WEST LAFAYETTE — Purdue University professor Dongyan Xu was looking at his text messages. His bank transactions. His contact list. Everything he had opened on his smartphone in the past five minutes.
Except Xu wasn't looking at his phone.
Even after he signed out and closed several applications, RetroScope used his phone's volatile memory, or RAM, to re-create the screens that flashed before his eyes as he talked to friends or took care of his banking.
"I was personally surprised by that," said Xu, part of a Purdue research team that developed the new technology, which will be presented Friday during the USENIX Security Symposium in Austin, Texas. "I couldn’t believe the amount of information that we were able to recover. Honestly, we were expecting less."
The Purdue team is heralding RetroScope as the "new frontier" in smartphone forensics, a growing field in law enforcement as mobile devices become a rich source of evidence. The technology allows police to simply plug in an Android phone and recover up to 11 screens per application rather than a series of bits and bytes, said Brendan Saltaformaggio, a Ph.D. student and lead author of the team's research paper.