Recognising a Windows handheld
The ASUS ROG Xbox Ally looks like a handheld games console, but runs Windows 11. For a forensic examiner, that distinction matters: the operating system, applications and storage may have more in common with a laptop than the device’s appearance suggests.
RHEM Labs is examining the Xbox Ally as part of an active research program on modern Windows handheld PCs. The aim is to develop a repeatable method for recognising, acquiring and examining this class of device.
The question arose from casework involving child exploitation material. The research has a broader focus: how device classification affects forensic examination.
Establishing the baseline
We acquired the Xbox Ally’s internal NVMe storage using FTK Imager before completing normal Windows first-boot setup. The acquisition was verified and a directory listing generated before the device was reassembled and configured.
The research device with its internal NVMe storage removed and connected to an external adapter.
This factory-state acquisition provides a baseline for controlled experiments. By recording known activities and comparing subsequent acquisitions, we can investigate which changes are attributable to those activities.
Work underway
The literature review, device-plausibility assessment and platform preparation are complete. Controlled experiments are the current phase, with artefact mapping and validation to follow.
Planned activities include browsing, downloading, viewing local media, using communications and cloud services, deleting files and connecting removable storage. Power states, encryption and live evidence also raise questions for acquisition.
The program will test expectations about Windows and gaming-platform artefacts rather than assume that familiar records behave in the same way on this device. Findings will be reported after experimental validation, with substantive results reserved for research publication.
Related research
Eichhorn, Schneider and Pugliese’s 2024 Steam Deck study, presented at DFRWS EU, used differential forensic analysis to examine SteamOS and the Steam client. It provides relevant prior work for investigating a different handheld platform running Windows.
Contact RHEM Labs about this research.