Steps in Mobile Forensics

The cornerstone of digital forensics is the principle that evidence should always be correctly handled, preserved, and acceptable in court. Just a few legal issues are related to seizing a mobile device.

The two major risks involved with this step of a mobile forensic method are the cellular connection and the lock activation (by operator, suspect, or inadvertent related parties). Isolating a network is usually a great idea, and you have two different ways to accomplish it: either 1) deactivate wifi and hotspots on the phone and set it in aeroplane mode, or 2) duplicate the SIM card from your smartphone.

Airplane mode

The best approach to transport mobile devices is to attempt to keep devices powered on to prevent a shutdown that could inevitably alter files. This is because maintaining evidence is the purpose of their seizure.

Phone jammer

A Faraday box/backpack plus an external power supply are typical pieces of gear for forensics. The former is a box specifically designed to separate mobile phones from communication networks whilst still helping with the safe handling of evidence in a lab, in contrast to the latter, which is a source of power installed on the inside of the Faraday box. Upon placing the device in the Faraday box, disconnect the device from the network, disable all connectivity (GPS, wifi, etc.), and turn on flight mode to secure the information’s integrity.