The acquisition is the process of imaging or otherwise obtaining information from a mobile device and its associated media. Performing an acquisition at the scene has the advantage that loss of information due to battery depletion, damage, etc., during transportation and storage is avoided. Unlike a laboratory setting, off-site acquisitions create challenges in finding a controlled setting in which to work with the appropriate equipment while satisfying additional prerequisites. For this discussion, a laboratory environment is assumed throughout this chapter.

The forensic examination begins with the identification of the mobile device. The type of mobile device, its operating system, and other characteristics determine the route to take in creating a forensic copy of the device’s contents. The type of mobile device and data to be extracted generally dictates which tools and techniques to use in an investigation.


Was this helpful?

Yes No
You indicated this topic was not helpful to you ...
Could you please leave a comment telling us why? Thank you!
Thanks for your feedback.

Post your comment on this topic.

Post Comment