Cellebrite exits Chinese market
Struggle to stay up to date
Varied mobile phones market
Data regulations complicate data collection procedure
Comment
Mobile forensics, as a new subset of digital forensics, has been a popular topic in recent years due to various eDiscovery cases. This is because mobile forensics can help provide digital evidence or relevant data directly and effectively in litigation or investigation-related scenarios. Mobile data often serves as the key to crack the code; this is especially true in some internal investigations. However, collecting and analysing mobile data in China is not as simple as it would seem.
Cellebrite exits Chinese market
Cellebrite, one of the global software providers in forensics analysis, is best known for its simple and intuitive flagship product series, which allow extraction and analysis of data from mobile devices, such as smartphones and tablets. However, on 7 October 2020, due to regulatory changes in the United States, Cellebrite announced that it would stop selling its digital information software and services to customers in Hong Kong and China, effective immediately. This was a significant blow to eDiscovery service providers and brought disruption to the Chinese market.
Had global vendors like Cellebrite remained in the Chinese market, their well-known forensics tools would not always have been up to date, given the frequent upgrade of Chinese mobile applications.
For example, WeChat (the most popular instant messaging app in China) has been upgrading its instant messaging databases and storage schemes with the past few releases, but none of the global mainstream forensic tools are able to perfectly analyse and parse WeChat databases. This is probably because, while mainly dealing with the global market, mainstream forensic tools focus more on changes of international popular instant messaging applications (eg, WhatsApp) rather than on the Chinese market. Therefore, it is becoming gradually more difficult to use mainstream forensics tools to collect and analyse mobile data within China, especially for the WeChat chat history.
There are various mobile phone brands in China's cellular market. In addition to the iPhone (which is still popular with the public), Android phones (eg, Huawei, Oppo and Xiaomi) occupy a relatively high market share. Each phone manufacturer uses a different Android-based operating system and has its own unique user interface style and personalisation to suit the needs of different consumers. Therefore, in the process of collecting and analysing the mobile data, it is not possible to use one method to deal with all mobile phones, but rather one must adapt to various scenarios and use different methods.
Data regulations complicate data collection procedure
The Chinese Data Security Law and Personal Information Protection Law were launched on 1 September and 1 November in 2021, respectively. With the new regulations in place, people are beginning to pay more attention to data privacy and data protection, especially with regard to personal information. In most data collections where people use personal phones for business purposes, there is no easy way for forensics tools to completely segregate company data from personal data. Hence, certain measures must be taken to ensure the collection procedure complies with local regulations.
Applying mobile forensics in today's market is a significant challenge for Chinese phone manufacturers, but, despite these objective obstacles and practical barriers, there has been a rise of local forensic software suppliers and their advancement in domestic application analysis. Moreover, with the accumulation of experience in using mobile forensics, eDiscovery service providers have also gained a deeper understanding of how to adopt different data processing methods in different cases. The future looks promising for mobile forensics in China.
For further information on this topic please contact Jewel Zhu at AlixPartners by telephone (+8621 6171 7555) or email ([email protected]). The AlixPartners website can be accessed at www.alixpartners.com.