Sections 4 through 7 describe the forensics process as it applies to mobile devices. Evidence preservation is the process of securely maintaining custody of property without altering or changing the contents of data that reside on devices and removable media. It is the first step in digital evidence recovery. The chapter begins with a general introduction to the preservation and provides more specific guidance about dealing with mobile devices.

Preservation involves the search, recognition, documentation, and collection of electronic-based evidence to use evidence successfully; whether in a court of law or a less formal proceeding, preseve all evidence. Failure to preserve evidence in its original state could jeopardize an entire investigation, potentially losing valuable case-related information.

The remaining sections of this chapter provide supplemental information related to mobile devices, following the paradigm of Securing and Evaluating the Scene, Documenting the Scene, Isolation, Packaging, Transporting, and Storing Evidence, and Triage/On-Site Processing.


Was this helpful?

Yes No
You indicated this topic was not helpful to you ...
Could you please leave a comment telling us why? Thank you!
Thanks for your feedback.

Post your comment on this topic.

Post Comment