
Mobile Forensics ◾ 269
from a network share to a local drive, and then tried to pass the work o as
being forensic. It is far better to send the original copy, along with an expla-
nation of what it is and how it came to be, that it is not forensic in nature.
In this case, I imagine the investigator may have said something like:
To whom it may concern. is hard drive contains a READ ONLY
restoration of a le copy that was made under circumstances where
a forensic acquisition was not possible. In order to preserve the
information from any future issues, I have placed the les into an
LEF, the password for which is ____.
Such a precaution ca ...