Practical Mobile Forensics - Fourth Edition

The legal authority

It is important for the forensic examiner to determine and document what legal authority exists for the acquisition and examination of the device, as well as any limitations placed on the media prior to the examination of the device. For example, if the investigation on the device is being conducted based on a warrant, the search should be limited only to those areas that are defined in the warrant. In short, prior to the device seizure, you need to answer the following questions:

• If a search warrant does not exist, has the device owner consented to the search?
• If a search warrant exists, is the device included within the original warrant?
• If the device is included in the warrant, does it also define what data can be ...