Tangential equipment includes devices that contain memory and are associated with a mobile device. The three main categories are memory cards, host computers to which a mobile device has synchronized its contents, and cloud-based storage.
Smartphones may provide an interface that supports removable media (e.g., microSD or MMC) containing significant amounts of data. Memory cards are typically flash memory, used as auxiliary user file storage or to convey files to and from the device. Data may be acquired with the use of a write-blocked media reader and a forensic application.
The data contained on a mobile device is often present on a personal computer due to the capability of mobile devices to synchronize or otherwise share information among one or more host computers. Such personal computers or workstations are referred to as synched devices. Because of synchronization, a significant amount of data on a mobile device may be present on the owner’s laptop or personal computer and recovered using a conventional computer forensic tool for hard drive acquisition and examination.
Post your comment on this topic.