Note 3

The Forensic Analyst (or First Responder) should avoid touching the screen as much as possible, as this may activate the tablet computer and make changes to it.

Note 4

It may be possible to disable the account with the service provider.

Note 5

The Forensic Analyst must be aware of the possibility of the tablet computer being booby trapped or contain malware (e.g., Trojans to wipe the disk) and have a contingency plan in place if needed.

9.9.1.4.3 Acquiring Cell Phones

1. The cell phone to be imaged is connected to the acquisition machine via the write blocker to prevent evidence contamination.

2. Cell phone acquisition requires specialist software or tools and must only be undertaken by Forensic Analysts who are competent ...

Get Digital Forensics Processing and Procedures now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.