官术网_书友最值得收藏!

Documenting the evidence and changes

Whenever possible, a record of all visible data should be created. It is recommended to photograph the mobile device along with any of the other media found, such as cables, peripherals, and so on. This will be helpful in case questions arise later on about the environment. Do not touch or lay hands on the mobile device when photographing it. Ensure that you document all the methods and tools that are used to collect and extract the evidence. Detail your notes so that another examiner can reproduce them. Your work must be reproducible; if not, a judge may rule it inadmissible. It's important to document the entire recovery process, including all the changes made during the acquisition and examination. For example, if the forensic tool used for the data extraction sliced up the disk image to store it, this must be documented. All changes to the mobile device, including power cycling and syncing, should be documented in your case notes.

主站蜘蛛池模板: 兴仁县| 景德镇市| 乐亭县| 河西区| 江永县| 上犹县| 宜丰县| 隆安县| 老河口市| 亚东县| 玉门市| 和田县| 弥勒县| 克拉玛依市| 凤城市| 乐东| 公安县| 万州区| 贵州省| 阜南县| 渭南市| 奉贤区| 肃南| 金阳县| 东乌珠穆沁旗| 河源市| 聂拉木县| 新营市| 屯昌县| 眉山市| 东安县| 榆社县| 昂仁县| 平度市| 西乌珠穆沁旗| 东阳市| 石泉县| 湛江市| 余姚市| 白河县| 广宗县|