Information Technology Reference
In-Depth Information
The document and reporting phase
The forensic examiner is required to document throughout the examination process in the
form of contemporaneous notes relating to what was done during the acquisition and exam-
ination. Once the examiner completes the investigation, the results must go through some
form of peer-review to ensure the data is checked and the investigation is complete. The
examiner's notes and documentation may include information such as the following:
• Examination start date and time
• The physical condition of the phone
• Photos of the phone and individual components
• Phone status when received—turned on or off
• Phone make and model
• Tools used for the acquisition
• Tools used for the examination
• Data found during the examination
• Notes from peer-review
