官术网_书友最值得收藏!

Documenting the evidence and changes

Whenever possible, a record of all visible data should be created. It is recommended to photograph the mobile device along with any of the other media found, such as cables, peripherals, and so on. This will be helpful in case questions arise later on about the environment. Do not touch or lay hands on the mobile device when photographing it. Ensure that you document all the methods and tools that are used to collect and extract the evidence. Detail your notes so that another examiner can reproduce them. Your work must be reproducible; if not, a judge may rule it inadmissible. It's important to document the entire recovery process, including all the changes made during the acquisition and examination. For example, if the forensic tool used for the data extraction sliced up the disk image to store it, this must be documented. All changes to the mobile device, including power cycling and syncing, should be documented in your case notes.

主站蜘蛛池模板: 岢岚县| 油尖旺区| 大安市| 上栗县| 平度市| 镇巴县| 调兵山市| 北安市| 文化| 德清县| 敦煌市| 志丹县| 新田县| 息烽县| 隆昌县| 东辽县| 彰武县| 大关县| 安阳县| 泰顺县| 遂宁市| 喀什市| 灵宝市| 佳木斯市| 黄陵县| 新和县| 蓝田县| 莱西市| 澄城县| 兴安盟| 得荣县| 富顺县| 正定县| 密云县| 谷城县| 姚安县| 肇东市| 溆浦县| 读书| 奉节县| 报价|