Practical Mobile Forensics - Fourth Edition

The identification phase

The forensic examiner should identify the following details for every examination of a mobile device:

• The legal authority
• The data that needs to be extracted
• The make, model, and identifying information for the device
• Data storage media
• Other sources of potential evidence

We will discuss each of these in the following sections.