Mobile Forensic Investigations: A Guide to Evidence Collection, Analysis, and Presentation

4   Preparing, Protecting, and Seizing Digital Device Evidence

Conducting a proper initial investigation is a vital part of any forensic examination. How the evidence is prepared, seized, and then packaged after the proper seizure can be just as important, however. Data can be easily destroyed by improperly preparing and packaging a device.

The old adage “don’t sweat the small stuff” does not apply to the investigation of digital devices—particularly mobile devices. The small things are extremely important to the overall success of every investigation. “Bagging and tagging” the device using the proper procedures is not the only concern; the state of the device at the time of seizure and during property transportation and storage is also important. ...