MOBILE FORENSICS

Forensic analysis of Android NFC artefacts

Near Field Communication (NFC) is used on Android for, amongst other things, contactless payments, reading NFC tags and communicating with compatible devices. Depending on the device and its configuration, this may result in the creation of artefacts of forensic relevance.

NFC configurations
NFC function activation status
Device and pairing information
NFC tags and recognised data records (where available)
Information on contactless services
Timestamps and metadata
System logs
Features specific to the manufacturer and version

TECHNICAL BACKGROUND

Technical Fundamentals

Android stores various pieces of information relating to NFC usage in system-level configuration files and other artefacts.

Areas of forensic relevance include, amongst others:

  • •NFC configurations
  • •NFC function activation status
  • •Device and pairing information
  • •NFC tags and recognised data records (where available)
  • •Information on contactless services
  • •Timestamps and metadata
  • •System logs
  • •Features specific to the manufacturer and version

The information available depends on the version of Android, the device manufacturer and actual usage.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Following a suitable forensic data backup, NFC-related configuration files, system artefacts and logs are examined using recognised IT forensic tools and manual analysis. The results are correlated with timestamps, system settings and other technical artefacts. All stages of the investigation are documented in a reproducible manner.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔Was NFC enabled?
  • ✔Is there any evidence of NFC being used?
  • ✔Which devices or tags were detected?
  • ✔What system artefacts are present?
  • ✔How reliable is the available data?

LIMITATIONS & CONCLUSION

What you should know

Not every NFC interaction leaves behind traces that can be analysed in the long term. The availability and scope of these traces depend on the device, the version of Android, the apps and the specific usage scenarios.

The analysis of NFC artefacts can assist in reconstructing the device configuration and specific usage scenarios. To draw reliable conclusions, all available technical artefacts must be assessed collectively.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to have NFC artefacts from an Android device professionally examined? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

Is NFC relevant from a forensic perspective?
Yes. Depending on the circumstances, configuration and usage artefacts can provide important clues.
Can contactless payments be verified?
Depending on the data source, technical notes may be available; it is not possible to make a general statement.
Are NFC tags read?
Provided that such artefacts exist, yes.
Do NFC artefacts vary depending on the manufacturer?
Yes. Storage locations and data structures vary.
Could an expert report be drawn up on this matter?
Yes. The results are documented in a transparent manner and assessed from a technical perspective.