Event Reconstruction of Indonesian E-Banking Services on Windows Phone Devices

In this paper, a digital investigation of electronic (e)-banking services on the Windows Phone platform of nine Indonesian banks is undertaken. In the experiments, banking transactions (balance check, funds transfer and phone credit purchase) are performed using a Nokia Lumia 625. The digital evidence resulting from these transactions is acquired and analyzed using mobile forensic tools from Cellebrite and Micro Systemation AB. In order to reconstruct the transaction events, evidence objects are identified and related events are sequenced. Specifically, the findings relating to mobile banking activities identify eight digital evidence objects (SMS, email, call log, contact, media file, network packets, location and installed apps), and a physical object (account book - obtained from a physical investigation). Investigation questions of who, what, when and how are answered from the acquired evidence and the event sequence diagrams. The findings contribute to a better understanding of available mobile banking evidence on Windows Phone devices.