Crime Smartphones have digital evidence of crime and need to be
analyzed. The rapid development of Smartphone technology has brought changes.
On Smartphone devices currently there is Internal storage as a smartphone storage
medium, because Internal storage technology has fast data access speeds.
Smartphone technicians often use Smartphone freezer software, as it can save
maintenance costs. This software is used to protect the Smartphone from unwanted
changes, the Smartphone system that implants the software makes changes that occur
to the Smartphone system not stored on the storage media after the Smartphone is
deleted data. When this happens what should a digital forensic investigator do. This
study discusses the comparison regarding the forensic tools used for the examination
and analysis process. Taking copies of digital evidence is carried out using the static
forensic method, while the research and analysis stages adapt and implement the
forensic methods of the National Institute of Justice (NIJ) to obtain digital evidence.
Drive freeze software such as Shadow Defender has proven to be influential in the
practice of digital forensic examination of obtaining digital evidence, with these
conditions the percentage of success in restoring files is only 75% so that it can
become an obstacle in the digital forensic process.