ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Microsoft PocketPC

From ForensicsWiki
Revision as of 12:25, 7 February 2006 by Sledz (Talk | contribs) (Just a little grammar edit for now.)

Jump to: navigation, search


A "PocketPC" is commonly referred to as a small-scale (hand-held) computer that runs Microsoft’s PocketPC/Windows Mobile software. As an operating system, Microsoft PocketPC, sometimes referred to as P/PC or PPC, is based upon the Windows CE framework. There are a few variants of this OS, namely "PocketPC 2000," "PocketPC 2002," "Windows Mobile 2003 (and Windows Mobile 2003 SE)," and the latest, "Windows Mobile 5.0.” Additional variants exist for SmartPhones, such as Windows Mobile 2003 Smartphone edition. The PDA version of the operating system can often be found in such devices as the Compaq iPaq, HP Jornada, and Dell Axim. Some popular features of PocketPC devices are their inclusion of "mobile" versions of such office software as Microsoft Word, Excel, and PowerPoint. Additionally, using Microsoft's ActiveSync program as a companion, a PocketPC-based device can "synch" with a parent computer. In this way, the PocketPC device can easily hold such data items as Microsoft Outlook contacts and appointments, as well as mobile versions of Word and Excel documents.

In 2001, PDAs with Palm OS installed enjoyed a market share of about 72 percent, while PocketPC held a meager 15 percent. However, by the fourth quarter of 2004, Microsoft PocketPC and Palm OS were practically tied. With sales of Palm OS devices down, PocketPC-based devices had a market share of 40.2 percent to Palm's 40.7 percent. This is evidence of the growing popularity of PocketPC-based devices, and thus the increased likeliness one will encounter such a device "in the field."


The PocketPC operating system began as Windows CE in November of 1996. The NEC MobilePro 200 and the Casio A-10 were the first two PDA-type devices available with this early version of the operating system. From here, Windows CE continued in development through versions 2 (with such devices as the MD Elan SC400, DEC SA1100, Hitachi SuperH 3, NEC VR4101, Philips DR 31500, and the Toshiba TX3912).

PocketPC Variants

As previously noted, there exist many variants of the PocketPC operating system. Below are a summary of each.

PocketPC 2000

PocketPC 2002

Windows Mobile 2003/SE

Windows Mobile 5.0

Windows Mobile 5.0, based off of Windows CE 5.0, was released on May 10, 2005. Windows Mobile 5.0 brought many changes to the PocketPC landscape. For one, with this release, the phone and PDA versions of the OS have merged into one encompassing OS, instead of two separate versions of the same one. Additionally, while past versions of PocketPC software utilized the RAM of a PDA for program and data storage, Windows Mobile 5.0 uses a PDA's hardware more like a traditional computer. The operating system and user data is stored in the more persistent ROM of the device, and RAM is used in a way more similar to that of a desktop PC. This has implications for forensics, as data stored on these devices is now less volatile.

Pocket PC Devices


The History of Microsoft Windows CE

Palm vs. Pocket PC-The Great Debate

Gartner: Windows CE ties Palm