3   Collecting Mobile Devices, USB Drives, and Storage Media at the Scene

Every successful examination starts with a successful physical seizure of the devices that hold the data and/or the repository (such as iCloud storage). A physical seizure involves taking possession of the container or containers in which the digital data is stored. This could be, but is not limited to, a server, Cloud storage, a computer desktop or laptop, a flash drive, a portable hard drive, and, of course, the mobile device itself.

Lawful Device Seizure

A successful physical seizure of the device along with its contents can be a complicated endeavor. Because the seizure process can be dictated by federal, state, and local laws pertaining to a person’s rights, if correct ...

Get Mobile Forensic Investigations: A Guide to Evidence Collection, Analysis, and Presentation now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.