Practical Mobile Forensics - Third Edition

The documenting and reporting phase

The forensic examiner is required to document throughout the examination process in the form of contemporaneous notes relating to what was done during the acquisition and examination. Once the examiner completes the investigation, the results must go through some form of peer review to ensure that the data is checked and the investigation is complete. The examiner's notes and documentation may include information such as the following:

• The examination start date and time
• The physical condition of the phone
• Photos of the phone and individual components
• Phone status when received—turned on or off
• Phone make and model
• Tools used for the acquisition
• Tools used for the examination
• Data found during the examination ...