Learning Android Forensics - Second Edition

Reporting

Documentation of the examination should be done throughout the process, noting down what was done in each phase. The following are a few points that might be documented by an examiner:

• The date and time the examination started
• The physical condition of the phone
• The status of the phone when received (ON/OFF)
• The make, model, and operating system of the phone
• Pictures of the phone and individual components
• The tools used during the investigation (including the version number)
• Data documented during the examination

The data extracted from the mobile device should be clearly presented to the recipient so that it can be imported into other software for further analysis. In the case of civil or criminal cases, wherever possible, pictures ...