A mobile forensic examination should be driven by a clear question. The aim is not simply to extract as much data as possible, but to preserve and examine relevant material in a controlled, explainable way.
The scope comes first
Before examination, the investigator should understand the relevant dates, applications, people, accounts and issues. A defined scope helps focus the work and reduces unnecessary intrusion into unrelated personal data.
Acquisition depends on the device
Available extraction methods vary by device model, operating-system version, security state and lawful access. Some examinations produce a broad extraction; others are limited to data that can be accessed through supported methods.
Analysis follows acquisition
Messages, call activity, images, documents, app data, locations and metadata may be reviewed depending on scope and availability. Findings should be linked back to their source and explained in context.
Reporting should distinguish fact from interpretation
A good report explains what was found, where it came from, what methods were used and what conclusions can reasonably be drawn.
- The handset and passcode where lawfully available
- Relevant SIM or removable media
- Charging cable if unusual or proprietary
- Known account details relevant to scope
- Any prior screenshots or exports
- A clear description of the questions to be answered
- Factory-resetting or updating the device before examination
- Installing recovery applications
- Excessive browsing through relevant apps
- Assuming a locked device means no evidence can be obtained