The acquisition is the process of imaging or otherwise obtaining information from a mobile device and its associated media. Performing an acquisition at the scene has the advantage that loss of information due to battery depletion, damage, etc., during transportation and storage is avoided. Unlike a laboratory setting, off-site acquisitions create challenges in finding a controlled setting in which to work with the appropriate equipment while satisfying additional prerequisites. For this discussion, a laboratory environment is assumed throughout this chapter.
The forensic examination begins with the identification of the mobile device. The type of mobile device, its operating system, and other characteristics determine the route to take in creating a forensic copy of the device’s contents. The type of mobile device and data to be extracted generally dictates which tools and techniques to use in an investigation.
Post your comment on this topic.