Special Pu blicatio n 800 -72 Sponsored by the Depa rtment of Homelan d Security Guidelines on PD A Forensics Recommendations of the National Institute of Standards and T echnology Wayne Jansen Rick A yers NIST Special Public ation 800-72 C O M P U T E R S E C U R I T Y Com puter Security Division Inform ation Technology Laboratory National Institute of St andards and Technology Gaithersburg, MD 20899-8930 Novem ber 2004 U.S. Department of Commerce Donald L. Evans, Sec retary Technology Administration Phillip J. Bond, Under Secretary for Tech nology Nation al Institute of Stan dards and Technolog y Arden L. Bem ent, Jr., Director Guidelines on PDA Forensics Recomm endati ons of the National Institute of Standards and Technology Wayne Janse n Rick Ayers Reports on Compute r Systems Technology The Inf ormation Te chno logy Laboratory (ITL) at the Nation al Instit ute of Standards a nd Technol ogy (NIST) promotes the U.S. econo my and public welfare by providin g technic al leadership fo r the Nation ’s measure ment and st andards inf rastructure. ITL develop s tests, tes t methods, ref erence dat a, proof of c oncept im plementatio ns, and technic al analysis to advance the deve lopm ent and productiv e use of inform ation technol ogy. ITL’s res ponsibi lities include t he develo pment of tech nical, p hysical, adminis trative, and m anageme nt standards and guide lines for t he cost-eff ective security and privacy of sens itive uncl assif ied inf ormation in Federal co mputer systems. This Special Publicati on 800-serie s reports on IT L’s researc h, guidanc e, and outreach ef forts in co mputer sec urity and its collab orative acti vities with industry, government , and a cade mic organ izations. Certai n commercial en tities, eq uipment, or materials m ay be identified in t his document in order to describe an experimental pro cedure or concept adequately. Su ch iden tification is not intended to imply reco mmendation or endorsement by the National Institu te of Stand ards and Techno logy, nor is it intended to imply that the entities, m aterials, or equipment are necessa rily the best a vailable for the purpose . National Institute of Standards and Technolog y Special Publication 800-72 Natl. Inst . Stand. Techno l. Spec. Publ. 800-72 , 67 pages (2004 ) Acknowledgements The authors, W ayne Jansen and R ick Ayers fr om NIST wish to expr ess the ir thanks to colleagues w ho reviewed drafts of this docum ent. In partic ular, their ap preciation goe s to Murug iah So uppaya and Tim Grance from NIST , Karen K ent from Booz-Allen -Ham ilton, Barry Grundy from NASA – Office of Inspector Genera l, Rick Mislan from Ferris State University, Joe Grand from Grand Idea Studio , and Eoghan C asey from Knowledge Solutions LLC for their research, technica l support, and w ritten contribu tions to this doc ument. The authors would also lik e to express thanks to all others who assisted wi th our review process, including Susan Ballou from NIST’s Office of Law Enforcem ent Standards and those individuals who contributed input during the public comm ent period. This work w as sponsored by th e Departm ent of Hom eland Secu rity (DHS), whose su pport and guidance in this effo rt are greatly appreciated. Guidelines on PDA Forensics Table of Contents TABLE OF C ONTENTS ............................................................................................................. V LIST OF FIGURES ................................................................................................................ ....VII LIST OF TABLES ................................................................................................................. ...VIII EXECUTIVE SUMMARY....................................................