Note 3

The Forensic Analyst (or First Responder) should avoid touching the screen as much as possible, as this may activate the tablet computer and make changes to it.

Note 4

It may be possible to disable the account with the service provider.

Note 5

The Forensic Analyst must be aware of the possibility of the tablet computer being booby trapped or contain malware (e.g., Trojans to wipe the disk) and have a contingency plan in place if needed.

9.9.1.4.3 Acquiring Cell Phones

1. The cell phone to be imaged is connected to the acquisition machine via the write blocker to prevent evidence contamination.

2. Cell phone acquisition requires specialist software or tools and must only be undertaken by Forensic Analysts who are competent ...

Get Digital Forensics Processing and Procedures now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.