Information Technology Reference
In-Depth Information
Documenting all changes
It's important to document the entire recovery process, including all the changes made dur-
ing the acquisition and examination. For example, if the forensic tool used for the data ex-
traction sliced up the disk image to store it, this must be documented. All changes to the
mobile device, including power cycling and syncing, should be documented in your case
notes.
