Skip to content

Mobile Acquisition

Evidence Integrity

Isolate the device from networks (airplane mode / Faraday bag) to prevent remote wipe. Document AFU vs BFU state.

Chain of Custody

Log passcode status, USB debugging changes, and every setting modified at the scene.

Mobile Devices

Types of mobile acquisitions

  1. Logical Acquisition: Provides SMS, contacts, call logs, media files (photos, videos, audio), and installed app information
  2. Does not include WhatsApp chats or other third party app data
  3. Information included when you do a phone backup
  4. File System Acquisition: Includes all logical data plus files, hidden files, and third party data like WhatsApp chats
  5. Physical Acquisition: : Bit-by-bit copy including deleted data
  6. Close to impossible on modern phones due to everything being encrypted
  7. Manual Acquisition (not forensically good)

[Diagram — add to assets/ if available]

Process Overview:

[Diagram — add to assets/ if available]

1.Disable Network and Passcode
  • Network Access should be disabled by turning off wifi and airplane mode
  • this is to prevent anyone from remotely wiping the device
  • Passcode should be disabled
2. Enable USB debugging and Stay awake settings
3. Connect to a portable battery

To prevent it from being switched off.
Why is it important that the phone not be removed/ SIM not be removed?
There are two stage of phone:

  1. After First Unlock
  2. Phone can be unlocked after first unlock using biometrics that can be obtained from the suspect
  3. Before First Unlock
  4. Here PIN/password is required and cannot be unlocked using biometrics alone, thus closing off access to the device
4. Transport using anti-static bags

[Diagram — add to assets/ if available]