Practical Mobile Forensics - Third Edition

Comparing extracted data to the handset data

Check whether the data extracted from the device matches the data displayed by the device. The data extracted can be compared to the device itself or a logical report, whichever is preferred. Remember, handling the original device may make changes to the only evidence—the device itself.