Overview
Mobile devices can contain communications, application records, photographs, documents, timestamps, account data, and other artifacts. Available data depends heavily on the device, operating system, security configuration, acquisition method, and legal authority.
Common reasons clients request this service
- Messages or application data relevant to a matter
- Device usage and activity questions
- Preservation before a phone is replaced, wiped, or returned
- Review of supported photographs, files, and device artifacts
- Technical assistance interpreting a mobile forensic extraction
What the engagement can include
▯
Device Assessment
Identify device model, condition, security state, and available acquisition options.
◫
Preservation
Use an appropriate supported preservation or acquisition workflow.
⌕
Focused Analysis
Analyze relevant data categories based on the questions defined in scope.
The appropriate forensic method depends on the device, account, legal authority, technical condition, and objectives of the matter. Scope is confirmed before work begins.