Windows Phone is a proprietary mobile operating system developed by Microsoft. It was launched as a successor to Windows Mobile, but it does not provide backward compatibility with the previous platform. Windows Phone was launched in October 2010 with Windows Phone 7. The version history of the Windows Phone operating system then continued with the release of Windows Phone 7.5, Windows Phone 7.8, Windows Phone 8.1, and Windows Phone 10. 

Despite the fact that Microsoft claims they have stopped developing this mobile operating system, excluding security patches, you are likely to face it as a mobile forensic examiner.

The following sections will provide more details about Windows Phone, its features, and its underlying security model.

Unlike Android and iOS devices, Windows Phone comes with a new interface, which uses so-called tiles for apps instead of icons, as shown in the following image. These tiles can be designed and updated by the user:

Similar to other mobile platforms, Windows Phone allows for the installation of third-party apps. These apps can be downloaded from the Windows Phone Marketplace, which is managed by Microsoft. When comparing the number of apps available for iOS and Android devices, Windows Phone pales in comparison. However, applications are available and you should expect to see them on Windows Phone devices.

Windows Phone introduced new features, making it more similar to other smartphones compared to Windows Mobile:

• Cortana: This is the personal assistant for the device. It was introduced in Windows 8.1 and is still present on Windows 10 devices. Cortana aids the user by fielding questions using Bing, setting reminders, sending texts, and essentially using all the functionality to provide the user with a better and easier experience. Everything that Cortana does leaves a trace on the device.
• Wallet: This stores credit card accounts, boarding passes, tickets, coupons, and more.
• Geofence and advanced location settings: These provide the user with additional protection as the phone can detect when it is out of a trusted zone and may lock itself.
• Additional features: These are features such as live tiles, enhanced colors, and quiet hours.

Other common applications associated with Windows Phone include OneDrive (formerly SkyDrive), OneNote, and Office 365 synchronization. OneDrive provides the user with access to all of their documents and files from any device. OneNote is essentially the same, but it acts as a notebook or diary. Office 365 provides the user with constant access to their email, calendar, contacts, and more across multiple devices.

The introduction of data synchronization across multiple devices makes our job as forensic examiners difficult. It is our job to determine how the evidence was placed on the device. Is it possible to definitively state how an artifact was placed on a device? To be honest, this depends. Nobody wants to hear this response, but a lot of factors must be considered. What is the app? What OS is running on the device? What is the artifact? For example, let's consider OneDrive. If the device contains documents from OneDrive, the original author should be contained within the metadata. This, together with examining whether or not the content was shared with the device, may provide a glimpse into how the artifact was created. However, when examining a calendar entry when Office 365 is in place, it may be impossible to state whether the user created the entry on their phone, PC, or laptop. The synchronization is instantaneous, and status flags stating where the artifact was created do not always exist. If this artifact is indeed the smoking gun of the investigation, you need to apply your skills to uncover other artifacts that support your findings. Digging deeper into the data is required. Now that we are aware of the details of Windows Phone and its features, let's have a look at its security model and see how it keeps the data secure.