Image File Creation

The following requirements and test assertions only apply if a mobile device forensic tool supports the acquisition of a supported mobile device.

MDT-RO-01. A mobile device forensic tool creates an image file from a physical memory acquisition (e.g., boot loader).

MDT-AO-01. An image file is created of physical memory.

MDT-RO-02. A mobile device forensic tool creates an image file from a logical acquisition of all supported memory artifacts.

MDT-AO-02. An image file is created containing supported memory artifacts.

MDT-RO-03. A mobile device forensic tool creates an image file from a logical acquisition of selected memory artifacts.

MDT-AO-03. An image file is created containing selected artifacts.

MDT-RO-04. A mobile device forensic tool creates an image file from an acquisition of the mobile device file system.
MDT-AO-04. An image file is created of the device file system.

MDT-RO-05. A mobile device forensic tool notifies the user if there is a failure to access a connected mobile device.

MDT-AO-05. The user is notified if the tool fails to establish a connection or acquire data
from a connected mobile device.

MDT-RO-06. A mobile device forensic tool notifies the user if an acquisition is interrupted before completion.

MDT-AO-06. The user is notified if an acquisition is disrupted.