Practical Mobile Forensics - Fourth Edition

Data storage media

Many mobile phones provide an option to extend memory with removable storage devices. In cases when such removable media is found in a mobile phone that is submitted for examination, the storage card should be removed and processed using traditional digital forensic techniques. It is wise to also acquire the card while in the mobile device to ensure that data stored on both the handset memory and card are linked for easier analysis. This will be discussed in detail in the upcoming chapters.