Information Technology Reference
In-Depth Information
The processing phase
Once the phone has been isolated from the communication networks, the actual processing
of the mobile phone begins. The phone should be acquired using a tested method that is re-
peatable and is as forensically sound as possible. Physical acquisition is the preferred meth-
od as it extracts the raw memory data and the device is commonly powered off during the
acquisition process. On most devices, the least amount of changes occur to the device dur-
ing physical acquisition. If physical acquisition is not possible or fails, an attempt should be
made to acquire the file system of the mobile device. A logical acquisition should always
be obtained as it may contain only the parsed data and provide pointers to examine the raw
memory image.
