官术网_书友最值得收藏!

Documenting the evidence and changes

Whenever possible, a record of all visible data should be created. It is recommended to photograph the mobile device along with any of the other media found, such as cables, peripherals, and so on. This will be helpful in case questions arise later on about the environment. Do not touch or lay hands on the mobile device when photographing it. Ensure that you document all the methods and tools that are used to collect and extract the evidence. Detail your notes so that another examiner can reproduce them. Your work must be reproducible; if not, a judge may rule it inadmissible. It's important to document the entire recovery process, including all the changes made during the acquisition and examination. For example, if the forensic tool used for the data extraction sliced up the disk image to store it, this must be documented. All changes to the mobile device, including power cycling and syncing, should be documented in your case notes.

主站蜘蛛池模板: 长寿区| 普兰县| 公主岭市| 太仓市| 陵川县| 岐山县| 大悟县| 中西区| 合山市| 霞浦县| 天津市| 芦山县| 黑龙江省| 于都县| 云林县| 虎林市| 崇仁县| 高唐县| 平江县| 贵阳市| 北京市| 正定县| 平昌县| 内乡县| 德格县| 聂拉木县| 江口县| 石河子市| 应城市| 礼泉县| 临朐县| 翁源县| 石家庄市| 乌鲁木齐县| 赣榆县| 伊金霍洛旗| 庐江县| 阳泉市| 黎川县| 广灵县| 平昌县|