The following requirements define the essential elements of a mobile acquisition tool:
MDT-CR-01. A mobile device forensic tool extracts and presents all supported data artifacts from a mobile device image file.
MDT-CA-01. The tool presents all subscriber and equipment information available from an
image file.
MDT-CA-02. The tool presents all PIM (address book, calendar & notes) data available
from an image file.
MDT-CA-03. The tool presents all call data (call type (incoming, outgoing, missed), date359 time stamps, duration) available from an image file.
MDT-CA-04. The tool presents all message (SMS, MMS & instant messages) data
available from an image file.
MDT-CA-05. The tool presents all stand-alone (audio, documents, graphic & video) files
available from an image file.
MDT-CA-06. The tool presents all browsing (history & bookmarks) data available from an
image file.
MDT-CA-07. The tool presents all email data available from an image file.
MDT-CA-08. The tool presents all social media application data available from an image file.
MDT-CA-09. The tool presents all geo-location application data available from an image file.
MDT-CR-02. The tool renders text correctly.
MDT-CA-10. Presented text is rendered with the correct character glyphs.
MDT-CR-03. A mobile device forensic tool does not modify a mobile device image file being examined.
MDT-CA-11. The tool does not modify an image file.
MDT-CR-04. A mobile device forensic tool notifies the tool user if a mobile device image file has been modified.
MDT-CA-12. If an image file is modified, the tool notifies the user that a change has been made to the image file.
Post your comment on this topic.