14   Presenting the Data as a Mobile Forensics Expert

Making a case after collecting a significant amount of data from a mobile device examination is only as good as the documentation. If the entire process, from seizure to data analysis, is not properly documented or explained in a way that’s appropriate for the audience, then a comprehensive and proper exam is often pointless.

Documentation is an examiner’s most important tool, especially when many different exhibits, methods, or custodians are involved. Without proper documentation, an examiner will be relying on memory or only the extracted and analyzed data. Recalling details from even a day prior is often difficult for most, let alone recalling every detail from the start of a process that ...

Get Mobile Forensic Investigations: A Guide to Evidence Collection, Analysis, and Presentation now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.