Sections 4 through 7 describe the forensics process as it applies to mobile devices. Evidence preservation is the process of securely maintaining custody of property without altering or changing the contents of data that reside on devices and removable media. It is the first step in digital evidence recovery. The chapter begins with a general introduction to the preservation and provides more specific guidance about dealing with mobile devices.
Preservation involves the search, recognition, documentation, and collection of electronic-based evidence to use evidence successfully; whether in a court of law or a less formal proceeding, preseve all evidence. Failure to preserve evidence in its original state could jeopardize an entire investigation, potentially losing valuable case-related information.
The remaining sections of this chapter provide supplemental information related to mobile devices, following the paradigm of Securing and Evaluating the Scene, Documenting the Scene, Isolation, Packaging, Transporting, and Storing Evidence, and Triage/On-Site Processing.
Post your comment on this topic.