: SPT–CA–24 If a cellular forensic tool completes acquisition of the target

device without error then stand–alone audio files shall be presented in a

useable format via either an internal application or suggested third–party

application.

SPT–CA–25 If a cellular forensic tool completes acquisition of the target

device without error then stand–alone graphic files shall be presented in a

useable format via either an internal application or suggested third–party

application.

SPT–CA–26 If a cellular forensic tool completes acquisition of the target

device without error then stand–alone video files shall be presented in a

useable format via either an internal application or suggested third–party

application. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Wed Jul 28 08:48:45 EDT 2010 

Device: HTC_TouchPro2 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 08:48:45 EDT 2010

Acquisition finished: Wed Jul 28 08:57:41 EDT 2010 

Audio files were not acquired

Image files were not acquired

Video files were not acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–24 Acquisition of stand–alone audio files. Not as expected

SPT–CA–25 Acquisition of stand–alone graphic files. Not as expected

SPT–CA–26 Acquisition of stand–alone video files. Not as expected 

Analysis: Expected results Not achieved 

November 2010 149 of 196 Results of Device Seizure 4.0 
 

5.2.97 SPT–11 (HTC Touch Pro 2) 

Test Case SPT–11 Device Seizure 4.0 

Case 

Summary: 

SPT–11 Acquire mobile device internal memory and review application related

data (i.e., word documents, spreadsheet, presentation documents).

Assertions: SPT–CA–27 If a cellular forensic tool completes acquisition of the target

device without error then device specific application related data shall be

acquired and presented in a useable format via either an internal

application or suggested third–party application. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Wed Jul 28 08:58:00 EDT 2010 

Device: HTC_TouchPro2 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 08:58:00 EDT 2010

Acquisition finished: Wed Jul 28 09:01:44 EDT 2010 

Application data was not acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–27 Acquisition of application related data. Not as expected 

Analysis: Expected results Not achieved 

November 2010 150 of 196 Results of Device Seizure 4.0 
 

5.2.98 SPT–12 (HTC Touch Pro 2) 

Test Case SPT–12 Device Seizure 4.0 

Case 

Summary: 

SPT–12 Acquire mobile device internal memory and review Internet related

data (i.e., bookmarks, visited sites.

Assertions: SPT–CA–28 If a cellular forensic tool completes acquisition of the target

device without error then Internet related data (i.e., bookmarks, visited

sites) cached to the device shall be acquired and presented in a useable

format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 09:02:06 EDT 2010 

Device: HTC_TouchPro2 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 09:02:06 EDT 2010

Acquisition finished: Wed Jul 28 09:05:03 EDT 2010 

All Internet related data was acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–28 Acquisition of Internet related data. as expected 

Analysis: Expected results achieved 

November 2010 151 of 196 Results of Device Seizure 4.0 
 

5.2.99 SPT–13 (HTC Touch Pro 2) 

Test Case SPT–13 Device Seizure 4.0 

Case 

Summary: 

SPT–13 Acquire mobile device internal memory by selecting a combination of

supported data elements.

Assertions: SPT–CA–29 If a cellular forensic tool provides the user with an “Acquire

All” device data objects acquisition option then the tool shall complete

the acquisition of all data objects without error.

SPT–CA–30 If a cellular forensic tool provides the user with an “Select

All” individual device data objects then the tool shall complete the

acquisition of all individually selected data objects without error.

SPT–CA–31 If a cellular forensic tool provides the user with the ability to

“Select Individual” device data objects for acquisition then the tool shall

acquire each exclusive data object without error. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 09:05:27 EDT 2010 

Device: HTC_TouchPro2 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 09:05:27 EDT 2010

Acquisition finished: Wed Jul 28 09:07:25 EDT 2010 

Acquire All acquisition was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–29 Acquire–All data objects acquisition. as expected

SPT–CA–30 Select–All data objects acquisition. as expected

SPT–CA–31 Select–Individual data objects acquisition. as expected 

Analysis: Expected results achieved 

November 2010 152 of 196 Results of Device Seizure 4.0 
 

5.2.100 SPT–24 (HTC Touch Pro 2) 

Test Case SPT–24 Device Seizure 4.0 

Case 

Summary: 

SPT–24 Acquire mobile device internal memory and review reported data via

supported generated report formats.

Assertions: SPT–AO–25 If a cellular forensic tool completes acquisition of the target

device without error then the tool shall present the acquired data in a

useable format via supported generated report formats. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 09:08:57 EDT 2010 

Device: HTC_TouchPro2 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 09:08:57 EDT 2010

Acquisition finished: Wed Jul 28 09:11:45 EDT 2010 

Complete representation of known data via generated reports was not

successful 

Notes: 

When attempting to generate a report the following error occurs: Reporting

error: Object reference not set to an instance of an object. 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–25 Comparison of known device data elements via

generated reports. 

Not as 

expected 

Analysis: Expected results Not achieved 

November 2010 153 of 196 Results of Device Seizure 4.0 
 

5.2.101 SPT–25 (HTC Touch Pro 2) 

Test Case SPT–25 Device Seizure 4.0 

Case 

Summary: 

SPT–25 Acquire mobile device internal memory and review reported data via

the preview pane.

Assertions: SPT–AO–26 If a cellular forensic tool completes acquisition of the target

device without error then the tool shall present the acquired data in a

useable format in a preview–pane view. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 09:16:14 EDT 2010 

Device: HTC_TouchPro2 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 09:16:14 EDT 2010

Acquisition finished: Wed Jul 28 09:18:29 EDT 2010 

Complete representation of known data via preview–pane was successful 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–26 Comparison of known device data elements via

preview–pane. 

as expected 

Analysis: Expected results achieved 

November 2010 154 of 196 Results of Device Seizure 4.0 
 

5.2.102 SPT–29 (HTC Touch Pro 2) 

Test Case SPT–29 Device Seizure 4.0 

Case 

Summary: 

SPT–29 After a successful mobile device internal memory, alter the case

file via third–party means and attempt to re–open the case.

Assertions: SPT–AO–27 If the case file or individual data objects are modified via

third–party means then the tool shall provide protection mechanisms

disallowing or reporting data modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 09:18:57 EDT 2010 

Device: HTC_TouchPro2 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 09:18:57 EDT 2010

Acquisition finished: Wed Jul 28 09:22:57 EDT 2010 

Notification of modified device memory data was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–27 Notification of modified device case data. as expected 

Analysis: Expected results achieved 

November 2010 155 of 196 Results of Device Seizure 4.0 
 

5.2.103 SPT–31 (HTC Touch Pro 2) 

Test Case SPT–31 Device Seizure 4.0 

Case 

Summary: 

SPT–31 Perform a physical acquisition and review data output for

readability.

Assertions: SPT–AO–31 If the cellular forensic tool supports a physical acquisition of

the target device then the tool shall complete the acquisition without

error. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 09:28:20 EDT 2010 

Device: HTC_TouchPro2 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 09:28:20 EDT 2010

Acquisition finished: Wed Jul 28 09:29:25 EDT 2010 

Physical Acquisition: readability and completeness was not successful 

Notes: 

Data acquired from performing the physical acquisition was not decoded. 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–31 Physical acquisition, data is presented in a

useable format. 

Not as 

expected 

Analysis: Expected results Not achieved 

November 2010 156 of 196 Results of Device Seizure 4.0 
 

5.2.104 SPT–33 (HTC Touch Pro 2) 

Test Case SPT–33 Device Seizure 4.0 

Case 

Summary: 

SPT–33 Acquire mobile device internal memory and review data containing

non–ASCII characters. 

Assertions: SPT–AO–40 If the cellular forensic tool supports display of non–ASCII

characters then the application should present address book entries in

their native format. 

SPT–AO–41 If the cellular forensic tool supports proper display of non–

ASCII characters then the application should present text messages in their

native format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 09:23:52 EDT 2010 

Device: HTC_TouchPro2 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 09:23:52 EDT 2010

Acquisition finished: Wed Jul 28 09:26:03 EDT 2010 

Non–ASCII Address book entries were acquired and properly displayed

Non–ASCII text messages were not acquired 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–40 Acquisition of non–ASCII address book

entries/ADNs. 

as expected 

SPT–AO–41 Acquisition of non–ASCII text messages. NA 

Analysis: Expected results achieved 

November 2010 157 of 196 Results of Device Seizure 4.0 
 

5.2.105 SPT–38 (HTC Touch Pro 2) 

Test Case SPT–38 Device Seizure 4.0 

Case 

Summary: 

SPT–38 Acquire mobile device internal memory and review hash values for

vendor supported data objects.

Assertions: SPT–AO–43 If the cellular forensic tool supports hashing for individual

data objects then the tool shall present the user with a hash value for

each supported data object. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 09:27:11 EDT 2010 

Device: HTC_TouchPro2 

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 09:27:11 EDT 2010

Acquisition finished: Wed Jul 28 09:27:46 EDT 2010 

Hash values were properly reported for individually acquired device data

elements 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–43 Acquire data, check known hash values for

consistency. 

as expected 

Analysis: Expected results achieved 

November 2010 158 of 196 Results of Device Seizure 4.0 
 

5.2.106 SPT–01 (Blackberry 9630) 

Test Case SPT–01 Device Seizure 4.0 

Case 

Summary: 

SPT–01 Acquire mobile device internal memory over tool–supported interfaces

(e.g., cable, Bluetooth, IrDA).

Assertions: SPT–CA–01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

SPT–CA–04 If a cellular forensic tool completes acquisition of the target

device without error then the tool shall have the ability to present

acquired data objects in a useable format via either a preview–pane or

generated report.

SPT–CA–29 If a cellular forensic tool provides the user with an “Acquire

All” device data objects acquisition option then the tool shall complete

the acquisition of all data objects without error.

SPT–CA–30 If a cellular forensic tool provides the user with a “Select All”

individual device data objects then the tool shall complete the acquisition

of all individually selected data objects without error.

SPT–CA–31 If a cellular forensic tool provides the user with the ability to

“Select Individual” device data objects for acquisition then the tool shall

acquire each exclusive data object without error.

SPT–CA–32 If a cellular forensic tool completes two consecutive logical

acquisitions of the target device without error then the payload (data

objects) on the mobile device shall remain consistent. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Wed Jul 28 12:13:11 EDT 2010 

Device: Blackberry_9630

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 12:13:11 EDT 2010

Acquisition finished: Wed Jul 28 12:18:08 EDT 2010 

Device connectivity was established via supported interface 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–CA–01 Device connectivity via supported interfaces. as expected

SPT–CA–04 Readability and completeness of acquired data via

supported reports. 

as expected 

SPT–CA–29 Acquire–All data objects acquisition. as expected

SPT–CA–30 Select–All data objects acquisition. as expected

SPT–CA–31 Select–Individual data objects acquisition. as expected

SPT–CA–32 Perform back–to–back acquisitions, check device

payload for modifications. 

as expected 

Analysis: Expected results achieved 

November 2010 159 of 196 Results of Device Seizure 4.0 
 

5.2.107 SPT–02 (Blackberry 9630) 

Test Case SPT–02 Device Seizure 4.0 

Case 

Summary: 

SPT–02 Attempt internal memory acquisition of a non–supported mobile

device. 

Assertions: SPT–CA–02 If a cellular forensic tool attempts to connect to a non–

supported device then the tool shall notify the user that the device is not

supported. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 12:18:38 EDT 2010 

Device: non_supported_device

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 12:18:38 EDT 2010

Acquisition finished: Wed Jul 28 12:19:45 EDT 2010 

Identification of non–supported devices was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–02 Identification of non–supported devices. as expected 

Analysis: Expected results achieved 

November 2010 160 of 196 Results of Device Seizure 4.0 
 

5.2.108 SPT–03 (Blackberry 9630) 

Test Case SPT–03 Device Seizure 4.0 

Case 

Summary: 

SPT–03 Begin mobile device internal memory acquisition and interrupt

connectivity by interface disengagement.

Assertions: SPT–CA–03 If connectivity between the mobile device and cellular forensic

tool is disrupted then the tool shall notify the user that connectivity has

been disrupted. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 12:22:40 EDT 2010 

Device: Blackberry_9630

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 12:22:40 EDT 2010

Acquisition finished: Wed Jul 28 12:30:46 EDT 2010 

Device acquisition disruption notification was not successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–03 Notification of device acquisition

disruption. 

Not as 

expected 

Analysis: Expected results Not achieved 

November 2010 161 of 196 Results of Device Seizure 4.0 
 

5.2.109 SPT–04 (Blackberry 9630) 

Test Case SPT–04 Device Seizure 4.0 

Case 

Summary: 

SPT–04 Acquire mobile device internal memory and review reported data via

the preview–pane or generated reports for readability.

Assertions: SPT–CA–04 If a cellular forensic tool completes acquisition of the target

device without error then the tool shall have the ability to present

acquired data objects in a useable format via either a preview–pane or

generated report. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Wed Jul 28 12:31:51 EDT 2010 

Device: Blackberry_9630

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 12:31:51 EDT 2010

Acquisition finished: Wed Jul 28 12:35:22 EDT 2010 

Readability and completeness of acquired data was successful 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–CA–04 Readability and completeness of acquired data

via supported reports. 

as expected 

Analysis: Expected results achieved 

November 2010 162 of 196 Results of Device Seizure 4.0 
 

5.2.110 SPT–05 (Blackberry 9630) 

Test Case SPT–05 Device Seizure 4.0 

Case 

Summary: 

SPT–05 Acquire mobile device internal memory and review reported subscriber

and equipment related information (e.g., IMEI/MEID/ESN, MSISDN).

Assertions: SPT–CA–05 If a cellular forensic tool completes acquisition of the target

device without error then subscriber–related information shall be presented

in a useable format. 

SPT–CA–06 If a cellular forensic tool completes acquisition of the target

device without error then equipment related information shall be presented

in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 12:35:51 EDT 2010 

Device: Blackberry_9630

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 12:35:51 EDT 2010

Acquisition finished: Wed Jul 28 12:40:58 EDT 2010 

IMEI, MEID/ESN were not acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–05 Acquisition of MSISDN, IMSI. Not as expected

SPT–CA–06 Acquisition of IMEI/MEID/ESN. Not as expected 

Analysis: Expected results Not achieved 

November 2010 163 of 196 Results of Device Seizure 4.0 
 

5.2.111 SPT–06 (Blackberry 9630) 

Test Case SPT–06 Device Seizure 4.0 

Case 

Summary: 

SPT–06 Acquire mobile device internal memory and review reported PIM

related data. 

Assertions: SPT–CA–07 If a cellular forensic tool completes acquisition of the target

device without error then address book entries shall be presented in a

useable format. 

SPT–CA–08 If a cellular forensic tool completes acquisition of the target

device without error then maximum length address book entries shall be

presented in a useable format.

SPT–CA–09 If a cellular forensic tool completes acquisition of the target

device without error then address book entries containing special

characters shall be presented in a useable format.

SPT–CA–10 If a cellular forensic tool completes acquisition of the target

device without error then address book entries containing blank names shall

be presented in a useable format.

SPT–CA–11 If a cellular forensic tool completes acquisition of the target

device without error then email addresses associated with address book 

entries shall be presented in a useable format.

SPT–CA–12 If a cellular forensic tool completes acquisition of the target

device without error then graphics associated with address book entries

shall be presented in a useable format.

SPT–CA–13 If a cellular forensic tool completes acquisition of the target

device without error then datebook, calendar, note entries shall be

presented in a useable format.

SPT–CA–14 If a cellular forensic tool completes acquisition of the target

device without error then maximum length datebook, calendar, note entries

shall be presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 12:41:36 EDT 2010 

Device: Blackberry_9630

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log Created by Device Seizure Version 4.0

Highlights: Acquisition started: Wed Jul 28 12:41:36 EDT 2010

Acquisition finished: Wed Jul 28 13:07:25 EDT 2010 

Regular Length Address Book entries were acquired

Maximum Length Address Book entries were acquired

Special Character Address Book entries were acquired

Blank Name Address Book entries were acquire

Email addresses within Address Book entries were acquired

Embedded graphics within Address Book entries were not acquired

ALL PIM related data was acquired 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–CA–07 Acquisition of address book entries. as expected

SPT–CA–08 Acquisition of maximum length address book

entries. 

as expected 

SPT–CA–09 Acquisition of address book entries containing

special characters. 

as expected 

SPT–CA–10 Acquisition of address book entries containing a

blank name entry. 

as expected 

SPT–CA–11 Acquisition of embedded email addresses within

address book entries. 

as expected 

SPT–CA–12 Acquisition of embedded graphics within address

book entries. 

Not as 

expected

SPT–CA–13 Acquisition of PIM data (i.e.,

datebook/calendar, notes). 

as expected 

SPT–CA–14 Acquisition of maximum length PIM data. as expected 

November 2010 164 of 196 Results of Device Seizure 4.0 
Test Case SPT–06 Device Seizure 4.0 

Analysis: Partial results achieved 

November 2010 165 of 196 Results of Device Seizure 4.0 
 

5.2.112 SPT–07 (Blackberry 9630) 

Test Case SPT–07 Device Seizure 4.0 

Case 

Summary: 

SPT–07 Acquire mobile device internal memory and review reported call logs. 

Assertions: SPT–CA–15 If a cellular forensic tool completes acquisition of the target

device without error then call logs (incoming/outgoing/missed) shall be

presented in a useable format.

SPT–CA–16 If a cellular forensic tool completes acquisition of the target

device without error then the corresponding date/time stamps and the

duration of the call for call logs shall be presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 13:34:04 EDT 2010 

Device: Blackberry_9630

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 13:34:04 EDT 2010

Acquisition finished: Wed Jul 28 13:39:59 EDT 2010 

All Call Logs (incoming, outgoing, missed) were acquired

All Call Log date/time stamps data were correctly reported 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–15 Acquisition of call logs. as expected

SPT–CA–16 Acquisition of call log date/time stamps. as expected 

Analysis: Expected results achieved 

November 2010 166 of 196 Results of Device Seizure 4.0 
 

5.2.113 SPT–08 (Blackberry 9630) 

Test Case SPT–08 Device Seizure 4.0 

Case 

Summary: 

SPT–08 Acquire mobile device internal memory and review reported text

messages.

Assertions: SPT–CA–17 If a cellular forensic tool completes acquisition of the target

device without error then ASCII text messages (i.e., SMS, EMS) shall be

presented in a useable format.

SPT–CA–18 If a cellular forensic tool completes acquisition of the target

device without error then the corresponding date/time stamps for text

messages shall be presented in a useable format.

SPT–CA–19 If a cellular forensic tool completes acquisition of the target

device without error then the corresponding status (i.e., read, unread) for

text messages shall be presented in a useable format.

SPT–CA–20 If a cellular forensic tool completes acquisition of the target

device without error then the corresponding sender / recipient phone

numbers for text messages shall be presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 13:41:18 EDT 2010 

Device: Blackberry_9630

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 13:41:18 EDT 2010

Acquisition finished: Wed Jul 28 13:42:14 EDT 2010 

ALL text messages (SMS, EMS) were acquired

Correct date/time stamps were reported for all text messages

Correct status flags were reported for all text messages

Sender and Recipient phone numbers associated with text messages were

correctly reported 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–CA–17 Acquisition of text messages. as expected

SPT–CA–18 Acquisition of text message date/time stamps. as expected

SPT–CA–19 Acquisition of text message status flags. as expected

SPT–CA–20 Acquisition of sender/recipient phone number

associated with text messages. 

as expected 

Analysis: Expected results achieved 

November 2010 167 of 196 Results of Device Seizure 4.0 
 

5.2.114 SPT–09 (Blackberry 9630) 

Test Case SPT–09 Device Seizure 4.0 

Case 

Summary: 

SPT–09 Acquire mobile device internal memory and review reported MMS multi–

media related data (i.e., text, audio, graphics, video).

Assertions: SPT–CA–21 If a cellular forensic tool completes acquisition of the target

device without error then MMS messages and associated audio shall be

presented in a useable format.

SPT–CA–22 If a cellular forensic tool completes acquisition of the target

device without error then MMS messages and associated graphic files shall

be presented in a useable format.

SPT–CA–23 If a cellular forensic tool completes acquisition of the target

device without error then MMS messages and associated video shall be

presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 13:42:46 EDT 2010 

Device: Blackberry_9630

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 13:42:46 EDT 2010

Acquisition finished: Wed Jul 28 13:46:44 EDT 2010 

Partial audio MMS messages were acquired

Partial image MMS messages were acquired

Partial video MMS messages were acquired 

Notes: 

The attached audio, video and graphics files were not acquired. 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–CA–21 Acquisition of audio MMS messages. Partial 

SPT–CA–22 Acquisition of graphic data image MMS

messages. 

Partial 

SPT–CA–23 Acquisition of video MMS messages. Partial 

Analysis: Partial results achieved 

November 2010 168 of 196 Results of Device Seizure 4.0 
 

5.2.115 SPT–10 (Blackberry 9630) 

Test Case SPT–10 Device Seizure 4.0 

Case 

Summary: 

SPT–10 Acquire mobile device internal memory and review reported stand–

alone multi–media data (i.e., audio, graphics, video).

Assertions: SPT–CA–24 If a cellular forensic tool completes acquisition of the target

device without error then stand–alone audio files shall be presented in a

useable format via either an internal application or suggested third–party

application.

SPT–CA–25 If a cellular forensic tool completes acquisition of the target

device without error then stand–alone graphic files shall be presented in a

useable format via either an internal application or suggested third–party

application.

SPT–CA–26 If a cellular forensic tool completes acquisition of the target

device without error then stand–alone video files shall be presented in a

useable format via either an internal application or suggested third–party

application. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Wed Jul 28 13:47:52 EDT 2010 

Device: Blackberry_9630

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 13:47:52 EDT 2010

Acquisition finished: Wed Jul 28 13:49:50 EDT 2010 

Audio files were not acquired

Image files were not acquired

Video files were not acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–24 Acquisition of stand–alone audio files. Not as expected

SPT–CA–25 Acquisition of stand–alone graphic files. Not as expected

SPT–CA–26 Acquisition of stand–alone video files. Not as expected 

Analysis: Expected results Not achieved 

November 2010 169 of 196 Results of Device Seizure 4.0 
 

5.2.116 SPT–11 (Blackberry 9630) 

Test Case SPT–11 Device Seizure 4.0 

Case 

Summary: 

SPT–11 Acquire mobile device internal memory and review application related

data (i.e., word documents, spreadsheet, presentation documents).

Assertions: SPT–CA–27 If a cellular forensic tool completes acquisition of the target

device without error then device specific application related data shall be

acquired and presented in a useable format via either an internal

application or suggested third–party application. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Wed Jul 28 13:50:39 EDT 2010 

Device: Blackberry_9630

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 13:50:39 EDT 2010

Acquisition finished: Wed Jul 28 13:52:01 EDT 2010 

Application data was not acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–27 Acquisition of application related data. Not as expected 

Analysis: Expected results Not achieved 

November 2010 170 of 196 Results of Device Seizure 4.0 
 

5.2.117 SPT–12 (Blackberry 9630) 

Test Case SPT–12 Device Seizure 4.0 

Case 

Summary: 

SPT–12 Acquire mobile device internal memory and review Internet related

data (i.e., bookmarks, visited sites.

Assertions: SPT–CA–28 If a cellular forensic tool completes acquisition of the target

device without error then Internet related data (i.e., bookmarks, visited

sites) cached to the device shall be acquired and presented in a useable

format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 13:53:50 EDT 2010 

Device: Blackberry_9630

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 13:53:50 EDT 2010

Acquisition finished: Wed Jul 28 13:55:12 EDT 2010 

Internet related data was not acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–28 Acquisition of Internet related data. Not as expected 

Analysis: Expected results Not achieved 

November 2010 171 of 196 Results of Device Seizure 4.0 
 

5.2.118 SPT–13 (Blackberry 9630) 

Test Case SPT–13 Device Seizure 4.0 

Case 

Summary: 

SPT–13 Acquire mobile device internal memory by selecting a combination of

supported data elements.

Assertions: SPT–CA–29 If a cellular forensic tool provides the user with an “Acquire

All” device data objects acquisition option then the tool shall complete

the acquisition of all data objects without error.

SPT–CA–30 If a cellular forensic tool provides the user with an “Select

All” individual device data objects then the tool shall complete the

acquisition of all individually selected data objects without error.

SPT–CA–31 If a cellular forensic tool provides the user with the ability to

“Select Individual” device data objects for acquisition then the tool shall

acquire each exclusive data object without error. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 13:55:42 EDT 2010 

Device: Blackberry_9630

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 13:55:42 EDT 2010

Acquisition finished: Wed Jul 28 14:03:40 EDT 2010 

Acquire All acquisition was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–29 Acquire–All data objects acquisition. as expected

SPT–CA–30 Select–All data objects acquisition. as expected

SPT–CA–31 Select–Individual data objects acquisition. as expected 

Analysis: Expected results achieved 

November 2010 172 of 196 Results of Device Seizure 4.0 
 

5.2.119 SPT–24 (Blackberry 9630) 

Test Case SPT–24 Device Seizure 4.0 

Case 

Summary: 

SPT–24 Acquire mobile device internal memory and review reported data via

supported generated report formats.

Assertions: SPT–AO–25 If a cellular forensic tool completes acquisition of the target

device without error then the tool shall present the acquired data in a

useable format via supported generated report formats. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 14:05:59 EDT 2010 

Device: Blackberry_9630

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 14:05:59 EDT 2010

Acquisition finished: Wed Jul 28 14:09:54 EDT 2010 

Complete representation of known data via generated reports was successful 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–25 Comparison of known device data elements via

generated reports. 

as expected 

Analysis: Expected results achieved 

November 2010 173 of 196 Results of Device Seizure 4.0 
 

5.2.120 SPT–25 (Blackberry 9630) 

Test Case SPT–25 Device Seizure 4.0 

Case 

Summary: 

SPT–25 Acquire mobile device internal memory and review reported data via

the preview pane.

Assertions: SPT–AO–26 If a cellular forensic tool completes acquisition of the target

device without error then the tool shall present the acquired data in a

useable format in a preview–pane view. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 14:10:23 EDT 2010 

Device: Blackberry_9630

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 14:10:23 EDT 2010

Acquisition finished: Wed Jul 28 14:12:48 EDT 2010 

Complete representation of known data via preview–pane was successful 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–26 Comparison of known device data elements via

preview–pane. 

as expected 

Analysis: Expected results achieved 

November 2010 174 of 196 Results of Device Seizure 4.0 
 

5.2.121 SPT–29 (Blackberry 9630) 

Test Case SPT–29 Device Seizure 4.0 

Case 

Summary: 

SPT–29 After a successful mobile device internal memory, alter the case

file via third–party means and attempt to re–open the case.

Assertions: SPT–AO–27 If the case file or individual data objects are modified via

third–party means then the tool shall provide protection mechanisms

disallowing or reporting data modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 14:13:19 EDT 2010 

Device: Blackberry_9630

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 14:13:19 EDT 2010

Acquisition finished: Wed Jul 28 14:16:56 EDT 2010 

Notification of modified device memory data was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–27 Notification of modified device case data. as expected 

Analysis: Expected results achieved 

November 2010 175 of 196 Results of Device Seizure 4.0 
 

5.2.122 SPT–33 (Blackberry 9630) 

Test Case SPT–33 Device Seizure 4.0 

Case 

Summary: 

SPT–33 Acquire mobile device internal memory and review data containing

non–ASCII characters. 

Assertions: SPT–AO–40 If the cellular forensic tool supports display of non–ASCII

characters then the application should present address book entries in

their native format. 

SPT–AO–41 If the cellular forensic tool supports proper display of non–

ASCII characters then the application should present text messages in their

native format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 14:17:21 EDT 2010 

Device: Blackberry_9630

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 14:17:21 EDT 2010

Acquisition finished: Wed Jul 28 14:21:11 EDT 2010 

Non–ASCII Address book entries were not acquired

Non–ASCII text messages were not acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–40 Acquisition of non–ASCII address book

entries/ADNs. 

Not as 

expected

SPT–AO–41 Acquisition of non–ASCII text messages. Not as 

expected 

Analysis: Expected results Not achieved 

November 2010 176 of 196 Results of Device Seizure 4.0 
 

5.2.123 SPT–38 (Blackberry 9630) 

Test Case SPT–38 Device Seizure 4.0 

Case 

Summary: 

SPT–38 Acquire mobile device internal memory and review hash values for

vendor supported data objects.

Assertions: SPT–AO–43 If the cellular forensic tool supports hashing for individual

data objects then the tool shall present the user with a hash value for

each supported data object. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Jul 28 14:26:17 EDT 2010 

Device: Blackberry_9630

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Wed Jul 28 14:26:17 EDT 2010

Acquisition finished: Wed Jul 28 14:28:11 EDT 2010 

Hash values were properly reported for individually acquired device data

elements 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–43 Acquire data, check known hash values for

consistency. 

as expected 

Analysis: Expected results achieved 

November 2010 177 of 196 Results of Device Seizure 4.0 
 

5.2.124 SPT–01 (Palm pixi) 

Test Case SPT–01 Device Seizure 4.0 

Case 

Summary: 

SPT–01 Acquire mobile device internal memory over tool–supported interfaces

(e.g., cable, Bluetooth, IrDA).

Assertions: SPT–CA–01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

SPT–CA–04 If a cellular forensic tool completes acquisition of the target

device without error then the tool shall have the ability to present

acquired data objects in a useable format via either a preview–pane or

generated report.

SPT–CA–29 If a cellular forensic tool provides the user with an “Acquire

All” device data objects acquisition option then the tool shall complete

the acquisition of all data objects without error.

SPT–CA–30 If a cellular forensic tool provides the user with a “Select All”

individual device data objects then the tool shall complete the acquisition

of all individually selected data objects without error.

SPT–CA–31 If a cellular forensic tool provides the user with the ability to

“Select Individual” device data objects for acquisition then the tool shall

acquire each exclusive data object without error.

SPT–CA–32 If a cellular forensic tool completes two consecutive logical

acquisitions of the target device without error then the payload (data

objects) on the mobile device shall remain consistent. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Thu Jul 29 12:42:53 EDT 2010 

Device: Palm_pixi

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Thu Jul 29 12:42:53 EDT 2010

Acquisition finished: Thu Jul 29 12:44:54 EDT 2010 

Device connectivity was established via supported interface 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–CA–01 Device connectivity via supported interfaces. as expected

SPT–CA–04 Readability and completeness of acquired data via

supported reports. 

as expected 

SPT–CA–29 Acquire–All data objects acquisition. as expected

SPT–CA–30 Select–All data objects acquisition. as expected

SPT–CA–31 Select–Individual data objects acquisition. as expected

SPT–CA–32 Perform back–to–back acquisitions, check device

payload for modifications. 

as expected 

Analysis: Expected results achieved 

November 2010 178 of 196 Results of Device Seizure 4.0 
 

5.2.125 SPT–02 (Palm pixi) 

Test Case SPT–02 Device Seizure 4.0 

Case 

Summary: 

SPT–02 Attempt internal memory acquisition of a non–supported mobile

device. 

Assertions: SPT–CA–02 If a cellular forensic tool attempts to connect to a non–

supported device then the tool shall notify the user that the device is not

supported. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu Jul 29 12:45:37 EDT 2010 

Device: non_supported_device

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Thu Jul 29 12:45:37 EDT 2010

Acquisition finished: Thu Jul 29 12:47:22 EDT 2010 

Identification of non–supported devices was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–02 Identification of non–supported devices. as expected 

Analysis: Expected results achieved 

November 2010 179 of 196 Results of Device Seizure 4.0 
 

5.2.126 SPT–03 (Palm pixi) 

Test Case SPT–03 Device Seizure 4.0 

Case 

Summary: 

SPT–03 Begin mobile device internal memory acquisition and interrupt

connectivity by interface disengagement.

Assertions: SPT–CA–03 If connectivity between the mobile device and cellular forensic

tool is disrupted then the tool shall notify the user that connectivity has

been disrupted. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu Jul 29 12:47:45 EDT 2010 

Device: Palm_pixi

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Thu Jul 29 12:47:45 EDT 2010

Acquisition finished: Thu Jul 29 12:55:04 EDT 2010 

Device acquisition disruption notification was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–03 Notification of device acquisition disruption. as expected 

Analysis: Expected results achieved 

November 2010 180 of 196 Results of Device Seizure 4.0 
 

5.2.127 SPT–04 (Palm pixi) 

Test Case SPT–04 Device Seizure 4.0 

Case 

Summary: 

SPT–04 Acquire mobile device internal memory and review reported data via

the preview–pane or generated reports for readability.

Assertions: SPT–CA–04 If a cellular forensic tool completes acquisition of the target

device without error then the tool shall have the ability to present

acquired data objects in a useable format via either a preview–pane or

generated report. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Thu Jul 29 12:55:41 EDT 2010 

Device: Palm_pixi

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Thu Jul 29 12:55:41 EDT 2010

Acquisition finished: Thu Jul 29 13:01:01 EDT 2010 

Readability and completeness of acquired data was successful 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–CA–04 Readability and completeness of acquired data

via supported reports. 

as expected 

Analysis: Expected results achieved 

November 2010 181 of 196 Results of Device Seizure 4.0 
 

5.2.128 SPT–05 (Palm pixi) 

Test Case SPT–05 Device Seizure 4.0 

Case 

Summary: 

SPT–05 Acquire mobile device internal memory and review reported subscriber

and equipment related information (e.g., IMEI/MEID/ESN, MSISDN).

Assertions: SPT–CA–05 If a cellular forensic tool completes acquisition of the target

device without error then subscriber–related information shall be presented

in a useable format. 

SPT–CA–06 If a cellular forensic tool completes acquisition of the target

device without error then equipment related information shall be presented

in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu Jul 29 13:01:20 EDT 2010 

Device: Palm_pixi

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Thu Jul 29 13:01:20 EDT 2010

Acquisition finished: Thu Jul 29 13:07:07 EDT 2010 

IMEI, MEID/ESN were not acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–05 Acquisition of MSISDN, IMSI. Not as expected

SPT–CA–06 Acquisition of IMEI/MEID/ESN. Not as expected 

Analysis: Expected results Not achieved 

November 2010 182 of 196 Results of Device Seizure 4.0 
 

5.2.129 SPT–06 (Palm pixi) 

Test Case SPT–06 Device Seizure 4.0 

Case 

Summary: 

SPT–06 Acquire mobile device internal memory and review reported PIM

related data. 

Assertions: SPT–CA–07 If a cellular forensic tool completes acquisition of the target

device without error then address book entries shall be presented in a

useable format. 

SPT–CA–08 If a cellular forensic tool completes acquisition of the target

device without error then maximum length address book entries shall be

presented in a useable format.

SPT–CA–09 If a cellular forensic tool completes acquisition of the target

device without error then address book entries containing special

characters shall be presented in a useable format.

SPT–CA–10 If a cellular forensic tool completes acquisition of the target

device without error then address book entries containing blank names shall

be presented in a useable format.

SPT–CA–11 If a cellular forensic tool completes acquisition of the target

device without error then email addresses associated with address book 

entries shall be presented in a useable format.

SPT–CA–12 If a cellular forensic tool completes acquisition of the target

device without error then graphics associated with address book entries

shall be presented in a useable format.

SPT–CA–13 If a cellular forensic tool completes acquisition of the target

device without error then datebook, calendar, note entries shall be

presented in a useable format.

SPT–CA–14 If a cellular forensic tool completes acquisition of the target

device without error then maximum length datebook, calendar, note entries

shall be presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu Jul 29 13:07:35 EDT 2010 

Device: Palm_pixi

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log Created by Device Seizure Version 4.0

Highlights: Acquisition started: Thu Jul 29 13:07:35 EDT 2010

Acquisition finished: Thu Jul 29 13:11:43 EDT 2010 

Regular Length Address Book entries were acquired

Maximum Length Address Book entries were acquired

Special Character Address Book entries were acquired

Blank Name Address Book entries were acquire

Email addresses within Address Book entries were acquired

Embedded graphics within Address Book entries were not acquired

ALL PIM related data was acquired 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–CA–07 Acquisition of address book entries. as expected

SPT–CA–08 Acquisition of maximum length address book

entries. 

as expected 

SPT–CA–09 Acquisition of address book entries containing

special characters. 

as expected 

SPT–CA–10 Acquisition of address book entries containing a

blank name entry. 

as expected 

SPT–CA–11 Acquisition of embedded email addresses within

address book entries. 

as expected 

SPT–CA–12 Acquisition of embedded graphics within address

book entries. 

Not as 

expected

SPT–CA–13 Acquisition of PIM data (i.e.,

datebook/calendar, notes). 

as expected 

SPT–CA–14 Acquisition of maximum length PIM data. as expected 

November 2010 183 of 196 Results of Device Seizure 4.0 
Test Case SPT–06 Device Seizure 4.0 

Analysis: Partial results achieved 

November 2010 184 of 196 Results of Device Seizure 4.0 
 

5.2.130 SPT–07 (Palm pixi) 

Test Case SPT–07 Device Seizure 4.0 

Case 

Summary: 

SPT–07 Acquire mobile device internal memory and review reported call logs. 

Assertions: SPT–CA–15 If a cellular forensic tool completes acquisition of the target

device without error then call logs (incoming/outgoing/missed) shall be

presented in a useable format.

SPT–CA–16 If a cellular forensic tool completes acquisition of the target

device without error then the corresponding date/time stamps and the

duration of the call for call logs shall be presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu Jul 29 13:12:44 EDT 2010 

Device: Palm_pixi

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Thu Jul 29 13:12:44 EDT 2010

Acquisition finished: Thu Jul 29 13:15:16 EDT 2010 

All Call Logs (incoming, outgoing, missed) were acquired

All Call Log date/time stamps data were correctly reported 

Notes: 

The duration of the call is not specified if it is seconds, minutes, or

hours. 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–15 Acquisition of call logs. Partial 

SPT–CA–16 Acquisition of call log date/time stamps. Partial 

Analysis: Partial results achieved 

November 2010 185 of 196 Results of Device Seizure 4.0 
 

5.2.131 SPT–08 (Palm pixi) 

Test Case SPT–08 Device Seizure 4.0 

Case 

Summary: 

SPT–08 Acquire mobile device internal memory and review reported text

messages.

Assertions: SPT–CA–17 If a cellular forensic tool completes acquisition of the target

device without error then ASCII text messages (i.e., SMS, EMS) shall be

presented in a useable format.

SPT–CA–18 If a cellular forensic tool completes acquisition of the target

device without error then the corresponding date/time stamps for text

messages shall be presented in a useable format.

SPT–CA–19 If a cellular forensic tool completes acquisition of the target

device without error then the corresponding status (i.e., read, unread) for

text messages shall be presented in a useable format.

SPT–CA–20 If a cellular forensic tool completes acquisition of the target

device without error then the corresponding sender / recipient phone

numbers for text messages shall be presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu Jul 29 13:15:58 EDT 2010 

Device: Palm_pixi

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Thu Jul 29 13:15:58 EDT 2010

Acquisition finished: Thu Jul 29 13:21:58 EDT 2010 

ALL text messages (SMS, EMS) were acquired

Correct date/time stamps were reported for all text messages

Correct status flags were reported for all text messages

Sender and Recipient phone numbers associated with text messages were

correctly reported 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–CA–17 Acquisition of text messages. as expected

SPT–CA–18 Acquisition of text message date/time stamps. as expected

SPT–CA–19 Acquisition of text message status flags. as expected

SPT–CA–20 Acquisition of sender/recipient phone number

associated with text messages. 

as expected 

Analysis: Expected results achieved 

November 2010 186 of 196 Results of Device Seizure 4.0 
 

5.2.132 SPT–09 (Palm pixi) 

Test Case SPT–09 Device Seizure 4.0 

Case 

Summary: 

SPT–09 Acquire mobile device internal memory and review reported MMS multi–

media related data (i.e., text, audio, graphics, video).

Assertions: SPT–CA–21 If a cellular forensic tool completes acquisition of the target

device without error then MMS messages and associated audio shall be

presented in a useable format.

SPT–CA–22 If a cellular forensic tool completes acquisition of the target

device without error then MMS messages and associated graphic files shall

be presented in a useable format.

SPT–CA–23 If a cellular forensic tool completes acquisition of the target

device without error then MMS messages and associated video shall be

presented in a useable format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu Jul 29 13:23:35 EDT 2010 

Device: Palm_pixi

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Thu Jul 29 13:23:35 EDT 2010

Acquisition finished: Thu Jul 29 13:27:03 EDT 2010 

Audio MMS messages were not acquired

Image MMS messages were not acquired

Video MMS messages were not acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–21 Acquisition of audio MMS messages. Not as 

expected

SPT–CA–22 Acquisition of graphic data image MMS

messages. 

Not as 

expected

SPT–CA–23 Acquisition of video MMS messages. Not as 

expected 

Analysis: Expected results Not achieved 

November 2010 187 of 196 Results of Device Seizure 4.0 
 

5.2.133 SPT–10 (Palm pixi) 

Test Case SPT–10 Device Seizure 4.0 

Case 

Summary: 

SPT–10 Acquire mobile device internal memory and review reported stand–

alone multi–media data (i.e., audio, graphics, video).

Assertions: SPT–CA–24 If a cellular forensic tool completes acquisition of the target

device without error then stand–alone audio files shall be presented in a

useable format via either an internal application or suggested third–party

application.

SPT–CA–25 If a cellular forensic tool completes acquisition of the target

device without error then stand–alone graphic files shall be presented in a

useable format via either an internal application or suggested third–party

application.

SPT–CA–26 If a cellular forensic tool completes acquisition of the target

device without error then stand–alone video files shall be presented in a

useable format via either an internal application or suggested third–party

application. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Thu Jul 29 13:29:18 EDT 2010 

Device: Palm_pixi

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Thu Jul 29 13:29:18 EDT 2010

Acquisition finished: Thu Jul 29 13:32:32 EDT 2010 

ALL stand–alone data files (Audio, Image, Video) were acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–24 Acquisition of stand–alone audio files. as expected

SPT–CA–25 Acquisition of stand–alone graphic files. as expected

SPT–CA–26 Acquisition of stand–alone video files. as expected 

Analysis: Expected results achieved 

November 2010 188 of 196 Results of Device Seizure 4.0 
 

5.2.134 SPT–11 (Palm pixi) 

Test Case SPT–11 Device Seizure 4.0 

Case 

Summary: 

SPT–11 Acquire mobile device internal memory and review application related

data (i.e., word documents, spreadsheet, presentation documents).

Assertions: SPT–CA–27 If a cellular forensic tool completes acquisition of the target

device without error then device specific application related data shall be

acquired and presented in a useable format via either an internal

application or suggested third–party application. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Thu Jul 29 13:32:53 EDT 2010 

Device: Palm_pixi

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Thu Jul 29 13:32:53 EDT 2010

Acquisition finished: Thu Jul 29 13:34:43 EDT 2010 

Application data was not acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–27 Acquisition of application related data. Not as expected 

Analysis: Expected results Not achieved 

November 2010 189 of 196 Results of Device Seizure 4.0 
 

5.2.135 SPT–12 (Palm pixi) 

Test Case SPT–12 Device Seizure 4.0 

Case 

Summary: 

SPT–12 Acquire mobile device internal memory and review Internet related

data (i.e., bookmarks, visited sites.

Assertions: SPT–CA–28 If a cellular forensic tool completes acquisition of the target

device without error then Internet related data (i.e., bookmarks, visited

sites) cached to the device shall be acquired and presented in a useable

format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu Jul 29 13:34:59 EDT 2010 

Device: Palm_pixi

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Thu Jul 29 13:34:59 EDT 2010

Acquisition finished: Thu Jul 29 13:37:05 EDT 2010 

All Internet related data was acquired 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–28 Acquisition of Internet related data. as expected 

Analysis: Expected results achieved 

November 2010 190 of 196 Results of Device Seizure 4.0 
5.2.136 SPT–13 (Palm pixi) 

Test Case SPT–13 Device Seizure 4.0 

Case 

Summary: 

SPT–13 Acquire mobile device internal memory by selecting a combination of

supported data elements.

Assertions: SPT–CA–30 If a cellular forensic tool provides the user with an “Select

All” individual device data objects then the tool shall complete the

acquisition of all individually selected data objects without error. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu Jul 29 13:37:21 EDT 2010 

Device: Palm_pixi

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Thu Jul 29 13:37:21 EDT 2010

Acquisition finished: Thu Jul 29 13:39:20 EDT 2010 

Select All acquisition was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–CA–30 Select–All data objects acquisition. as expected 

Analysis: Expected results achieved 

November 2010 191 of 196 Results of Device Seizure 4.0 
 

5.2.137 SPT–24 (Palm pixi) 

Test Case SPT–24 Device Seizure 4.0 

Case 

Summary: 

SPT–24 Acquire mobile device internal memory and review reported data via

supported generated report formats.

Assertions: SPT–AO–25 If a cellular forensic tool completes acquisition of the target

device without error then the tool shall present the acquired data in a

useable format via supported generated report formats. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu Jul 29 13:39:59 EDT 2010 

Device: Palm_pixi

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Thu Jul 29 13:39:59 EDT 2010

Acquisition finished: Thu Jul 29 13:57:07 EDT 2010 

Complete representation of known data via generated reports was successful 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–25 Comparison of known device data elements via

generated reports. 

as expected 

Analysis: Expected results achieved 

November 2010 192 of 196 Results of Device Seizure 4.0 
 

5.2.138 SPT–25 (Palm pixi) 

Test Case SPT–25 Device Seizure 4.0 

Case 

Summary: 

SPT–25 Acquire mobile device internal memory and review reported data via

the preview pane.

Assertions: SPT–AO–26 If a cellular forensic tool completes acquisition of the target

device without error then the tool shall present the acquired data in a

useable format in a preview–pane view. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu Jul 29 13:57:42 EDT 2010 

Device: Palm_pixi

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Thu Jul 29 13:57:42 EDT 2010

Acquisition finished: Thu Jul 29 13:58:41 EDT 2010 

Complete representation of known data via preview–pane was successful 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–26 Comparison of known device data elements via

preview–pane. 

as expected 

Analysis: Expected results achieved 

November 2010 193 of 196 Results of Device Seizure 4.0 
 

5.2.139 SPT–29 (Palm pixi) 

Test Case SPT–29 Device Seizure 4.0 

Case 

Summary: 

SPT–29 After a successful mobile device internal memory, alter the case

file via third–party means and attempt to re–open the case.

Assertions: SPT–AO–27 If the case file or individual data objects are modified via

third–party means then the tool shall provide protection mechanisms

disallowing or reporting data modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu Jul 29 13:59:11 EDT 2010 

Device: Palm_pixi

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Thu Jul 29 13:59:11 EDT 2010

Acquisition finished: Thu Jul 29 14:01:26 EDT 2010 

Notification of modified device memory data was successful 

Results: 

Assertion & Expected Result Actual Result 

SPT–AO–27 Notification of modified device case data. as expected 

Analysis: Expected results achieved 

November 2010 194 of 196 Results of Device Seizure 4.0 
 

5.2.140 SPT–33 (Palm pixi) 

Test Case SPT–33 Device Seizure 4.0 

Case 

Summary: 

SPT–33 Acquire mobile device internal memory and review data containing

non–ASCII characters. 

Assertions: SPT–AO–40 If the cellular forensic tool supports display of non–ASCII

characters then the application should present address book entries in

their native format. 

SPT–AO–41 If the cellular forensic tool supports proper display of non–

ASCII characters then the application should present text messages in their

native format. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu Jul 29 14:01:59 EDT 2010 

Device: Palm_pixi

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Thu Jul 29 14:01:59 EDT 2010

Acquisition finished: Thu Jul 29 14:05:28 EDT 2010 

Non–ASCII Address book entries were acquired and properly displayed

Non–ASCII text messages were acquired and properly displayed 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–40 Acquisition of non–ASCII address book

entries/ADNs. 

as expected 

SPT–AO–41 Acquisition of non–ASCII text messages. as expected 

Analysis: Expected results achieved 

November 2010 195 of 196 Results of Device Seizure 4.0 
 

5.2.141 SPT–38 (Palm pixi) 

Test Case SPT–38 Device Seizure 4.0 

Case 

Summary: 

SPT–38 Acquire mobile device internal memory and review hash values for

vendor supported data objects.

Assertions: SPT–AO–43 If the cellular forensic tool supports hashing for individual

data objects then the tool shall present the user with a hash value for

each supported data object. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu Jul 29 14:06:08 EDT 2010 

Device: Palm_pixi

Source 

Setup: 

OS: WIN XP 

Interface: cable 

Log

Highlights: 

Created by Device Seizure Version 4.0

Acquisition started: Thu Jul 29 14:06:08 EDT 2010

Acquisition finished: Tue Jul 29 14:09:04 EDT 2010 

Hash values were properly reported for individually acquired device data

elements 

Results: 

Assertion & Expected Result Actual 

Result 

SPT–AO–43 Acquire data, check known hash values for

consistency. 

as expected 

Analysis: Expected results achieved 

November 2010 196 of 196 Results of Device Seizure 4.0 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

  

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

About the National Institute of Justice 

A component of the Office of Justice Programs, NIJ is the research, development and evaluation agency of the U.S. Department of Justice. NIJ’s mission is to advance scientific research, 

development and evaluation to enhance the administration of justice and public safety. NIJ’s 

principal authorities are derived from the Omnibus Crime Control and Safe Streets Act of 1968, 

as amended (see 42 U.S.C. §§ 3721–3723). 

The NIJ Director is appointed by the President and confirmed by the Senate. The Director establishes the Institute’s objectives, guided by the priorities of the Office of Justice Programs, the 

U.S. Department of Justice, and the needs of the field. The Institute actively solicits the views of 

criminal justice and other professionals and researchers to inform its search for the knowledge 

and tools to guide policy and practice. 

Strategic Goals 

NIJ has seven strategic goals grouped into three categories: 

Creating relevant knowledge and tools 

1. Partner with state and local practitioners and policymakers to identify social science research 

and technology needs. 

2. Create scientific, relevant, and reliable knowledge—with a particular emphasis on terrorism, 

violent crime, drugs and crime, cost-effectiveness, and community-based efforts—to enhance 

the administration of justice and public safety. 

3. Develop affordable and effective tools and technologies to enhance the administration of 

justice and public safety. 

Dissemination 

4. Disseminate relevant knowledge and information to practitioners and policymakers in an 

understandable, timely and concise manner. 

5. Act as an honest broker to identify the information, tools and technologies that respond to 

the needs of stakeholders. 

Agency management 

6. Practice fairness and openness in the research and development process. 

7. Ensure professionalism, excellence, accountability, cost-effectiveness and integrity in the management and conduct of NIJ activities and programs. 

Program Areas 

In addressing these strategic challenges, the Institute is involved in the following program 

areas: crime control and prevention, including policing; drugs and crime; justice systems and 

offender behavior, including corrections; violence and victimization; communications and information technologies; critical incident response; investigative and forensic sciences, including 

DNA; less-than-lethal technologies; officer protection; education and training technologies; testing and standards; technology assistance to law enforcement and corrections agencies; field 

testing of promising programs; and international crime control. 

In addition to sponsoring research and development and technology assistance, NIJ evaluates 

programs, policies, and technologies. NIJ communicates its research and evaluation findings 

through conferences and print and electronic media. 

To find out more about the National 

Institute of Justice, please visit: 

http://www.ojp.usdoj.gov/nij

or contact: 

National Criminal Justice 

Reference Service 

P.O. Box 6000 

Rockville, MD 20849–6000 

800–851–3420 

http://www.ncjrs.gov