U.S. Department of Justice 

Office of Justice Programs 

National Institute of Justice 

Special REPORT

Test Results for Mobile Device Acquisition Tool: 

Guidance Software Neutrino 1.4.14 

OCT. 08 

Office of Justice Programs 

Innovation • Partnerships • Safer Neighborhoods 

www.ojp.usdoj.gov

www.ojp.usdoj.gov/nij 
U.S. Department of Justice 

Office of Justice Programs 

810 Seventh Street N.W. 

Washington, DC 20531 

Michael B. Mukasey 

Attorney General 

Jeffrey L. Sedgwick 

Assistant Attorney General 

David W. Hagy 

Director, National Institute of Justice 

This and other publications and products of the National Institute 

of Justice can be found at: 

National Institute of Justice 

www.ojp.usdoj.gov/nij 

Office of Justice Programs 

Innovation • Partnerships • Safer Neighborhoods 

www.ojp.usdoj.gov 
OCT. 08 

Test Results for Mobile Device Acquisition Tool: 

Guidance Software Neutrino 1.4.14 

NCJ 224150
David W. Hagy 

Director, National Institute of Justice 

This report was prepared for the National Institute of Justice, U.S. Department of Justice, by the 

Office of Law Enforcement Standards of the National Institute of Standards and Technology 

under Interagency Agreement 2003–IJ–R–029. 

The National Institute of Justice is a component of the Office of Justice Programs, which also 

includes the Bureau of Justice Assistance, the Bureau of Justice Statistics, the Office of 

Juvenile Justice and Delinquency Prevention, and the Office for Victims of Crime. 
August 2008 

Test Results for Mobile Device Acquisition Tool: 

Guidance Software Neutrino 1.4.14 
October 2008 ii Results of Neutrino V1.4.14 8/2008 
Contents 

1 Results Summary ...................................................................................................................... 2

2 Test Case Selection ................................................................................................................... 3

3 Results by Test Assertion.......................................................................................................... 5

3.1 EMS Messages................................................................................................................. 10

3.2 Abbreviated Dialing Numbers ......................................................................................... 10

3.3 Stand-alone Acquisition................................................................................................... 10

4 Testing Environment ............................................................................................................... 11

4.1 Test Computers ................................................................................................................ 11

5 Test Results............................................................................................................................. 12

5.1 Test Results Report Key .................................................................................................. 12

5.2 Test Details ...................................................................................................................... 13

5.2.1 CFT-IM-01 (Nokia 6101) ......................................................................................... 13

5.2.2 CFT-IM-02 (Nokia 6101) ......................................................................................... 15

5.2.3 CFT-IM-04 (Nokia 6101) ......................................................................................... 17

5.2.4 CFT-IM-05 (Nokia 6101) ......................................................................................... 19

5.2.5 CFT-IM-06 (Nokia 6101) ......................................................................................... 21

5.2.6 CFT-IM-07 (Nokia 6101) ......................................................................................... 23

5.2.7 CFT-IM-08 (Nokia 6101) ......................................................................................... 25

5.2.8 CFT-IM-10 (Nokia 6101) ......................................................................................... 27

5.2.9 CFT-IMO-01 (Nokia 6101) ...................................................................................... 29

5.2.10 CFT-IMO-02 (Nokia 6101) .................................................................................... 31

5.2.11 CFT-IMO-03 (Nokia 6101) .................................................................................... 33

5.2.12 CFT-IMO-04 (Nokia 6101) .................................................................................... 35

5.2.13 CFT-IMO-10 (Nokia 6101) .................................................................................... 37

5.2.14 CFT-IMO-11 (Nokia 6101) .................................................................................... 39

5.2.15 CFT-SIM-01 (T-Mobile SIM) ................................................................................ 41

5.2.16 CFT-SIM-02 (T-Mobile SIM) ................................................................................ 42

5.2.17 CFT-SIM-03 (T-Mobile SIM) ................................................................................ 43

5.2.18 CFT-SIM-04 (T-Mobile SIM) ................................................................................ 44

5.2.19 CFT-SIM-05 (T-Mobile SIM) ................................................................................ 45

5.2.20 CFT-SIM-06 (T-Mobile SIM) ................................................................................ 46

5.2.21 CFT-SIM-07 (T-Mobile SIM) ................................................................................ 48

5.2.22 CFT-SIM-08 (T-Mobile SIM) ................................................................................ 50

5.2.23 CFT-SIM-09 (T-Mobile SIM) ................................................................................ 51

5.2.24 CFT-SIMO-01 (T-Mobile SIM) ............................................................................. 53

5.2.25 CFT-SIMO-02 (T-Mobile SIM) ............................................................................. 54

5.2.26 CFT-SIMO-03 (T-Mobile SIM) ............................................................................. 55

5.2.27 CFT-SIMO-04 (T-Mobile SIM) ............................................................................. 56

5.2.28 CFT-SIMO-05 (T-Mobile SIM) ............................................................................. 57

5.2.29 CFT-SIMO-08 (T-Mobile SIM) ............................................................................. 59

5.2.30 CFT-SIMO-09 (T-Mobile SIM) ............................................................................. 60

5.2.31 CFT-SIMO-10 (T-Mobile SIM) ............................................................................. 61

5.2.32 CFT-IM-01 (Motorola RAZR V3).......................................................................... 62

October 2008 iii Results of Neutrino V1.4.14 8/2008 
5.2.33 CFT-IM-02 (Motorola RAZR V3).......................................................................... 64

5.2.34 CFT-IM-04 (Motorola RAZR V3).......................................................................... 66

5.2.35 CFT-IM-05 (Motorola RAZR V3).......................................................................... 68

5.2.36 CFT-IM-06 (Motorola RAZR V3).......................................................................... 70

5.2.37 CFT-IM-07 (Motorola RAZR V3).......................................................................... 72

5.2.38 CFT-IM-08 (Motorola RAZR V3).......................................................................... 74

5.2.39 CFT-IM-10 (Motorola RAZR V3).......................................................................... 76

5.2.40 CFT-IMO-01 (Motorola RAZR V3)....................................................................... 78

5.2.41 CFT-IMO-02 (Motorola RAZR V3)....................................................................... 80

5.2.42 CFT-IMO-03 (Motorola RAZR V3)....................................................................... 82

5.2.43 CFT-IMO-04 (Motorola RAZR V3)....................................................................... 84

5.2.44 CFT-IMO-10 (Motorola RAZR V3)....................................................................... 86

5.2.45 CFT-IMO-11 (Motorola RAZR V3)....................................................................... 88

5.2.46 CFT-SIM-01 (AT&T SIM)..................................................................................... 90

5.2.47 CFT-SIM-02 (AT&T SIM)..................................................................................... 91

5.2.48 CFT-SIM-03 (AT&T SIM)..................................................................................... 92

5.2.49 CFT-SIM-04 (AT&T SIM)..................................................................................... 93

5.2.50 CFT-SIM-05 (AT&T SIM)..................................................................................... 94

5.2.51 CFT-SIM-06 (AT&T SIM)..................................................................................... 95

5.2.52 CFT-SIM-07 (AT&T SIM)..................................................................................... 96

5.2.53 CFT-SIM-08 (AT&T SIM)..................................................................................... 98

5.2.54 CFT-SIM-09 (AT&T SIM)..................................................................................... 99

5.2.55 CFT-SIMO-01 (AT&T SIM)................................................................................ 101

5.2.56 CFT-SIMO-02 (AT&T SIM)................................................................................ 102

5.2.57 CFT-SIMO-03 (AT&T SIM)................................................................................ 103

5.2.58 CFT-SIMO-04 (AT&T SIM)................................................................................ 104

5.2.59 CFT-SIMO-05 (AT&T SIM)................................................................................ 105

5.2.60 CFT-SIMO-08 (AT&T SIM)................................................................................ 107

5.2.61 CFT-SIMO-09 (AT&T SIM)................................................................................ 108

5.2.62 CFT-SIMO-10 (AT&T SIM)................................................................................ 109

October 2008 iv Results of Neutrino V1.4.14 8/2008 
October 2008 v Results of Neutrino V1.4.14 8/2008 
Introduction 

The Computer Forensics Tool Testing (CFTT) program is a joint project of the National 

Institute of Justice (NIJ), the research and development organization of the U.S. 

Department of Justice (DOJ), and the National Institute of Standards and Technology’s 

(NIST’s) Office of Law Enforcement Standards and Information Technology Laboratory. 

CFTT is supported by other organizations, including the Federal Bureau of Investigation, 

the U.S. Department of Defense Cyber Crime Center, U.S. Internal Revenue Service 

Criminal Investigation Division Electronic Crimes Program, and the U.S. Department of 

Homeland Security’s Bureau of Immigration and Customs Enforcement, U.S. Customs 

and Border Protection, and U.S. Secret Service. The objective of the CFTT program is to 

provide measurable assurance to practitioners, researchers, and other applicable users that 

the tools used in computer forensics investigations provide accurate results. 

Accomplishing this requires the development of specifications and test methods for 

computer forensics tools and subsequent testing of specific tools against those 

specifications. 

Test results provide the information necessary for developers to improve tools, users to 

make informed choices, and the legal community and others to understand the tools’ 

capabilities. This approach to testing computer forensic tools is based on well-recognized 

methodologies for conformance and quality testing. The specifications and test methods 

are posted on the CFTT Web site (http://www.cftt.nist.gov/) for review and comment by 

the computer forensics community. 

This document reports the results from testing Guidance Software Neutrino, version 

1.4.14, against the GSM Mobile Device and Associated Media Tool Specification and 

Test Plan Version 1.1, available at the CFTT Web site (http://www.cftt.nist.gov/GSMMobile-Device-and-Associated-Media-Tool-Specification-and-Test-Plan.pdf). Collected 

data packets (sent and received data transmissions) for mobile device internal memory 

acquisitions and SIM internal memory acquisitions, captured via a port monitoring utility, 

are posted at www.cftt.nist.gov/mobile_devices.htm. 

Test results from other software packages and the CFTT tool methodology can be found 

on NIJ’s computer forensics tool testing Web 

page, http://www.ojp.usdoj.gov/nij/topics/technology/electronic-crime/cftt.htm.
 

 

 

 

Test Results for Mobile Device Data Acquisition Tool 

Tool Tested: Guidance Software Neutrino 

Version: 1.4.14 

Run Environments: Windows XP Service Pack 2 

Supplier: Guidance Software 

Address: 215 North Marengo Ave., Suite 250 

Pasadena, CA 91101 

Tel: 626–229–9191 

Fax: 626–229–9199 

WWW: http://www.guidancesoftware.com 

1 Results Summary 

Except for the following test cases (CFT–IM–08, CFT–SIM–07, CFT–IMO–10), the 

tested tool acquired all supported data objects completely and accurately from the 

selected test mobile devices and associated media (i.e., Nokia 6101, T-Mobile SIM, 

Motorola RAZR V3, AT&T SIM). The exceptions are the following: 

1. EMS messages (text messages over 160 characters were not acquired for the 

Motorola RAZR V3). (CFT–IM–08) 

2. Maximum length ADNs and ADNs that contain special characters for the name 

(i.e., ‘@’) were not reported. (CFT–SIM–07) 

3. Stand-alone internal memory acquisitions alter the status flags of ‘unread’ text 

messages present on the SIM to ‘read’. (CFT–IMO–10) 

October 2008 2 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

2 Test Case Selection 

Not all test cases or test assertions are appropriate for all tools. In addition to the base test cases, each 

remaining test case is linked to optional tool features needed for the test case. If a given tool 

implements a given feature then the test cases linked to that feature are run. Table 1 lists the features 

available in Guidance Software’s Neutrino V1.4.14 and the linked test cases. 

Table 2 lists the features not available in Guidance Software’s Neutrino v1.4.14 and the 

linked test cases. 

Table 1 Selected Test Cases 

Supported Optional Feature Cases selected for execution 

Base Cases CFT–IM–(01–02,04–08,10), CFT– 

SIM–(01–07, 08, 09) 

Acquire mobile device internal memory and 

review data via supported generated report 

formats 

CFT–IMO–01 

Acquire mobile device internal memory and 

review reported data via the preview pane 

CFT–IMO–02 

Acquire mobile device internal memory and 

compare reported data via the preview pane 

and supported generated report formats 

CFT–IMO–03 

After a successful mobile device internal 

memory acquisition, alter the case file via third 

party means and attempt to reopen the case 

CFT–IMO–04 

Perform a stand-alone mobile device internal 

memory acquisition and review the status flags 

for text messages present on the SIM 

CFT–IMO–10 

Acquire mobile device internal memory and 

review hash values for vendor supported data 

objects 

CFT–IMO–11 

Acquire SIM internal memory and review 

acquired data via supported generated report 

formats 

CFT–SIMO–01 

Acquire SIM internal memory and review 

acquired data via the preview pane 

CFT–SIMO–02 

Acquire SIM internal memory and compare 

acquired data via the preview pane and 

supported generated reports 

CFT–SIMO–03 

After a successful SIM internal memory 

acquisition, alter the case file via third party 

means and attempt to reopen the case 

CFT–SIMO–04 

Acquire SIM internal memory and review 

reports for recoverable deleted data 

CFT–SIMO–05 

October 2008 3 of 110 Results of Neutrino V1.4.14 8/2008 
Begin acquisition on a PIN protected SIM to 

determine if the tool provides an accurate 

count of the remaining number of PIN 

attempts and if the PIN attempts are 

decremented when entering an incorrect value 

CFT–SIMO–08 

Begin acquisition on a SIM whose PIN 

attempts have been exhausted to determine if 

the tool provides an accurate count of the 

remaining number of PUK attempts and if the 

PUK attempts are decremented when entering 

an incorrect value 

CFT–SIMO–09 

Acquire SIM internal memory and review hash 

values for vendor supported data objects 

CFT–SIMO–10 

Table 2 Omitted Test Cases 

Unsupported Optional Feature Cases omitted (not executed) 

Begin mobile device internal memory 

acquisition and interrupt connectivity by 

interface disengagement 

CFT–IM–03 

Acquire mobile device internal memory and 

review reported MMS multimedia related data 

(i.e., text, audio, graphics, video) 

CFT–IM–09 

Acquire SIM internal memory and review 

reported location related data (i.e., LOCI, 

GPRSLOCI) 

CFT–SIM–10 

Perform a physical acquisition and review data 

output for readability 

CFT–IMO–05 

Perform a physical acquisition and review 

reports for recoverable deleted data 

CFT–IMO–06 

Create a SIM access card via vendor 

documentation 

CFT–IMO–07 

Acquire mobile device internal memory and 

review generated log files 

CFT–IMO–08 

Acquire mobile device internal memory and 

review data containing foreign language 

characters 

CFT–IMO–09 

Acquire mobile device internal memory and 

review the overall case file hash 

CFT–IMO–12 

Acquire SIM internal memory and review 

generated log files 

CFT–SIMO–06 

Acquire SIM internal memory and review data 

containing foreign language characters 

CFT–SIMO–07 

Acquire SIM internal memory and review the 

overall case file hash. 

CFT–SIMO–11 

October 2008 4 of 110 Results of Neutrino V1.4.14 8/2008 
 

3 Results by Test Assertion 

Table 4 summarizes the test results by assertion. The column labeled Assertion gives the 

text of each assertion. The column labeled Tests gives the number of test cases that use 

the given assertion. The column labeled Anomaly gives the section number in this report 

where the anomaly is discussed. 

Table 3 Assertions Tested 

Assertions Tested Tests Anomaly 

A_IM–01 If a cellular forensic tool provides support for connectivity of 

the target device then the tool shall successfully recognize the target 

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA). 

9 

A_IM–02 If a cellular forensic tool attempts to connect to a nonsupported device then the tool shall have the ability to identify that the 

device is not supported. 

1 

A_IM–04 If a cellular forensic tool successfully completes acquisition 

of the target device then the tool shall have the ability to present 

acquired data elements in a human-readable format via either a preview 

pane or generated report. 

7 

A_IM–06 If a cellular forensic tool successfully completes acquisition 

of the target device then equipment related information shall be 

presented in a human-readable format without modification. 

1 

A_IM–07 If a cellular forensic tool successfully completes acquisition 

of the target device then all known address book entries shall be 

presented in a human-readable format without modification. 

1 

A_IM–08 If a cellular forensic tool successfully completes acquisition 

of the target device then all known maximum length address book 

entries shall be presented in a human-readable format without 

modification. 

1 

A_IM–09 If a cellular forensic tool successfully completes acquisition 

of the target device then all known address book entries containing 

special characters shall be presented in a human-readable format 

without modification. 

1 

A_IM–10 If a cellular forensic tool successfully completes acquisition 

of the target device then all known address book entries containing 

blank names shall be presented in a human-readable format without 

modification. 

1 

A_IM–11 If a cellular forensic tool successfully completes acquisition 

of the target device then all known email addresses associated with 

address book entries shall be presented in a human-readable format 

without modification. 

1 

A_IM–12 If a cellular forensic tool successfully completes acquisition 

of the target device then all known graphics associated with address 

book entries shall be presented in a human-readable format without 

modification. 

1 

A_IM–13 If a cellular forensic tool successfully completes acquisition 1 

October 2008 5 of 110 Results of Neutrino V1.4.14 8/2008 
of the target device then all known datebook, calendar, note entries shall 

be presented in a human-readable format without modification. 

A_IM–14 If a cellular forensic tool successfully completes acquisition 

of the target device then all maximum length datebook, calendar, note 

entries shall be presented in a human readable format without 

modification. 

1 

A_IM–15 If a cellular forensic tool successfully completes acquisition 

of the target device then all call logs (incoming/outgoing) shall be 

presented in a human-readable format without modification. 

1 

A_IM–16 If a cellular forensic tool successfully completes acquisition 

of the target device then all text messages (i.e., SMS, EMS) messages 

shall be presented in a human-readable format without modification. 

1 3.1 

A_IM–20 If a cellular forensic tool successfully completes acquisition 

of the target device then all stand-alone audio files shall be playable via 

either an internal application or suggested third-party application 

without modification. 

1 

A_IM–21 If a cellular forensic tool successfully completes acquisition 

of the target device then all stand-alone image files shall be viewable via 

either an internal application or suggested third-party application 

without modification. 

1 

A_IM–22 If a cellular forensic tool successfully completes acquisition 

of the target device then all stand-alone video files shall be viewable via 

either an internal application or suggested third-party application 

without modification. 

1 

A_SIM–23 If a cellular forensic tool provides support for connectivity 

of the target SIM then the tool shall successfully recognize the target 

SIM via all vendor supported interfaces (e.g., PC/SC reader, proprietary 

reader). 

9 

A_SIM–24 If a cellular forensic tool attempts to connect to a nonsupported SIM then the tool shall have the ability to identify that the 

SIM is not supported. 

1 

A_SIM–25 If a cellular forensic tool encounters disengagement 

between the SIM reader and application then the application shall notify 

the user that connectivity has been disrupted. 

1 

A_SIM–26 If the SIM is password protected then the cellular forensic 

tool shall provide the examiner with the opportunity to input the PIN 

before acquisition. 

1 

A_SIM–27 If a cellular forensic tool successfully completes acquisition 

of the target SIM then the tool shall have the ability to present acquired 

data in a human-readable format via either preview pane or generated 

report. 

6 

A_SIM–29 If a cellular forensic tool successfully completes acquisition 

of the target SIM then the ICCID shall be presented in a human-readable 

format without modification. 

1 

A_SIM–30 If a cellular forensic tool successfully completes acquisition 

of the target SIM then the IMSI shall be presented in a human-readable 

1 

October 2008 6 of 110 Results of Neutrino V1.4.14 8/2008 
 

format without modification. 

A_SIM–32 If a cellular forensic tool successfully completes acquisition 

of the target SIM then all Abbreviated Dialing Numbers (ADN) shall be 

presented in a human-readable format without modification. 

1 3.2 

A_SIM–33 If a cellular forensic tool successfully completes acquisition 

of the target SIM then all Last Numbers Dialed (LND) shall be 

presented in a human-readable format without modification. 

1 

A_SIM–34 If a cellular forensic tool successfully completes acquisition 

of the target SIM then all SMS text messages shall be presented in a 

human-readable format without modification. 

1 

A_SIM–35 If a cellular forensic tool successfully completes acquisition 

of the target SIM then all EMS text messages shall be presented in a 

human-readable format without modification. 

1 

A_IMO–38 If a cellular forensic tool successfully completes acquisition 

of the target device then the tool shall present the acquired data without 

modification via supported generated report formats. 

8 

A_IMO–39 If a cellular forensic tool successfully completes acquisition 

of the target device then the tool shall present the acquired data without 

modification in a preview-pane view. 

8 

A_IMO–40 If a cellular forensic tool provides a preview-pane view and 

a generated report of the acquired data then the reports shall maintain 

consistency of all reported data elements. 

1 

A_IMO–41 If modification is attempted to the case file or individual 

data elements via third-party means then the tool shall provide 

protection mechanisms disallowing or reporting data modification. 

1 

A_IMO–55 If the cellular forensic tool supports stand-alone acquisition 

of internal memory with the SIM present, then the contents of the SIM 

shall not be modified during internal memory acquisition. 

1 3.3 

A_IMO–56 If the cellular forensic tool supports hashing for individual 

data objects then the tool shall present the user with a hash value for 

each supported data object. 

A_SIMO–58 If a cellular forensic tool successfully completes 

acquisition of the target media (i.e., SIM) then the tool shall present the 

acquired data in a human-readable format without modification via 

supported generated report formats. 

6 

A_SIMO–59 If a cellular forensic tool successfully completes 

acquisition of the SIM then the tool shall present the acquired data in a 

human-readable format without modification in a preview-pane view. 

6 

A_SIMO–60 If a cellular forensic tool provides a preview-pane view 

and a generated report of the acquired data then the reports shall 

maintain consistency of all reported data elements. 

1 

A_SIMO–61 If modification is attempted to the case file or individual 

data elements via third-party means then the tool shall provide 

protection mechanisms disallowing or reporting data modification. 

1 

A_SIMO–62 If the cellular forensic tool successfully completes 

acquisition of the target SIM and recoverable deleted SMS messages 

1 

October 2008 7 of 110 Results of Neutrino V1.4.14 8/2008 
exist then the tool shall present recoverable deleted data in a humanreadable format without modification. 

A_SIMO–63 If the cellular forensic tool successfully completes 

acquisition of the target SIM and recoverable deleted EMS messages 

exist then the tool shall present recoverable deleted data in a humanreadable format without modification. 

1 

A_SIMO–67 If a cellular forensic tool provides the examiner with the 

remaining number of authentication attempts then the application should 

provide an accurate count of the remaining PIN attempts. 

1 

A_SIMO–68 If a cellular forensic tool provides the examiner with the 

remaining number of PUK attempts then the application should provide 

an accurate count of the remaining PUK attempts. 

1 

A_SIMO–69 If the cellular forensic tool supports hashing for individual 

data objects then the tool shall present the user with a hash value for 

each supported data object 

1 

Table 5 lists the assertions that were not tested, usually due to the tool not supporting an 

optional feature. 

Table 4 Assertions Not Tested 

Assertions not Tested 

A_IM–03 If a cellular forensic tool encounters disengagement between the device and 

application then the application shall notify the user that connectivity has been disrupted. 

A_IM–05 If a cellular forensic tool successfully completes acquisition of the target 

device then subscriber related information shall be presented in a human-readable format 

without modification. 

A_IM–17 If a cellular forensic tool successfully completes acquisition of the target 

device then all MMS messages and associated audio shall be presented properly without 

modification. 

A_IM–18 If a cellular forensic tool successfully completes acquisition of the target 

device then all MMS messages and associated images shall be presented properly without 

modification. 

A_IM–19 If a cellular forensic tool successfully completes acquisition of the target 

device then all MMS messages and associated video shall be presented properly without 

modification. 

A_SIM–28 If a cellular forensic tool successfully completes acquisition of the target SIM 

then the SPN shall be presented in a human-readable format without modification. 

A_SIM–31 If a cellular forensic tool successfully completes acquisition of the target SIM 

then the MSISDN shall be presented in a human-readable format without modification. 

A_SIM–36 If a cellular forensic tool successfully completes acquisition of the target SIM 

then all location related data (i.e., LOCI) shall be presented in a human-readable format 

without modification. 

A_SIM–37 If a cellular forensic tool successfully completes acquisition of the target SIM 

then all location related data (i.e., GRPSLOCI) shall be presented in a human-readable 

October 2008 8 of 110 Results of Neutrino V1.4.14 8/2008 
format without modification. 

A_IMO–42 If the cellular forensic tool supports a physical acquisition of the target 

device then the tool shall successfully complete the acquisition and present the data in a 

human-readable format. 

A_IMO–43 If the cellular forensic tool supports a physical acquisition of address book 

entries present on the target device then the tool shall report recoverable deleted data or 

address book data remnants in a human-readable format. 

A_IMO–44 If the cellular forensic tool supports a physical acquisition of calendar, tasks, 

or notes present on the target device then the tool shall report recoverable deleted 

calendar, tasks, or note data remnants in a human-readable format. 

A_IMO–45 If the cellular forensic tool supports a physical acquisition of call logs 

present on the target device then the tool shall report recoverable deleted call or call log 

data remnants in a human-readable format. 

A_IMO–46 If the cellular forensic tool supports a physical acquisition of SMS messages 

present on the target device then the tool shall report recoverable deleted SMS messages 

or SMS message data remnants in a human-readable format. 

A_IMO–47 If the cellular forensic tool supports a physical acquisition of EMS messages 

present on the target device then the tool shall report recoverable deleted EMS messages 

or EMS message data remnants in a human-readable format. 

A_IMO–48 If the cellular forensic tool supports a physical acquisition of audio files 

present on the target device then the tool shall report recoverable deleted audio data or 

audio file data remnants in a human-readable format. 

A_IMO–49 If the cellular forensic tool supports a physical acquisition of graphic files 

present on the target device then the tool shall report recoverable deleted graphic file data 

or graphic file data remnants in a human-readable format. 

A_IMO–50 If the cellular forensic tool supports a physical acquisition of video files 

present on the target device then the tool shall report recoverable deleted video file data 

or video file data remnants in a human-readable format. 

A_IMO–51 If the cellular forensic tool supports SIM access card creation then the card 

creation shall be completed without errors via manufacturer suggested protocols. 

A_IMO–52 If the cellular forensic tool supports log creation then the application should 

present the log files outlining the acquisition process in a human-readable format. 

A_IMO–53 If the cellular forensic tool supports proper display of foreign language 

character sets then the application should present address book entries containing foreign 

language characters in their native format without modification. 

A_IMO–54 If the cellular forensic tool supports proper display of foreign language 

character sets then the application should present text messages containing foreign 

language characters in their native format without modification. 

A_IMO–57 If the cellular forensic tool supports hashing the overall case file then the 

tool shall present the user with one hash value representing the entire case data. 

A_SIMO–64 If a cellular forensic tool supports the creation of log files then the 

application should present the log files in a human-readable format outlining the 

acquisition process. 

A_SIMO–65 If the cellular forensic tool supports proper display of foreign language 

character sets then the application should present abbreviated dialing numbers (ADNs) 

containing foreign language characters in their native format without modification. 

October 2008 9 of 110 Results of Neutrino V1.4.14 8/2008 
A_SIMO–66 If the cellular forensic tool supports proper display of foreign language 

character sets then the application should present text messages containing foreign 

language characters in their native format without modification. 

A_SIMO–70 If the cellular forensic tool supports hashing for the overall case file then 

the tool shall present the user with one hash value representative of the entire case data. 

3.1 EMS Messages 

EMS messages (i.e., messages over 160 characters) present on the internal memory of the 

Motorola RAZR V3 were not acquired or reported in either the GUI or generated report. 

3.2 Abbreviated Dialing Numbers 

Maximum Length ADNs (16 characters) or ADNs containing special characters (i.e., 

‘@’) present on both the T-Mobile and AT&T SIM were not acquired or reported in 

either the GUI or generated report. 

3.3 Stand-alone Acquisition 

When selecting “Acquire Logical Data” for the internal memory of the mobile device, 

text messages present on the SIM whose status is Unread is modified to Read after 

completing the logical data acquisition for the internal memory of the device. Note: 

“Acquire SIM Image” is not selected. 

October 2008 10 of 110 Results of Neutrino V1.4.14 8/2008 
4 Testing Environment 

The tests were run in the NIST CFTT lab. This section describes the test computers 

available for testing. 

4.1 Test Computers 

One test computers was used. 

Morrisy has the following configuration: 

Intel® D975XBX2 Motherboard 

BIOS Version BX97520J.86A.2674.2007.0315.1546 

Intel® CoreTM2 Duo CPU 6700 @ 2.66Ghz 

3.25 GB RAM 

1.44 MB floppy drive 

LITE-ON CD H LH52N1P 

LITE-ON DVDRW LH–20A1P 

2 slots for removable SATA hard disk drive 

8 USB 2.0 slots 

2 IEEE 1394 ports 

3 IEEE 1394 ports (mini) 

October 2008 11 of 110 Results of Neutrino V1.4.14 8/2008 
5 Test Results 

The main item of interest for interpreting the test results is determining the conformance 

of the device with the test assertions. Conformance with each assertion tested by a given 

test case is evaluated by examining Log File Highlights box of the test report summary. 

5.1 Test Results Report Key 

A summary of the actual test results is presented in this report. The following table 

presents a description of each section of the test report summary. 

Table 5 Test Results Report Key 

Heading Description 

First Line: Test case ID, name, and version of tool tested. 

Case Summary: Test case summary from GSM Mobile Device and 

Associated Media Tool Specification and Test Plan Version 

1.1. 

Assertions: The test assertions applicable to the test case, selected from 

GSM Mobile Device and Associated Media Tool 

Specification and Test Plan Version 1.1. 

Tester Name: Name or initials of person executing test procedure. 

Test Host: Host computer executing the test. 

Test Date: Time and date that test was started. 

Device: Source mobile device, media (i.e., SIM). 

Source Setup: Outline of data object types populated on the device or 

associated media (i.e., SIM). 

Log Highlights: Information extracted from various log files to illustrate 

conformance or nonconformance to the test assertions. 

Results Expected and actual results for each assertion tested. 

Analysis Whether or not the expected results were achieved. 

October 2008 12 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

 

 

5.2 Test Details 

5.2.1 CFT-IM-01 (Nokia 6101) 

Test Case CFT-IM-01 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-IM-01 Acquire mobile device internal memory over supported interfaces

(e.g., cable, Bluetooth, IrDA).

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA). 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu Apr 24 14:06:24 EDT 2008

Device: Nokia_6101 

Source 

Setup: 

OS: WIN XP 

Interface: RJ45 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

October 2008 13 of 110 Results of Neutrino V1.4.14 8/2008 
 

Test Case CFT-IM-01 Guidance Software Neutrino Version 1.4.14 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Thu Apr 24 14:06:24 EDT 2008

Acquisition finished: Thu Apr 24 14:16:04 EDT 2008 

Device connectivity was established via supported interface 

Results: 

Assertion & Expected Result Actual Result 

A_IM-01 Device connectivity via supported interfaces. as expected 

Analysis: Expected results achieved 

October 2008 14 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

 

 

5.2.2 CFT-IM-02 (Nokia 6101) 

Test Case CFT-IM-02 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-IM-02 Attempt internal memory acquisition of a non-supported mobile

device. 

Assertions: A_IM-02 If a cellular forensic tool attempts to connect to a non-supported

device then the tool shall have the ability to identify that the device is

not supported. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu Apr 24 14:18:53 EDT 2008

Device: non-supported mobile device

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log Created By Neutrino Version 1.4.14 

October 2008 15 of 110 Results of Neutrino V1.4.14 8/2008 
 

Test Case CFT-IM-02 Guidance Software Neutrino Version 1.4.14 

Highlights: Acquisition started: Thu Apr 24 14:18:53 EDT 2008

Acquisition finished: Thu Apr 24 14:20:17 EDT 2008 

Identification of non-supported devices was successful 

Results: 

Assertion & Expected Result Actual Result 

A_IM-02 Identification of non-supported devices. as expected 

Analysis: Expected results achieved 

October 2008 16 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

 

5.2.3 CFT-IM-04 (Nokia 6101) 

Test Case CFT-IM-04 Guidance Software Neutrino Version 1.4.14 

Case CFT-IM-04 Acquire mobile device internal memory and review reported data

Summary: via the preview-pane or generated reports for readability.

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-04 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall have the ability to present acquired

data elements in a human-readable format via either a preview-pane or

generated report. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Thu Apr 24 14:32:41 EDT 2008

Device: Nokia_6101 

Source OS: WIN XP 

Setup: Interface: RJ45 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

October 2008 17 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

Test Case CFT-IM-04 Guidance Software Neutrino Version 1.4.14 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Thu Apr 24 14:32:41 EDT 2008

Acquisition finished: Thu Apr 24 14:39:42 EDT 2008 

Device connectivity was established via supported interface

Readability and completeness of acquired data was successful 

Results: 

Assertion & Expected Result 

A_IM-01 Device connectivity via supported interfaces.

A_IM-04 Readability and completeness of acquired data via

supported reports. 

Actual 

Result 

as expected

as expected 

Analysis: Expected results achieved 

October 2008 18 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.4 CFT-IM-05 (Nokia 6101) 

Test Case CFT-IM-05 Guidance Software Neutrino Version 1.4.14 

Case 

Summary:

Assertions: 

CFT-IM-05 Acquire mobile device internal memory and review reported

subscriber and equipment related information (i.e., IMEI, MSISDN).

A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-04 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall have the ability to present acquired

data elements in a human-readable format via either a preview-pane or

generated report.

A_IM-06 If a cellular forensic tool successfully completes acquisition of

the target device then equipment related information shall be presented in

a human-readable format without modification. 

Tester 

Name: 

rpa 

Test Host: 

Test Date: 

Device: 

Morrisy

Thu Apr 24 14:40:15 EDT 2008

Nokia_6101 

Source OS: WIN XP 

Setup: Interface: RJ45 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

PIM Data 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry 

Call Logs 

Maximum Length

Regular Length

Deleted Entry

Special Character 

Missed 

Missed - Deleted 

Text Messages 

MMS Messages 

Stand-alone data files 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video 

Audio 

October 2008 19 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

 

Test Case CFT-IM-05 Guidance Software Neutrino Version 1.4.14 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Thu Apr 24 14:40:15 EDT 2008

Acquisition finished: Thu Apr 24 15:06:01 EDT 2008 

Device connectivity was established via supported interface

Readability and completeness of acquired data was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_IM-01 Device connectivity via supported interfaces. as expected

A_IM-04 Readability and completeness of acquired data via

supported reports. 

as expected 

A_IM-06 Acquisition of IMEI. as expected 

Analysis: Expected results achieved 

October 2008 20 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.5 CFT-IM-06 (Nokia 6101) 

Test Case CFT-IM-06 Guidance Software Neutrino Version 1.4.14 

Case CFT-IM-06 Acquire mobile device internal memory and review reported PIM

Summary: related data. 

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-04 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall have the ability to present acquired

data elements in a human-readable format via either a preview-pane or

generated report.

A_IM-07 If a cellular forensic tool successfully completes acquisition of

the target device then all known address book entries shall be presented in

a human-readable format without modification. 

A_IM-08 If a cellular forensic tool successfully completes acquisition of

the target device then all known maximum length address book entries shall

be presented in a human-readable format without modification.

A_IM-09 If a cellular forensic tool successfully completes acquisition of

the target device then all known address book entries containing special

characters shall be presented in a human-readable format without

modification. 

A_IM-10 If a cellular forensic tool successfully completes acquisition of

the target device then all known address book entries containing blank

names shall be presented in a human-readable format without modification.

A_IM-11 If a cellular forensic tool successfully completes acquisition of

the target device then all known email addresses associated with address

book entries shall be presented in a human-readable format without

modification. 

A_IM-12 If a cellular forensic tool successfully completes acquisition of

the target device then all known graphics associated with address book

entries shall be presented in a human-readable format without modification.

A_IM-13 If a cellular forensic tool successfully completes acquisition of

the target device then all known datebook, calendar, note entries shall be

presented in a human-readable format without modification.

A_IM-14 If a cellular forensic tool successfully completes acquisition of

the target device then all maximum length datebook, calendar, note entries

shall be presented in a human readable format without modification. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Thu Apr 24 15:16:50 EDT 2008

Device: Nokia_6101 

Source OS: WIN XP 

Setup: Interface: RJ45 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

October 2008 21 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

 

Test Case CFT-IM-06 Guidance Software Neutrino Version 1.4.14 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log Created By Neutrino Version 1.4.14

Highlights: Acquisition started: Thu Apr 24 15:16:50 EDT 2008

Acquisition finished: Thu Apr 24 15:24:16 EDT 2008 

Device connectivity was established via supported interface

Readability and completeness of acquired data was successful

All address book entries were successfully acquired

ALL PIM related data was acquired 

Notes: 

Address book entries containing pictures were not linked directly to the

corresponding name. 

Acquisitions of notes are not supported by Neutrino. 

Results: 

Assertion & Expected Result Actual 

Result 

A_IM-01 Device connectivity via supported interfaces. as expected

A_IM-04 Readability and completeness of acquired data via

supported reports. 

as expected 

A_IM-07 Acquisition of address book entries. as expected

A_IM-08 Acquisition of maximum length address book

entries. 

as expected 

A_IM-09 Acquisition of address book entries containing

special characters. 

as expected 

A_IM-10 Acquisition of address book entries containing a

blank name entry. 

as expected 

A_IM-11 Acquisition of embedded email addresses within

address book entries. 

as expected 

A_IM-12 Acquisition of embedded graphics within address

book entries. 

as expected 

A_IM-13 Acquisition of PIM data (i.e., datebook/calendar,

notes). 

as expected 

A_IM-14 Acquisition of maximum length PIM data. as expected 

Analysis: Expected results achieved 

October 2008 22 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

5.2.6 CFT-IM-07 (Nokia 6101) 

Test Case CFT-IM-07 Guidance Software Neutrino Version 1.4.14 

Case CFT-IM-07 Acquire mobile device internal memory and review reported call

Summary: logs.

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-04 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall have the ability to present acquired

data elements in a human-readable format via either a preview-pane or

generated report.

A_IM-15 If a cellular forensic tool successfully completes acquisition of

the target device then all call logs (incoming/outgoing) shall be presented

in a human-readable format without modification. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Fri Apr 25 08:59:51 EDT 2008

Device: Nokia_6101 

Source OS: WIN XP 

Setup: Interface: RJ45 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image 

October 2008 23 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

Test Case CFT-IM-07 Guidance Software Neutrino Version 1.4.14 

Image - Deleted

Video 

Video - Deleted 

Log Created By Neutrino Version 1.4.14

Highlights: Acquisition started: Fri Apr 25 08:59:51 EDT 2008

Acquisition finished: Fri Apr 25 09:32:00 EDT 2008 

Device connectivity was established via supported interface

Readability and completeness of acquired data was successful

All Call Logs (incoming, outgoing) were acquired 

Results: 

Analysis: Expected results achieved 

Assertion & Expected Result Actual 

Result 

A_IM-01 Device connectivity via supported interfaces. as expected

A_IM-04 Readability and completeness of acquired data via

supported reports. 

as expected 

A_IM-15 Acquisition of call logs. as expected 

October 2008 24 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

5.2.7 CFT-IM-08 (Nokia 6101) 

Test Case CFT-IM-08 Guidance Software Neutrino Version 1.4.14 

Case CFT-IM-08 Acquire mobile device internal memory and review reported text

Summary: messages.

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-04 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall have the ability to present acquired

data elements in a human-readable format via either a preview-pane or

generated report.

A_IM-16 If a cellular forensic tool successfully completes acquisition of

the target device then all text messages (i.e., SMS, EMS) messages shall be

presented in a human-readable format without modification. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Fri Apr 25 09:33:26 EDT 2008

Device: Nokia_6101 

Source OS: WIN XP 

Setup: Interface: RJ45 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image 

October 2008 25 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

Test Case CFT-IM-08 Guidance Software Neutrino Version 1.4.14 

Image - Deleted

Video 

Video - Deleted 

Log Created By Neutrino Version 1.4.14

Highlights: Acquisition started: Fri Apr 25 09:33:26 EDT 2008

Acquisition finished: Fri Apr 25 09:45:03 EDT 2008 

Device connectivity was established via supported interface

Readability and completeness of acquired data was successful

ALL text messages (SMS, EMS) were acquired 

Results: 

Analysis: Expected results achieved 

Assertion & Expected Result Actual 

Result 

A_IM-01 Device connectivity via supported interfaces. as expected

A_IM-04 Readability and completeness of acquired data via

supported reports. 

as expected 

A_IM-16 Acquisition of text messages. as expected 

October 2008 26 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.8 CFT-IM-10 (Nokia 6101) 

Test Case CFT-IM-10 Guidance Software Neutrino Version 1.4.14 

Case CFT-IM-10 Acquire mobile device internal memory and review reported standSummary: alone multi-media data (i.e., audio, graphics, video).

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-04 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall have the ability to present acquired

data elements in a human-readable format via either a preview-pane or

generated report.

A_IM-20 If a cellular forensic tool successfully completes acquisition of

the target device then all stand-alone audio files shall be playable via

either an internal application or suggested third-party application without

modification. 

A_IM-21 If a cellular forensic tool successfully completes acquisition of

the target device then all stand-alone image files shall be viewable via

either an internal application or suggested third-party application without

modification. 

A_IM-22 If a cellular forensic tool successfully completes acquisition of

the target device then all stand-alone video files shall be viewable via

either an internal application or suggested third-party application without

modification. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Fri Apr 25 10:21:00 EDT 2008

Device: Nokia_6101 

Source OS: WIN XP 

Setup: Interface: RJ45 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio 

October 2008 27 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

 

Test Case CFT-IM-10 Guidance Software Neutrino Version 1.4.14 

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Fri Apr 25 10:21:00 EDT 2008

Acquisition finished: Fri Apr 25 10:27:16 EDT 2008 

Device connectivity was established via supported interface

Readability and completeness of acquired data was successful

ALL stand-alone data files (Audio, Image, Video) were acquired 

Results: 

Assertion & Expected Result Actual 

Result 

A_IM-01 Device connectivity via supported interfaces. as expected

A_IM-04 Readability and completeness of acquired data via

supported reports. 

as expected 

A_IM-20 Acquisition of stand-alone audio files. as expected

A_IM-21 Acquisition of stand-alone graphic files. as expected

A_IM-22 Acquisition of stand-alone video files. as expected 

Analysis: Expected results achieved 

October 2008 28 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

 

 

5.2.9 CFT-IMO-01 (Nokia 6101) 

Test Case CFT-IMO-01 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-IMO-01 Acquire mobile device internal memory and review reported data

via supported generated report formats.

Assertions: A_IMO-38 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification via supported generated report formats. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Fri Apr 25 10:40:30 EDT 2008

Device: Nokia_6101 

Source 

Setup: 

OS: WIN XP 

Interface: RJ45 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log Created By Neutrino Version 1.4.14 

October 2008 29 of 110 Results of Neutrino V1.4.14 8/2008 
 

Test Case CFT-IMO-01 Guidance Software Neutrino Version 1.4.14 

Highlights: Acquisition started: Fri Apr 25 10:40:30 EDT 2008

Acquisition finished: Fri Apr 25 10:46:06 EDT 2008 

Complete representation of known data via generated reports was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_IMO-38 Comparison of known device data elements via

generated reports. 

as expected 

Analysis: Expected results achieved 

October 2008 30 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

 

 

5.2.10 CFT-IMO-02 (Nokia 6101) 

Test Case CFT-IMO-02 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-IMO-02 Acquire mobile device internal memory and review reported data

via the preview-pane.

Assertions: A_IMO-39 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification in a preview-pane view. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Fri Apr 25 11:32:06 EDT 2008

Device: Nokia_6101 

Source 

Setup: 

OS: WIN XP 

Interface: RJ45 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log Created By Neutrino Version 1.4.14 

October 2008 31 of 110 Results of Neutrino V1.4.14 8/2008 
 

Test Case CFT-IMO-02 Guidance Software Neutrino Version 1.4.14 

Highlights: Acquisition started: Fri Apr 25 11:32:06 EDT 2008

Acquisition finished: Fri Apr 25 11:41:00 EDT 2008 

Complete representation of known data via preview-pane was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_IMO-39 Comparison of known device data elements via

preview-pane. 

as expected 

Analysis: Expected results achieved 

October 2008 32 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

 

5.2.11 CFT-IMO-03 (Nokia 6101) 

Test Case CFT-IMO-03 Guidance Software Neutrino Version 1.4.14 

Case CFT-IMO-03 Acquire mobile device internal memory and compare reported data

Summary: via the preview-pane and supported generated reports.

Assertions: A_IMO-38 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification via supported generated report formats.

A_IMO-39 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification in a preview-pane view.

A_IMO-40 If a cellular forensic tool provides a preview-pane view and a

generated report of the acquired data then the reports shall maintain

consistency of all reported data elements. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Fri Apr 25 11:41:25 EDT 2008

Device: Nokia_6101 

Source OS: WIN XP 

Setup: Interface: RJ45 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

October 2008 33 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

Test Case CFT-IMO-03 Guidance Software Neutrino Version 1.4.14 

Video - Deleted 

Log Created By Neutrino Version 1.4.14

Highlights: Acquisition started: Fri Apr 25 11:41:25 EDT 2008

Acquisition finished: Fri Apr 25 11:57:23 EDT 2008 

Complete representation of known data via generated reports was successful 

Complete representation of known data via preview-pane was successful 

Consistency between generated reports and preview-pane was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_IMO-38 Comparison of known device data elements via

generated reports. 

as expected 

A_IMO-39 Comparison of known device data elements via

preview-pane. 

as expected 

A_IMO-40 Compare generated reports and preview-pane views

for device acquisition. 

as expected 

Analysis: Expected results achieved 

October 2008 34 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

 

 

5.2.12 CFT-IMO-04 (Nokia 6101) 

Test Case CFT-IMO-04 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-IMO-04 After a successful mobile device internal memory acquisition,

alter the case file via third party means and attempt to re-open the case.

Assertions: A_IMO-41 If modification is attempted to the case file or individual data

elements via third-party means then the tool shall provide protection

mechanisms disallowing or reporting data modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Fri Apr 25 11:59:36 EDT 2008

Device: Nokia_6101 

Source 

Setup: 

OS: WIN XP 

Interface: RJ45 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log Created By Neutrino Version 1.4.14 

October 2008 35 of 110 Results of Neutrino V1.4.14 8/2008 
 

Test Case CFT-IMO-04 Guidance Software Neutrino Version 1.4.14 

Highlights: Acquisition started: Fri Apr 25 11:59:36 EDT 2008

Acquisition finished: Fri Apr 25 12:05:17 EDT 2008 

Notification of modified case data was successful 

Notes: 

EnCase reports the following error when attempting to modify a case file:

Error in <filename>: Invalid data checksum 

Results: 

Assertion & Expected Result Actual Result 

A_IMO-41 Notification of modified device case data. as expected 

Analysis: Expected results achieved 

October 2008 36 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

 

5.2.13 CFT-IMO-10 (Nokia 6101) 

Test Case CFT-IMO-10 Guidance Software Neutrino Version 1.4.14 

Case CFT-IMO-10 Perform a stand-alone mobile device internal memory acquisition

Summary: and review the status flags for text messages present on the SIM.

Assertions: A_IMO-38 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification via supported generated report formats.

A_IMO-39 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification in a preview-pane view.

A_IMO-55 If the cellular forensic tool supports stand-alone acquisition of

internal memory with the SIM present, then the contents of the SIM shall

not be modified during internal memory acquisition. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Fri Apr 25 12:16:58 EDT 2008

Device: Nokia_6101 

Source OS: WIN XP 

Setup: Interface: RJ45 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

October 2008 37 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

Test Case CFT-IMO-10 Guidance Software Neutrino Version 1.4.14 

Video - Deleted 

Log Created By Neutrino Version 1.4.14

Highlights: Acquisition started: Fri Apr 25 12:16:58 EDT 2008

Acquisition finished: Fri Apr 25 12:23:19 EDT 2008 

Complete representation of known data via generated reports was not

successful 

Complete representation of known data via preview-pane was not successful

Stand-alone acquisition without disrupting SIM data was not successful 

Notes: 

When selecting "Acquire Logical Data" only, text messages

present on the SIM whose status is “Unread” is modified to

"Read" after the internal memory device logical Acquisition. 

"Acquire SIM Image" is NOT selected. 

Results: 

Assertion & Expected Result Actual 

Result 

A_IMO-38 Comparison of known device data elements via

generated reports. 

Partial 

A_IMO-39 Comparison of known device data elements via

preview-pane. 

Partial 

A_IMO-55 Stand-along acquisition without disrupting SIM

data. 

Not as 

expected 

Analysis: Expected results not achieved 

October 2008 38 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

 

5.2.14 CFT-IMO-11 (Nokia 6101) 

Test Case CFT-IMO-11 Guidance Software Neutrino Version 1.4.14 

Case CFT-IMO-11 Acquire mobile device internal memory and review hash values for

Summary: vendor supported data objects.

Assertions: A_IMO-38 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification via supported generated report formats.

A_IMO-39 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification in a preview-pane view.

A_IMO-56 If the cellular forensic tool supports hashing for individual data

objects then the tool shall present the user with a hash value for each

supported data object. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Fri Apr 25 12:24:07 EDT 2008

Device: Nokia_6101 

Source OS: WIN XP 

Setup: Interface: RJ45 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

October 2008 39 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

Test Case CFT-IMO-11 Guidance Software Neutrino Version 1.4.14 

Video - Deleted 

Log Created By Neutrino Version 1.4.14

Highlights: Acquisition started: Fri Apr 25 12:24:07 EDT 2008

Acquisition finished: Fri Apr 25 12:30:36 EDT 2008 

Complete representation of known data via generated reports was successful

Complete representation of known data via preview-pane was successful

Device hash reporting for individual acquired data elements was successful 

Notes: 

Contacts, Text Messages (SMS, EMS) Call Logs, Calendar entries and File

System data objects hash values are reported via the GUI. 

Results: 

Assertion & Expected Result Actual 

Result 

A_IMO-38 Comparison of known device data elements via

generated reports. 

as expected 

A_IMO-39 Comparison of known device data elements via

preview-pane. 

as expected 

A_IMO-56 Device hash reporting for individual acquired

data objects. 

as expected 

Analysis: Expected results achieved 

October 2008 40 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.15 CFT-SIM-01 (T-Mobile SIM) 

Test Case CFT-SIM-01 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIM-01 Acquire SIM over supported interfaces (e.g., PC/SC reader,

proprietary reader).

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader). 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Apr 21 13:26:49 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Mon Apr 21 13:26:49 EDT 2008

Acquisition finished: Mon Apr 21 13:27:22 EDT 2008 

Media connectivity was established via supported interface 

Results: 

Assertion & Expected Result Actual Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected 

Analysis: Expected results achieved 

October 2008 41 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.16 CFT-SIM-02 (T-Mobile SIM) 

Test Case CFT-SIM-02 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIM-02 Attempt acquisition of a non-supported SIM. 

Assertions: A_SIM-24 If a cellular forensic tool attempts to connect to a non-supported

SIM then the tool shall have the ability to identify that the SIM is not

supported. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Apr 21 13:29:19 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Mon Apr 21 13:29:19 EDT 2008 

Identification of non-supported media was successful 

Results: 

Assertion & Expected Result Actual Result 

A_SIM-24 Identification of non-supported SIMs. as expected 

Analysis: Expected results achieved 

October 2008 42 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.17 CFT-SIM-03 (T-Mobile SIM) 

Test Case CFT-SIM-03 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIM-03 Begin SIM acquisition and interrupt connectivity by interface

disengagement.

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-25 If a cellular forensic tool encounters disengagement between the

SIM reader and application then the application shall notify the user that

connectivity has been disrupted. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Apr 21 13:31:10 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Mon Apr 21 13:31:10 EDT 2008

Acquisition finished: Mon Apr 21 13:33:12 EDT 2008 

Media connectivity was established via supported interface

Media acquisition disruption notification was successful 

Results: 

Assertion & Expected Result Actual Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-25 Notification of SIM acquisition disruption. as expected 

Analysis: Expected results achieved 

October 2008 43 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.18 CFT-SIM-04 (T-Mobile SIM) 

Test Case CFT-SIM-04 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIM-04 Attempt acquisition on a password-protected SIM. 

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-26 If the SIM is password-protected then the cellular forensic tool

shall provide the examiner with the opportunity to input the PIN before

acquisition. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Apr 21 13:34:27 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Mon Apr 21 13:34:27 EDT 2008

Acquisition finished: Mon Apr 21 13:38:48 EDT 2008 

Media connectivity was established via supported interface

Ability to enter PIN on protected media before acquisition was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-26 Password entry before acquisition for protected

SIMs. 

as expected 

Analysis: Expected results achieved 

October 2008 44 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.19 CFT-SIM-05 (T-Mobile SIM) 

Test Case CFT-SIM-05 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIM-05 Acquire SIM internal memory and review reported data via the

preview-pane or generated reports for readability.

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-27 If a cellular forensic tool successfully completes acquisition of

the target SIM then the tool shall have the ability to present acquired

data in a human-readable format via either preview-pane or generated

report. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Apr 21 13:50:02 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Mon Apr 21 13:50:02 EDT 2008

Acquisition finished: Mon Apr 21 14:10:50 EDT 2008 

Media connectivity was established via supported interface

Readability and completeness of acquired data was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-27 Readability and completeness of acquired data via

supported reports. 

as expected 

Analysis: Expected results achieved 

October 2008 45 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.20 CFT-SIM-06 (T-Mobile SIM) 

Test Case CFT-SIM-06 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIM-06 Acquire SIM internal memory and review reported subscriber and

equipment related information (i.e., SPN, ICCID, IMSI, MSISDN).

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-27 If a cellular forensic tool successfully completes acquisition of

the target SIM then the tool shall have the ability to present acquired

data in a human-readable format via either preview-pane or generated

report.

A_SIM-29 If a cellular forensic tool successfully completes acquisition of

the target SIM then the ICCID shall be presented in a human-readable format

without modification. 

A_SIM-30 If a cellular forensic tool successfully completes acquisition of

the target SIM then the IMSI shall be presented in a human-readable format

without modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Apr 21 14:25:32 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Mon Apr 21 14:25:32 EDT 2008

Acquisition finished: Mon Apr 21 14:28:36 EDT 2008 

Media connectivity was established via supported interface

Readability and completeness of acquired data was successful

ICCID was acquired

IMSI was acquired 

Notes: 

The following fields: ICCID and IMSI were present in the generated report,

but not found within the Graphical User Interface. 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-27 Readability and completeness of acquired data via

supported reports. 

as expected 

A_SIM-29 Acquisition of ICCID. as expected

A_SIM-30 Acquisition of IMSI. as expected 

October 2008 46 of 110 Results of Neutrino V1.4.14 8/2008 
Test Case CFT-SIM-06 Guidance Software Neutrino Version 1.4.14 

Analysis: Expected results achieved 

October 2008 47 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.21 CFT-SIM-07 (T-Mobile SIM) 

Test Case CFT-SIM-07 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIM-07 Acquire SIM internal memory and review reported Abbreviated

Dialing Numbers (ADN).

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-27 If a cellular forensic tool successfully completes acquisition of

the target SIM then the tool shall have the ability to present acquired

data in a human-readable format via either preview-pane or generated

report.

A_SIM-32 If a cellular forensic tool successfully completes acquisition of

the target SIM then all Abbreviated Dialing Numbers (ADN) shall be

presented in a human-readable format without modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Apr 21 14:34:45 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Mon Apr 21 14:34:45 EDT 2008

Acquisition finished: Mon Apr 21 14:43:58 EDT 2008 

Media connectivity was established via supported interface

Readability and completeness of acquired data was successful

Regular length ADNs were acquired

Maximum Length ADNs were not acquired

Special Character ADNs were not acquired

Blank Name ADNs were acquired 

Notes: 

Maximum length ADNs (16 characters) were not acquired or reported

in either the GUI or generated report. 

Special character names (i.e., '@') were not displayed. 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-27 Readability and completeness of acquired data via

supported reports. 

as expected 

A_SIM-32 Acquisition of ADNs. Partial 

October 2008 48 of 110 Results of Neutrino V1.4.14 8/2008 
Test Case CFT-SIM-07 Guidance Software Neutrino Version 1.4.14 

Analysis: Partial results achieved 

October 2008 49 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.22 CFT-SIM-08 (T-Mobile SIM) 

Test Case CFT-SIM-08 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIM-08 Acquire SIM internal memory and review reported Last Numbers

Dialed (LND).

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-27 If a cellular forensic tool successfully completes acquisition of

the target SIM then the tool shall have the ability to present acquired

data in a human-readable format via either preview-pane or generated

report.

A_SIM-33 If a cellular forensic tool successfully completes acquisition of

the target SIM then all Last Numbers Dialed (LND) shall be presented in a

human-readable format without modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Mon Apr 21 14:52:24 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Mon Apr 21 14:52:24 EDT 2008

Acquisition finished: Mon Apr 21 15:02:51 EDT 2008 

Media connectivity was established via supported interface

Readability and completeness of acquired data was successful

LNDs were acquired 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-27 Readability and completeness of acquired data via

supported reports. 

as expected 

A_SIM-33 Acquisition of LNDs. as expected 

Analysis: Expected results achieved 

October 2008 50 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.23 CFT-SIM-09 (T-Mobile SIM) 

Test Case CFT-SIM-09 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIM-09 Acquire SIM internal memory and review reported text messages

(i.e., SMS, EMS).

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-27 If a cellular forensic tool successfully completes acquisition of

the target SIM then the tool shall have the ability to present acquired

data in a human-readable format via either preview-pane or generated

report.

A_SIM-34 If a cellular forensic tool successfully completes Acquisition of

the target SIM then all SMS text messages shall be presented in a humanreadable format without modification. 

A_SIM-35 If a cellular forensic tool successfully completes Acquisition of

the target SIM then all EMS text messages shall be presented in a humanreadable format without modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Apr 22 09:59:38 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Tue Apr 22 09:59:38 EDT 2008

Acquisition finished: Tue Apr 22 10:12:46 EDT 2008 

Media connectivity was established via supported interface

Readability and completeness of acquired data was successful

ALL text messages (SMS, EMS) were acquired 

Notes: 

Status flags for text messages are only displayed for deleted text

messages.

Read and unread status for text messages are not presented within the

GUI or generated report. 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-27 Readability and completeness of acquired data via

supported reports. 

as expected 

A_SIM-34 Acquisition of SMS messages. as expected

A_SIM-35 Acquisition of EMS messages. as expected 

October 2008 51 of 110 Results of Neutrino V1.4.14 8/2008 
Test Case CFT-SIM-09 Guidance Software Neutrino Version 1.4.14 

Analysis: Expected results achieved 

October 2008 52 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.24 CFT-SIMO-01 (T-Mobile SIM) 

Test Case CFT-SIMO-01 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIMO-01 Acquire SIM internal memory and review acquired data via

suported generated report formats.

Assertions: A_SIMO-58 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Tue Apr 22 10:42:47 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Tue Apr 22 10:42:47 EDT 2008

Acquisition finished: Tue Apr 22 10:54:51 EDT 2008 

Complete representation of known data via generated reports was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIMO-58 Comparison of known SIM data elements via

generated reports. 

as expected 

Analysis: Expected results achieved 

October 2008 53 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.25 CFT-SIMO-02 (T-Mobile SIM) 

Test Case CFT-SIMO-02 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIMO-02 Acquire SIM internal memory and review acquired data via the

preview-pane.

Assertions: A_SIMO-59 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Tue Apr 22 10:59:49 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Tue Apr 22 10:59:49 EDT 2008

Acquisition finished: Tue Apr 22 11:12:04 EDT 2008 

Complete representation of known data via preview-pane was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIMO-59 Comparison of known SIM data elements via

preview-pane. 

as expected 

Analysis: Expected results achieved 

October 2008 54 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.26 CFT-SIMO-03 (T-Mobile SIM) 

Test Case CFT-SIMO-03 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIMO-03 Acquire SIM internal memory and compare acquired data via the

preview-pane and supported generated reports.

Assertions: A_SIMO-58 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats.

A_SIMO-59 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats.

A_SIMO-60 If a cellular forensic tool provides a preview-pane view and a

generated report of the acquired data then the reports shall maintain

consistency of all reported data elements. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Tue Apr 22 12:25:57 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Tue Apr 22 12:25:57 EDT 2008

Acquisition finished: Tue Apr 22 12:38:54 EDT 2008 

Complete representation of known data via generated reports was successful

Complete representation of known data via preview-pane was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIMO-58 Comparison of known SIM data elements via

generated reports. 

as expected 

A_SIMO-59 Comparison of known SIM data elements via

preview-pane. 

as expected 

A_SIMO-60 Compare generated reports and preview-pane views

for SIM acquisition. 

as expected 

Analysis: Expected results achieved 

October 2008 55 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.27 CFT-SIMO-04 (T-Mobile SIM) 

Test Case CFT-SIMO-04 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIMO-04 After a successful SIM internal memory Acquisition, aflter the

case file via third party means and attempt to re-open the case.

Assertions: A_SIMO-61 If modification is attempted to the case file or individual data

elements via third-party means then the tool shall provide protection

mechanisms disallowing or reporting data modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Apr 22 12:43:20 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Tue Apr 22 12:43:20 EDT 2008

Acquisition finished: Tue Apr 22 12:51:24 EDT 2008

Notification of modified case data was successful 

Notes: 

EnCase reports the following error when attempting to modify a case file:

Error in <filename>: Invalid data checksum 

Results: 

Assertion & Expected Result Actual Result 

A_SIMO-61 Notification of modifed SIM case data. as expected 

Analysis: Expected results achieved 

October 2008 56 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.28 CFT-SIMO-05 (T-Mobile SIM) 

Test Case CFT-SIMO-05 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIMO-05 Acquire SIM internal memory and review reports for recoverable

deleted data. 

Assertions: A_SIMO-58 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats.

A_SIMO-59 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats.

A_SIMO-62 If the cellular forensic tool successfully completes acquisition

of the target SIM and recoverable deleted SMS messages exist then the tool

shall present recoverable deleted data in a human-readable format without

modification. 

A_SIMO-63 If the cellular forensic tool successfully completes acquisition

of the target SIM and recoverable deleted EMS messages exist then the tool

shall present recoverable deleted data in a human-readable format without

modification. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Tue Apr 22 12:57:39 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Tue Apr 22 12:57:39 EDT 2008

Acquisition finished: Tue Apr 22 13:10:23 EDT 2008 

Complete representation of known data via generated reports was successful

Complete representation of known data via preview-pane was successful

Deleted SMS data was recovered 

Deleted EMS data was recovered 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIMO-58 Comparison of known SIM data elements via

generated reports. 

as expected 

A_SIMO-59 Comparison of known SIM data elements via

preview-pane. 

as expected 

A_SIMO-62 Recovery of deleted SMS messages. as expected

A_SIMO-63 Recovery of deleted EMS messages. as expected 

October 2008 57 of 110 Results of Neutrino V1.4.14 8/2008 
Test Case CFT-SIMO-05 Guidance Software Neutrino Version 1.4.14 

Analysis: Expected results achieved 

October 2008 58 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.29 CFT-SIMO-08 (T-Mobile SIM) 

Test Case CFT-SIMO-08 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIMO-08 Begin acquisition on a PIN protected SIM to determine if the

tool provides an accurate count of the remaining number of PIN attempts and

if the PIN attempts are decremented when entering an incorrect value.

Assertions: A_SIMO-67 If a cellular forensic tool provides the examiner with the

remaining number of authentication attempts then the application should

provide an accurate count of the remaining PIN attempts. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Tue Apr 22 14:12:28 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Tue Apr 22 14:12:28 EDT 2008

Acquisition finished: Tue Apr 22 14:25:40 EDT 2008 

Remaining number of PIN attempts properly displayed was successful 

Results: 

Assertion & Expected Result Actual Result 

A_SIMO-67 Display of remaining number of PIN attempts. as expected 

Analysis: Expected results achieved 

October 2008 59 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.30 CFT-SIMO-09 (T-Mobile SIM) 

Test Case CFT-SIMO-09 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIMO-09 Begin acquisition on a SIM whose PIN attempts have been

exhausted to determine if the tool provides an accurate count of the

remaining number of PUK attempts and if the PUK attempts are decremented

when entering an incorrect value.

Assertions: A_SIMO-68 If a cellular forensic tool provides the examiner with the

remaining number of PUK attempts then the application should provide an

accurate count of the remaining PUK attempts. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Tue Apr 22 14:26:19 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Tue Apr 22 14:26:19 EDT 2008

Acquisition finished: Tue Apr 22 14:35:58 EDT 2008 

Remaining number of PUK attempts properly displayed was successful 

Results: 

Assertion & Expected Result Actual Result 

A_SIMO-68 Display of remaining number of PUK attempts. as expected 

Analysis: Expected results achieved 

October 2008 60 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.31 CFT-SIMO-10 (T-Mobile SIM) 

Test Case CFT-SIMO-10 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIMO-10 Acquire SIM internal memory and review hash values for vendor

supported data objects.

Assertions: A_SIMO-58 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats.

A_SIMO-59 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats.

A_SIMO-69 If the cellular forensic tool supports hashing for individual

data objects then the tool shall present the user with a hash value for

each supported data object. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Tue Apr 22 14:36:58 EDT 2008

Device: TMOBILE_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Tue Apr 22 14:36:58 EDT 2008

Acquisition finished: Tue Apr 22 14:45:47 EDT 2008 

Complete representation of known data via generated reports was successful

Complete representation of known data via preview-pane was successful

Device hash reporting for individual acquired data elements was successful 

Notes: 

Contacts (ADNs), Test Messages (SMS, EMS) and Call Logs (LND) hash

values are reported via the GUI. 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIMO-58 Comparison of known SIM data elements via

generated reports. 

as expected 

A_SIMO-59 Comparison of known SIM data elements via

preview-pane. 

as expected 

A_SIMO-69 SIM hash reporting for individual acquired data

objects. 

as expected 

Analysis: Expected results achieved 

October 2008 61 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

 

 

5.2.32 CFT-IM-01 (Motorola RAZR V3) 

Test Case CFT-IM-01 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-IM-01 Acquire mobile device internal memory over supported interfaces

(e.g., cable, Bluetooth, IrDA).

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA). 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu Apr 24 07:12:04 EDT 2008

Device: Motorola_RAZR_V3 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Thu Apr 24 07:12:04 EDT 2008

Acquisition finished: Thu Apr 24 07:14:47 EDT 2008 

October 2008 62 of 110 Results of Neutrino V1.4.14 8/2008 
 

Test Case CFT-IM-01 Guidance Software Neutrino Version 1.4.14 

Device connectivity was established via supported interface 

Results: 

Assertion & Expected Result Actual Result 

A_IM-01 Device connectivity via supported interfaces. as expected 

Analysis: Expected results achieved 

October 2008 63 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

 

 

5.2.33 CFT-IM-02 (Motorola RAZR V3) 

Test Case CFT-IM-02 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-IM-02 Attempt internal memory acquisition of a non-supported mobile

device. 

Assertions: A_IM-02 If a cellular forensic tool attempts to connect to a non-supported

device then the tool shall have the ability to identify that the device is

not supported. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu Apr 24 08:09:41 EDT 2008

Device: non-supported mobile device

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log Created By Neutrino Version 1.4.14 

October 2008 64 of 110 Results of Neutrino V1.4.14 8/2008 
 

Test Case CFT-IM-02 Guidance Software Neutrino Version 1.4.14 

Highlights: Acquisition started: Thu Apr 24 08:09:41 EDT 2008

Acquisition finished: Thu Apr 24 08:11:03 EDT 2008 

Identification of non-supported devices was successful 

Results: 

Assertion & Expected Result Actual Result 

A_IM-02 Identification of non-supported devices. as expected 

Analysis: Expected results achieved 

October 2008 65 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

 

5.2.34 CFT-IM-04 (Motorola RAZR V3) 

Test Case CFT-IM-04 Guidance Software Neutrino Version 1.4.14 

Case CFT-IM-04 Acquire mobile device internal memory and review reported data

Summary: via the preview-pane or generated reports for readability.

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-04 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall have the ability to present acquired

data elements in a human-readable format via either a preview-pane or

generated report. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Thu Apr 24 08:20:06 EDT 2008

Device: Motorola_RAZR_V3 

Source OS: WIN XP 

Setup: Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

October 2008 66 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

Test Case CFT-IM-04 Guidance Software Neutrino Version 1.4.14 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Thu Apr 24 08:20:06 EDT 2008

Acquisition finished: Thu Apr 24 08:21:13 EDT 2008 

Device connectivity was established via supported interface

Readability and completeness of acquired data was successful 

Results: 

Assertion & Expected Result 

A_IM-01 Device connectivity via supported interfaces.

A_IM-04 Readability and completeness of acquired data via

supported reports. 

Actual 

Result 

as expected

as expected 

Analysis: Expected results achieved 

October 2008 67 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

5.2.35 CFT-IM-05 (Motorola RAZR V3) 

Test Case CFT-IM-05 Guidance Software Neutrino Version 1.4.14 

Case CFT-IM-05 Acquire mobile device internal memory and review reported

Summary: subscriber and equipment related information (i.e., IMEI, MSISDN).

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-04 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall have the ability to present acquired

data elements in a human-readable format via either a preview-pane or

generated report.

A_IM-06 If a cellular forensic tool successfully completes acquisition of

the target device then equipment related information shall be presented in

a human-readable format without modification. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Thu Apr 24 08:21:56 EDT 2008

Device: Motorola_RAZR_V3 

Source OS: WIN XP 

Setup: Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image 

October 2008 68 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

Test Case CFT-IM-05 Guidance Software Neutrino Version 1.4.14 

Image - Deleted

Video 

Video - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Thu Apr 24 08:21:56 EDT 2008

Acquisition finished: Thu Apr 24 08:24:49 EDT 2008 

Device connectivity was established via supported interface

Readability and completeness of acquired data was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_IM-01 Device connectivity via supported interfaces. as expected

A_IM-04 Readability and completeness of acquired data via

supported reports. 

as expected 

A_IM-06 Acquisition of IMEI. as expected 

Analysis: Expected results achieved 

October 2008 69 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.36 CFT-IM-06 (Motorola RAZR V3) 

Test Case CFT-IM-06 Guidance Software Neutrino Version 1.4.14 

Case CFT-IM-06 Acquire mobile device internal memory and review reported PIM

Summary: related data. 

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-04 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall have the ability to present acquired

data elements in a human-readable format via either a preview-pane or

generated report.

A_IM-07 If a cellular forensic tool successfully completes acquisition of

the target device then all known address book entries shall be presented in

a human-readable format without modification. 

A_IM-08 If a cellular forensic tool successfully completes acquisition of

the target device then all known maximum length address book entries shall

be presented in a human-readable format without modification.

A_IM-09 If a cellular forensic tool successfully completes acquisition of

the target device then all known address book entries containing special

characters shall be presented in a human-readable format without

modification. 

A_IM-10 If a cellular forensic tool successfully completes acquisition of

the target device then all known address book entries containing blank

names shall be presented in a human-readable format without modification.

A_IM-11 If a cellular forensic tool successfully completes acquisition of

the target device then all known email addresses associated with address

book entries shall be presented in a human-readable format without

modification. 

A_IM-12 If a cellular forensic tool successfully completes acquisition of

the target device then all known graphics associated with address book

entries shall be presented in a human-readable format without modification.

A_IM-13 If a cellular forensic tool successfully completes acquisition of

the target device then all known datebook, calendar, note entries shall be

presented in a human-readable format without modification.

A_IM-14 If a cellular forensic tool successfully completes acquisition of

the target device then all maximum length datebook, calendar, note entries

shall be presented in a human readable format without modification. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Thu Apr 24 08:25:43 EDT 2008

Device: Motorola_RAZR_V3 

Source OS: WIN XP 

Setup: Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

October 2008 70 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

 

Test Case CFT-IM-06 Guidance Software Neutrino Version 1.4.14 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log Created By Neutrino Version 1.4.14

Highlights: Acquisition started: Thu Apr 24 08:25:43 EDT 2008

Acquisition finished: Thu Apr 24 08:29:43 EDT 2008 

Device connectivity was established via supported interface

Readability and completeness of acquired data was successful

All address book entries were successfully acquired

ALL PIM related data was acquired 

Results: 

Analysis: Expected results achieved 

Assertion & Expected Result Actual 

Result 

A_IM-01 Device connectivity via supported interfaces. as expected

A_IM-04 Readability and completeness of acquired data via

supported reports. 

as expected 

A_IM-07 Acquisition of address book entries. as expected

A_IM-08 Acquisition of maximum length address book

entries. 

as expected 

A_IM-09 Acquisition of address book entries containing

special characters. 

as expected 

A_IM-10 Acquisition of address book entries containing a

blank name entry. 

as expected 

A_IM-11 Acquisition of embedded email addresses within

address book entries. 

as expected 

A_IM-12 Acquisition of embedded graphics within address

book entries. 

as expected 

A_IM-13 Acquisition of PIM data (i.e., datebook/calendar,

notes). 

as expected 

A_IM-14 Acquisition of maximum length PIM data. as expected 

October 2008 71 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

5.2.37 CFT-IM-07 (Motorola RAZR V3) 

Test Case CFT-IM-07 Guidance Software Neutrino Version 1.4.14 

Case CFT-IM-07 Acquire mobile device internal memory and review reported call

Summary: logs.

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-04 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall have the ability to present acquired

data elements in a human-readable format via either a preview-pane or

generated report.

A_IM-15 If a cellular forensic tool successfully completes acquisition of

the target device then all call logs (incoming/outgoing) shall be presented

in a human-readable format without modification. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Thu Apr 24 08:34:45 EDT 2008

Device: Motorola_RAZR_V3 

Source OS: WIN XP 

Setup: Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image 

October 2008 72 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

Test Case CFT-IM-07 Guidance Software Neutrino Version 1.4.14 

Image - Deleted

Video 

Video - Deleted 

Log Created By Neutrino Version 1.4.14

Highlights: Acquisition started: Thu Apr 24 08:34:45 EDT 2008

Acquisition finished: Thu Apr 24 08:45:46 EDT 2008 

Device connectivity was established via supported interface

Readability and completeness of acquired data was successful

All Call Logs (incoming, outgoing) were acquired 

Results: 

Analysis: Expected results achieved 

Assertion & Expected Result Actual 

Result 

A_IM-01 Device connectivity via supported interfaces. as expected

A_IM-04 Readability and completeness of acquired data via

supported reports. 

as expected 

A_IM-15 Acquisition of call logs. as expected 

October 2008 73 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

5.2.38 CFT-IM-08 (Motorola RAZR V3) 

Test Case CFT-IM-08 Guidance Software Neutrino Version 1.4.14 

Case CFT-IM-08 Acquire mobile device internal memory and review reported text

Summary: messages.

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-04 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall have the ability to present acquired

data elements in a human-readable format via either a preview-pane or

generated report.

A_IM-16 If a cellular forensic tool successfully completes acquisition of

the target device then all text messages (i.e., SMS, EMS) messages shall be

presented in a human-readable format without modification. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Thu Apr 24 09:10:31 EDT 2008

Device: Motorola_RAZR_V3 

Source OS: WIN XP 

Setup: Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image 

October 2008 74 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

Test Case CFT-IM-08 Guidance Software Neutrino Version 1.4.14 

Image - Deleted

Video 

Video - Deleted 

Log Created By Neutrino Version 1.4.14

Highlights: Acquisition started: Thu Apr 24 09:10:31 EDT 2008

Acquisition finished: Thu Apr 24 09:30:43 EDT 2008 

Device connectivity was established via supported interface

Readability and completeness of acquired data was successful

Partial Text messages were acquired 

Notes: 

EMS messages (messages over 160 characters) are not acquired or reported

either via the GUI or generated report. 

Results: 

Assertion & Expected Result Actual 

Result 

A_IM-01 Device connectivity via supported interfaces. as expected

A_IM-04 Readability and completeness of acquired data via

supported reports. 

as expected 

A_IM-16 Acquisition of text messages. Partial 

Analysis: Partial results achieved 

October 2008 75 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.39 CFT-IM-10 (Motorola RAZR V3) 

Test Case CFT-IM-10 Guidance Software Neutrino Version 1.4.14 

Case CFT-IM-10 Acquire mobile device internal memory and review reported standSummary: alone multi-media data (i.e., audio, graphics, video).

Assertions: A_IM-01 If a cellular forensic tool provides support for connectivity of

the target device then the tool shall successfully recognize the target

device via all vendor supported interfaces (e.g., cable, Bluetooth, IrDA).

A_IM-04 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall have the ability to present acquired

data elements in a human-readable format via either a preview-pane or

generated report.

A_IM-20 If a cellular forensic tool successfully completes acquisition of

the target device then all stand-alone audio files shall be playable via

either an internal application or suggested third-party application without

modification. 

A_IM-21 If a cellular forensic tool successfully completes acquisition of

the target device then all stand-alone image files shall be viewable via

either an internal application or suggested third-party application without

modification. 

A_IM-22 If a cellular forensic tool successfully completes acquisition of

the target device then all stand-alone video files shall be viewable via

either an internal application or suggested third-party application without

modification. 

Tester rpa

Name: 

Test Host: Morrisy

Test Date: Thu Apr 24 10:35:06 EDT 2008

Device: Motorola_RAZR_V3 

Source OS: WIN XP 

Setup: Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio 

October 2008 76 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

 

Test Case CFT-IM-10 Guidance Software Neutrino Version 1.4.14 

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Thu Apr 24 10:35:06 EDT 2008

Acquisition finished: Thu Apr 24 10:35:20 EDT 2008 

Device connectivity was established via supported interface

Readability and completeness of acquired data was successful

Audio files were not acquired

Image files were not acquired

Video files were not acquired 

Notes: 

Neutrino is not designed to acquire stand-alone files (i.e., audio,

graphics, video) for the Motorola RAZR V3. 

Results: 

Assertion & Expected Result Actual 

Result 

A_IM-01 Device connectivity via supported interfaces. as expected

A_IM-04 Readability and completeness of acquired data via

supported reports. 

as expected 

A_IM-20 Acquisition of stand-alone audio files. as expected

A_IM-21 Acquisition of stand-alone graphic files. as expected

A_IM-22 Acquisition of stand-alone video files. as expected 

Analysis: Expected results achieved 

October 2008 77 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

 

 

5.2.40 CFT-IMO-01 (Motorola RAZR V3) 

Test Case CFT-IMO-01 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-IMO-01 Acquire mobile device internal memory and review reported data

via supported generated report formats.

Assertions: A_IMO-38 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification via supported generated report formats. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu Apr 24 10:46:15 EDT 2008

Device: Motorola_RAZR_V3 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

October 2008 78 of 110 Results of Neutrino V1.4.14 8/2008 
 

Test Case CFT-IMO-01 Guidance Software Neutrino Version 1.4.14 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Thu Apr 24 10:46:15 EDT 2008

Acquisition finished: Thu Apr 24 10:49:02 EDT 2008 

Complete representation of known data via generated reports was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_IMO-38 Comparison of known device data elements via

generated reports. 

as expected 

Analysis: Expected results achieved 

October 2008 79 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

 

 

5.2.41 CFT-IMO-02 (Motorola RAZR V3) 

Test Case CFT-IMO-02 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-IMO-02 Acquire mobile device internal memory and review reported data

via the preview-pane.

Assertions: A_IMO-39 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification in a preview-pane view. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu Apr 24 10:50:13 EDT 2008

Device: Motorola_RAZR_V3 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log Created By Neutrino Version 1.4.14 

October 2008 80 of 110 Results of Neutrino V1.4.14 8/2008 
 

Test Case CFT-IMO-02 Guidance Software Neutrino Version 1.4.14 

Highlights: Acquisition started: Thu Apr 24 10:50:13 EDT 2008

Acquisition finished: Thu Apr 24 10:53:51 EDT 2008 

Complete representation of known data via preview-pane was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_IMO-39 Comparison of known device data elements via

preview-pane. 

as expected 

Analysis: Expected results achieved 

October 2008 81 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

 

5.2.42 CFT-IMO-03 (Motorola RAZR V3) 

Test Case CFT-IMO-03 Guidance Software Neutrino Version 1.4.14 

Case CFT-IMO-03 Acquire mobile device internal memory and compare reported data

Summary: via the preview-pane and supported generated reports.

Assertions: A_IMO-38 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification via supported generated report formats.

A_IMO-39 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification in a preview-pane view.

A_IMO-40 If a cellular forensic tool provides a preview-pane view and a

generated report of the acquired data then the reports shall maintain

consistency of all reported data elements. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu Apr 24 11:58:06 EDT 2008

Device: Motorola_RAZR_V3 

Source OS: WIN XP 

Setup: Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

October 2008 82 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

Test Case CFT-IMO-03 Guidance Software Neutrino Version 1.4.14 

Video - Deleted 

Log Created By Neutrino Version 1.4.14

Highlights: Acquisition started: Thu Apr 24 11:58:06 EDT 2008

Acquisition finished: Thu Apr 24 12:15:22 EDT 2008 

Complete representation of known data via generated reports was successful

Complete representation of known data via preview-pane was successful

Consistency between generated reports and preview-pane was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_IMO-38 Comparison of known device data elements via

generated reports. 

as expected 

A_IMO-39 Comparison of known device data elements via

preview-pane. 

as expected 

A_IMO-40 Compare generated reports and preview-pane views

for device acquisition. 

as expected 

Analysis: Expected results achieved 

October 2008 83 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

 

 

5.2.43 CFT-IMO-04 (Motorola RAZR V3) 

Test Case CFT-IMO-04 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-IMO-04 After a successful mobile device internal memory acquisition,

alter the case file via third party means and attempt to re-open the case.

Assertions: A_IMO-41 If modification is attempted to the case file or individual data

elements via third-party means then the tool shall provide protection

mechanisms disallowing or reporting data modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu Apr 24 12:52:40 EDT 2008

Device: Motorola_RAZR_V3 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

Video - Deleted 

Log Created By Neutrino Version 1.4.14 

October 2008 84 of 110 Results of Neutrino V1.4.14 8/2008 
 

Test Case CFT-IMO-04 Guidance Software Neutrino Version 1.4.14 

Highlights: Acquisition started: Thu Apr 24 12:52:40 EDT 2008

Acquisition finished: Thu Apr 24 12:59:44 EDT 2008 

Notification of modified case data was successful 

Notes: 

EnCase reports the following error when attempting to modify a case file:

Error in <filename>: Invalid data checksum 

Results: 

Assertion & Expected Result Actual Result 

A_IMO-41 Notification of modified device case data. as expected 

Analysis: Expected results achieved 

October 2008 85 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

 

5.2.44 CFT-IMO-10 (Motorola RAZR V3) 

Test Case CFT-IMO-10 Guidance Software Neutrino Version 1.4.14 

Case CFT-IMO-10 Perform a stand-alone mobile device internal memory acquisition

Summary: and review the status flags for text messages present on the SIM.

Assertions: A_IMO-38 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification via supported generated report formats.

A_IMO-39 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification in a preview-pane view.

A_IMO-55 If the cellular forensic tool supports stand-alone acquisition of

internal memory with the SIM present, then the contents of the SIM shall

not be modified during internal memory acquisition. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu Apr 24 13:39:19 EDT 2008

Device: Motorola_RAZR_V3 

Source OS: WIN XP 

Setup: Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

October 2008 86 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

Test Case CFT-IMO-10 Guidance Software Neutrino Version 1.4.14 

Video - Deleted 

Log Created By Neutrino Version 1.4.14

Highlights: Acquisition started: Thu Apr 24 13:39:19 EDT 2008

Acquisition finished: Thu Apr 24 13:40:54 EDT 2008 

Complete representation of known data via generated reports was not

successful 

Complete representation of known data via preview-pane was not successful

Stand-alone acquisition without disrupting SIM data was not successful 

Notes: 

When selecting "Acquire Logical Data" only, text messages present on the

SIM whose status is Unread is modified to "Read" after the internal memory

device logical Acquisition. 

"Acquire SIM Image" is NOT selected. 

Results: 

Assertion & Expected Result Actual 

Result 

A_IMO-38 Comparison of known device data elements via

generated reports. 

Partial 

A_IMO-39 Comparison of known device data elements via

preview-pane. 

Partial 

A_IMO-55 Stand-along acquisition without disrupting SIM

data. 

Not as 

expected 

Analysis: Expected results not achieved 

October 2008 87 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

 

5.2.45 CFT-IMO-11 (Motorola RAZR V3) 

Test Case CFT-IMO-11 Guidance Software Neutrino Version 1.4.14 

Case CFT-IMO-11 Acquire mobile device internal memory and review hash values for

Summary: vendor supported data objects.

Assertions: A_IMO-38 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification via supported generated report formats.

A_IMO-39 If a cellular forensic tool successfully completes acquisition of

the target device then the tool shall present the acquired data without

modification in a preview-pane view.

A_IMO-56 If the cellular forensic tool supports hashing for individual data

objects then the tool shall present the user with a hash value for each

supported data object. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Thu Apr 24 13:44:40 EDT 2008

Device: Motorola_RAZR_V3 

Source OS: WIN XP 

Setup: Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Address Book Entries 

Maximum Length

Regular Length, email, picture

Special Character

Blank Name 

Regular Length, Deleted email - deleted picture

Deleted Entry

Foreign Entry

PIM Data 

Maximum Length

Regular Length

Deleted Entry

Special Character

Call Logs 

Missed 

Missed - Deleted 

Incoming

Incoming - Deleted

Outgoing

Outgoing - Deleted

Text Messages 

Incoming SMS - Read

Incoming SMS - Unread

Incoming SMS - Deleted

Outgoing SMS

Outgoing SMS - Deleted

Incoming EMS - Read

Incoming EMS - Unread

Incoming Foreign EMS - Read 

Incoming EMS - Deleted

Outgoing EMS

Outgoing EMS - Deleted

MMS Messages 

Incoming Audio

Incoming Image

Incoming Video

Outgoing Audio

Outgoing Image

Outgoing Video

Stand-alone data files 

Audio 

Audio - Deleted 

Image

Image - Deleted

Video 

October 2008 88 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

Test Case CFT-IMO-11 Guidance Software Neutrino Version 1.4.14 

Video - Deleted 

Log Created By Neutrino Version 1.4.14

Highlights: Acquisition started: Thu Apr 24 13:44:40 EDT 2008

Acquisition finished: Thu Apr 24 13:46:14 EDT 2008 

Complete representation of known data via generated reports was successful

Complete representation of known data via preview-pane was successful

Device hash reporting for individual acquired data elements was successful 

Notes: 

Contacts, Text Messages (SMS, EMS) and Call Logs hash values are reported

via the GUI. 

Results: 

Assertion & Expected Result Actual 

Result 

A_IMO-38 Comparison of known device data elements via

generated reports. 

as expected 

A_IMO-39 Comparison of known device data elements via

preview-pane. 

as expected 

A_IMO-56 Device hash reporting for individual acquired

data objects. 

as expected 

Analysis: Expected results achieved 

October 2008 89 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.46 CFT-SIM-01 (AT&T SIM)

Test Case CFT-SIM-01 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIM-01 Acquire SIM over supported interfaces (e.g., PC/SC reader,

proprietary reader).

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader). 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Apr 23 08:07:29 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Wed Apr 23 08:07:29 EDT 2008

Acquisition finished: Wed Apr 23 08:21:51 EDT 2008 

Media connectivity was established via supported interface 

Results: 

Assertion & Expected Result Actual Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected 

Analysis: Expected results achieved 

October 2008 90 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.47 CFT-SIM-02 (AT&T SIM)

Test Case CFT-SIM-02 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIM-02 Attempt acquisition of a non-supported SIM. 

Assertions: A_SIM-24 If a cellular forensic tool attempts to connect to a non-supported

SIM then the tool shall have the ability to identify that the SIM is not

supported. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Apr 23 08:31:19 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Wed Apr 23 08:31:19 EDT 2008

Acquisition finished: Wed Apr 23 08:32:35 EDT 2008 

Identification of non-supported media was successful 

Results: 

Assertion & Expected Result Actual Result 

A_SIM-24 Identification of non-supported SIMs. as expected 

Analysis: Expected results achieved 

October 2008 91 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.48 CFT-SIM-03 (AT&T SIM)

Test Case CFT-SIM-03 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIM-03 Begin SIM acquisition and interrupt connectivity by interface

disengagement.

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-25 If a cellular forensic tool encounters disengagement between the

SIM reader and application then the application shall notify the user that

connectivity has been disrupted. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Apr 23 08:33:51 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Wed Apr 23 08:33:51 EDT 2008

Acquisition finished: Wed Apr 23 08:37:08 EDT 2008 

Media connectivity was established via supported interface

Media acquisition disruption notification was successful 

Results: 

Assertion & Expected Result Actual Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-25 Notification of SIM acquisition disruption. as expected 

Analysis: Expected results achieved 

October 2008 92 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.49 CFT-SIM-04 (AT&T SIM)

Test Case CFT-SIM-04 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIM-04 Attempt acquisition on a password-protected SIM. 

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-26 If the SIM is password-protected then the cellular forensic tool

shall provide the examiner with the opportunity to input the PIN before

acquisition. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Apr 23 08:37:51 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Wed Apr 23 08:37:51 EDT 2008

Acquisition finished: Wed Apr 23 08:50:55 EDT 2008 

Media connectivity was established via supported interface

Ability to enter PIN on protected media before acquisition was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-26 Password entry before acquisition for protected

SIMs. 

as expected 

Analysis: Expected results achieved 

October 2008 93 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.50 CFT-SIM-05 (AT&T SIM)

Test Case CFT-SIM-05 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIM-05 Acquire SIM internal memory and review reported data via the

preview-pane or generated reports for readability.

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-27 If a cellular forensic tool successfully completes acquisition of

the target SIM then the tool shall have the ability to present acquired

data in a human-readable format via either preview-pane or generated

report. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Apr 23 08:51:25 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Wed Apr 23 08:51:25 EDT 2008

Acquisition finished: Wed Apr 23 09:03:28 EDT 2008 

Media connectivity was established via supported interface

Readability and completeness of acquired data was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-27 Readability and completeness of acquired data via

supported reports. 

as expected 

Analysis: Expected results achieved 

October 2008 94 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.51 CFT-SIM-06 (AT&T SIM)

Test Case CFT-SIM-06 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIM-06 Acquire SIM internal memory and review reported subscriber and

equipment related information (i.e., SPN, ICCID, IMSI, MSISDN).

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-27 If a cellular forensic tool successfully completes acquisition of

the target SIM then the tool shall have the ability to present acquired

data in a human-readable format via either preview-pane or generated

report.

A_SIM-29 If a cellular forensic tool successfully completes acquisition of

the target SIM then the ICCID shall be presented in a human-readable format

without modification. 

A_SIM-30 If a cellular forensic tool successfully completes acquisition of

the target SIM then the IMSI shall be presented in a human-readable format

without modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Apr 23 09:54:56 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Wed Apr 23 09:54:56 EDT 2008

Acquisition finished: Wed Apr 23 10:10:39 EDT 2008 

Media connectivity was established via supported interface

Readability and completeness of acquired data was successful

ICCID was acquired

IMSI was acquired 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-27 Readability and completeness of acquired data via

supported reports. 

as expected 

A_SIM-29 Acquisition of ICCID. as expected

A_SIM-30 Acquisition of IMSI. as expected 

Analysis: Expected results achieved 

October 2008 95 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.52 CFT-SIM-07 (AT&T SIM)

Test Case CFT-SIM-07 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIM-07 Acquire SIM internal memory and review reported Abbreviated

Dialing Numbers (ADN).

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-27 If a cellular forensic tool successfully completes acquisition of

the target SIM then the tool shall have the ability to present acquired

data in a human-readable format via either preview-pane or generated

report.

A_SIM-32 If a cellular forensic tool successfully completes acquisition of

the target SIM then all Abbreviated Dialing Numbers (ADN) shall be

presented in a human-readable format without modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Apr 23 10:26:01 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Wed Apr 23 10:26:01 EDT 2008

Acquisition finished: Wed Apr 23 10:36:23 EDT 2008 

Media connectivity was established via supported interface

Readability and completeness of acquired data was successful

Regular length ADNs were acquired

Maximum Length ADNs were not acquired

Special Character ADNs were not acquired

Blank Name ADNs were acquired 

Notes: 

Maximum length ADNs (16 characters) were not acquired or reported

in either the GUI or generated report. 

Special character names (i.e., '@') were not displayed. 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-27 Readability and completeness of acquired data via

supported reports. 

as expected 

A_SIM-32 Acquisition of ADNs. Partial 

October 2008 96 of 110 Results of Neutrino V1.4.14 8/2008 
Test Case CFT-SIM-07 Guidance Software Neutrino Version 1.4.14 

Analysis: Partial results achieved 

October 2008 97 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.53 CFT-SIM-08 (AT&T SIM)

Test Case CFT-SIM-08 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIM-08 Acquire SIM internal memory and review reported Last Numbers

Dialed (LND).

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-27 If a cellular forensic tool successfully completes acquisition of

the target SIM then the tool shall have the ability to present acquired

data in a human-readable format via either preview-pane or generated

report.

A_SIM-33 If a cellular forensic tool successfully completes acquisition of

the target SIM then all Last Numbers Dialed (LND) shall be presented in a

human-readable format without modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Apr 23 10:37:58 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Wed Apr 23 10:37:58 EDT 2008

Acquisition finished: Wed Apr 23 10:46:56 EDT 2008 

Media connectivity was established via supported interface

Readability and completeness of acquired data was successful

LNDs were acquired 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-27 Readability and completeness of acquired data via

supported reports. 

as expected 

A_SIM-33 Acquisition of LNDs. as expected 

Analysis: Expected results achieved 

October 2008 98 of 110 Results of Neutrino V1.4.14 8/2008 
 

5.2.54 CFT-SIM-09 (AT&T SIM)

Test Case CFT-SIM-09 Guidance Software Neutrino Version 1.4.14 

Case CFT-SIM-09 Acquire SIM internal memory and review reported text messages

Summary: (i.e., SMS, EMS).

Assertions: A_SIM-23 If a cellular forensic tool provides support for connectivity of

the target SIM then the tool shall successfully recognize the target SIM

via all vendor supported interfaces (e.g., PC/SC reader, proprietary

reader).

A_SIM-27 If a cellular forensic tool successfully completes acquisition of

the target SIM then the tool shall have the ability to present acquired

data in a human-readable format via either preview-pane or generated

report.

A_SIM-34 If a cellular forensic tool successfully completes Acquisition of

the target SIM then all SMS text messages shall be presented in a humanreadable format without modification. 

A_SIM-35 If a cellular forensic tool successfully completes Acquisition of

the target SIM then all EMS text messages shall be presented in a humanreadable format without modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Apr 23 10:47:28 EDT 2008

Device: ATT_SIM 

Source OS: WIN XP 

Setup: Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log Created By Neutrino Version 1.4.14

Highlights: Acquisition started: Wed Apr 23 10:47:28 EDT 2008

Acquisition finished: Wed Apr 23 10:57:15 EDT 2008 

Media connectivity was established via supported interface

Readability and completeness of acquired data was successful

ALL text messages (SMS, EMS) were acquired 

Notes: 

Status flags for text messages are only displayed for deleted text

messages.

Read and unread status for text messages are not presented within the

GUI or generated report. 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIM-23 SIM connectivity via supported interfaces. as expected

A_SIM-27 Readability and completeness of acquired data via as expected

supported reports.

A_SIM-34 Acquisition of SMS messages. as expected

A_SIM-35 Acquisition of EMS messages. as expected 

October 2008 99 of 110 Results of Neutrino V1.4.14 8/2008 
 

Test Case CFT-SIM-09 Guidance Software Neutrino Version 1.4.14 

Analysis: Expected results achieved 

October 2008 100 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

 

5.2.55 CFT-SIMO-01 (AT&T SIM)

Test Case CFT-SIMO-01 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIMO-01 Acquire SIM internal memory and review acquired data via

suported generated report formats.

Assertions: A_SIMO-58 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Wed Apr 23 11:19:04 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Wed Apr 23 11:19:04 EDT 2008

Acquisition finished: Wed Apr 23 11:29:43 EDT 2008 

Complete representation of known data via generated reports was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIMO-58 Comparison of known SIM data elements via

generated reports. 

as expected 

Analysis: Expected results achieved 

October 2008 101 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.56 CFT-SIMO-02 (AT&T SIM)

Test Case CFT-SIMO-02 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIMO-02 Acquire SIM internal memory and review acquired data via the

preview-pane.

Assertions: A_SIMO-59 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Wed Apr 23 11:31:39 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Wed Apr 23 11:31:39 EDT 2008

Acquisition finished: Wed Apr 23 11:40:41 EDT 2008 

Complete representation of known data via preview-pane was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIMO-59 Comparison of known SIM data elements via

preview-pane. 

as expected 

Analysis: Expected results achieved 

October 2008 102 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.57 CFT-SIMO-03 (AT&T SIM)

Test Case CFT-SIMO-03 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIMO-03 Acquire SIM internal memory and compare acquired data via the

preview-pane and supported generated reports.

Assertions: A_SIMO-58 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats.

A_SIMO-59 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats.

A_SIMO-60 If a cellular forensic tool provides a preview-pane view and a

generated report of the acquired data then the reports shall maintain

consistency of all reported data elements. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Wed Apr 23 13:50:11 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Wed Apr 23 13:50:11 EDT 2008

Acquisition finished: Wed Apr 23 14:04:06 EDT 2008 

Complete representation of known data via generated reports was successful

Complete representation of known data via preview-pane was successful

Consistency between generated reports and preview-pane was successful 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIMO-58 Comparison of known SIM data elements via

generated reports. 

as expected 

A_SIMO-59 Comparison of known SIM data elements via

preview-pane. 

as expected 

A_SIMO-60 Compare generated reports and preview-pane views

for SIM acquisition. 

as expected 

Analysis: Expected results achieved 

October 2008 103 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.58 CFT-SIMO-04 (AT&T SIM)

Test Case CFT-SIMO-04 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIMO-04 After a successful SIM internal memory Acquisition, alter the

case file via third party means and attempt to re-open the case.

Assertions: A_SIMO-61 If modification is attempted to the case file or individual data

elements via third-party means then the tool shall provide protection

mechanisms disallowing or reporting data modification. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Apr 23 14:06:10 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Wed Apr 23 14:06:10 EDT 2008

Acquisition finished: Wed Apr 23 14:07:49 EDT 2008 

Notification of modified case data was successful 

Notes: 

EnCase reports the following error when attempting to modify a case file:

Error in <filename>: Invalid data checksum 

Results: 

Assertion & Expected Result Actual Result 

A_SIMO-61 Notification of modifed SIM case data. as expected 

Analysis: Expected results achieved 

October 2008 104 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.59 CFT-SIMO-05 (AT&T SIM)

Test Case CFT-SIMO-05 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIMO-05 Acquire SIM internal memory and review reports for recoverable

deleted data. 

Assertions: A_SIMO-58 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats.

A_SIMO-59 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats.

A_SIMO-62 If the cellular forensic tool successfully completes acquisition

of the target SIM and recoverable deleted SMS messages exist then the tool

shall present recoverable deleted data in a human-readable format without

modification. 

A_SIMO-63 If the cellular forensic tool successfully completes acquisition

of the target SIM and recoverable deleted EMS messages exist then the tool

shall present recoverable deleted data in a human-readable format without

modification. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Wed Apr 23 14:08:37 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Wed Apr 23 14:08:37 EDT 2008

Acquisition finished: Wed Apr 23 14:20:00 EDT 2008 

Complete representation of known data via generated reports was successful

Complete representation of known data via preview-pane was successful

Deleted SMS data was recovered 

Deleted EMS data was recovered 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIMO-58 Comparison of known SIM data elements via

generated reports. 

as expected 

A_SIMO-59 Comparison of known SIM data elements via

preview-pane. 

as expected 

A_SIMO-62 Recovery of deleted SMS messages. as expected

A_SIMO-63 Recovery of deleted EMS messages. as expected 

October 2008 105 of 110 Results of Neutrino V1.4.14 8/2008 
Test Case CFT-SIMO-05 Guidance Software Neutrino Version 1.4.14 

Analysis: Expected results achieved 

October 2008 106 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.60 CFT-SIMO-08 (AT&T SIM)

Test Case CFT-SIMO-08 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIMO-08 Begin acquisition on a PIN protected SIM to determine if the

tool provides an accurate count of the remaining number of PIN attempts and

if the PIN attempts are decremented when entering an incorrect value.

Assertions: A_SIMO-67 If a cellular forensic tool provides the examiner with the

remaining number of authentication attempts then the application should

provide an accurate count of the remaining PIN attempts. 

Tester Name: rpa

Test Host: Morrisy

Test Date: Wed Apr 23 14:33:20 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Wed Apr 23 14:33:20 EDT 2008

Acquisition finished: Wed Apr 23 14:42:46 EDT 2008 

Remaining number of PIN attempts properly displayed was successful 

Results: 

Assertion & Expected Result Actual Result 

A_SIMO-67 Display of remaining number of PIN attempts. as expected 

Analysis: Expected results achieved 

October 2008 107 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.61 CFT-SIMO-09 (AT&T SIM)

Test Case CFT-SIMO-09 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIMO-09 Begin acquisition on a SIM whose PIN attempts have been

exhausted to determine if the tool provides an accurate count of the

remaining number of PUK attempts and if the PUK attempts are decremented

when entering an incorrect value.

Assertions: A_SIMO-68 If a cellular forensic tool provides the examiner with the

remaining number of PUK attempts then the application should provide an

accurate count of the remaining PUK attempts. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Wed Apr 23 14:43:15 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Wed Apr 23 14:43:15 EDT 2008

Acquisition finished: Wed Apr 23 14:53:26 EDT 2008 

Remaining number of PUK attempts properly displayed was successful 

Results: 

Assertion & Expected Result Actual Result 

A_SIMO-68 Display of remaining number of PUK attempts. as expected 

Analysis: Expected results achieved 

October 2008 108 of 110 Results of Neutrino V1.4.14 8/2008 
 

 

5.2.62 CFT-SIMO-10 (AT&T SIM)

Test Case CFT-SIMO-10 Guidance Software Neutrino Version 1.4.14 

Case 

Summary: 

CFT-SIMO-10 Acquire SIM internal memory and review hash values for vendor

supported data objects.

Assertions: A_SIMO-58 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats.

A_SIMO-59 If a cellular forensic tool successfully completes acquisition of

the target media (i.e., SIM) then the tool shall present the acquired data

in a human-readable format without modification via supported generated

report formats.

A_SIMO-69 If the cellular forensic tool supports hashing for individual

data objects then the tool shall present the user with a hash value for

each supported data object. 

Tester 

Name: 

rpa 

Test Host: Morrisy

Test Date: Wed Apr 23 14:53:48 EDT 2008

Device: ATT_SIM 

Source 

Setup: 

OS: WIN XP 

Interface: USB 

DATA OBJECTS DATA ELEMENTS 

Abbreviated Dialing Numbers (ADN) 

Maximum Length

Special Character

Blank Name 

Regular Length - Deleted Number

Foreign Entry

Call Logs 

Last Numbers Dialed (LND)

Text Messages 

Incoming SMS - Read

Incoming SMS - Foreign

Incoming SMS - Deleted

Incoming SMS - Unread

Incoming Foreign EMS - Read

Incoming EMS - Deleted 

Log

Highlights: 

Created By Neutrino Version 1.4.14

Acquisition started: Wed Apr 23 14:53:48 EDT 2008

Acquisition finished: Wed Apr 23 15:08:59 EDT 2008 

Complete representation of known data via generated reports was successful

Complete representation of known data via preview-pane was successful

Device hash reporting for individual acquired data elements was successful 

Notes: 

Contacts (ADNs), Text Messages (SMS, EMS) and Call Logs (LND) hash

values are reported via the GUI. 

Results: 

Assertion & Expected Result Actual 

Result 

A_SIMO-58 Comparison of known SIM data elements via

generated reports. 

as expected 

A_SIMO-59 Comparison of known SIM data elements via

preview-pane. 

as expected 

A_SIMO-69 SIM hash reporting for individual acquired data

objects. 

as expected 

Analysis: Expected results achieved 

October 2008 109 of 110 Results of Neutrino V1.4.14 8/2008 
October 2008 110 of 110 Results of Neutrino V1.4.14 8/2008 
About the National Institute of Justice 

NIJ is the research, development, and evaluation agency of the U.S. Department of Justice. NIJ’s 

mission is to advance scientific research, development, and evaluation to enhance the administration of justice and public safety. NIJ’s principal authorities are derived from the Omnibus 

Crime Control and Safe Streets Act of 1968, as amended (see 42 U.S.C. §§ 3721–3723). 

The NIJ Director is appointed by the President and confirmed by the Senate. The Director establishes the Institute’s objectives, guided by the priorities of the Office of Justice Programs, the 

U.S. Department of Justice, and the needs of the field. The Institute actively solicits the views of 

criminal justice and other professionals and researchers to inform its search for the knowledge 

and tools to guide policy and practice. 

Strategic Goals 

NIJ has seven strategic goals grouped into three categories: 

Creating relevant knowledge and tools 

1. Partner with State and local practitioners and policymakers to identify social science research 

and technology needs. 

2. Create scientific, relevant, and reliable knowledge—with a particular emphasis on terrorism, 

violent crime, drugs and crime, cost-effectiveness, and community-based efforts—to enhance 

the administration of justice and public safety. 

3. Develop affordable and effective tools and technologies to enhance the administration of 

justice and public safety. 

Dissemination 

4. Disseminate relevant knowledge and information to practitioners and policymakers in an 

understandable, timely, and concise manner. 

5. Act as an honest broker to identify the information, tools, and technologies that respond to 

the needs of stakeholders. 

Agency management 

6. Practice fairness and openness in the research and development process. 

7. Ensure professionalism, excellence, accountability, cost-effectiveness, and integrity in the 

management and conduct of NIJ activities and programs. 

Program Areas 

In addressing these strategic challenges, the Institute is involved in the following program areas: 

crime control and prevention, including policing; drugs and crime; justice systems and offender 

behavior, including corrections; violence and victimization; communications and information 

technologies; critical incident response; investigative and forensic sciences, including DNA; lessthan-lethal technologies; officer protection; education and training technologies; testing and 

standards; technology assistance to law enforcement and corrections agencies; field testing of 

promising programs; and international crime control. 

In addition to sponsoring research and development and technology assistance, NIJ evaluates 

programs, policies, and technologies. NIJ communicates its research and evaluation findings 

through conferences and print and electronic media. 

To find out more about the National 

Institute of Justice, please visit: 

http://www.ojp.usdoj.gov/nij 

or contact: 

National Criminal Justice 

Reference Service 

P.O. Box 6000 

Rockville, MD 20849–6000 

800–851–3420 

http://www.ncjrs.gov