Mobile forensics pr...
 
Notifications
Clear all

Mobile forensics protocol

9 Posts
6 Users
1 Reactions
2,503 Views
 dega
(@dega)
Reputable Member
Joined: 11 years ago
Posts: 267
Topic starter  

Dear collegue,

I am updating the procedures.

I know that if a smartphone is on to turn it off y removing the battery.

But if it is a phone with no removable battery? Which is the correct procedure?


   
Quote
(@deltron)
Estimable Member
Joined: 11 years ago
Posts: 125
 

In 2020 with FDE and FBE I would ask why would you want to turn the device off? This is a very old practice that will hurt you on new Android and iPhone device. If you have a iphone in AFU and you turn it off you just lost alot of data you potentialy had.


   
Styers reacted
ReplyQuote
 dega
(@dega)
Reputable Member
Joined: 11 years ago
Posts: 267
Topic starter  

but what should do LE in a situation of seizure of a Phone?


   
ReplyQuote
(@armresl)
Noble Member
Joined: 21 years ago
Posts: 1011
 
Posted by: @giandega

but what should do LE in a situation of seizure of a Phone?

Airplane mode, then keep it powered up until you find out what specifically you need to do with it.

No shortage of cables or outlets in examiner's offices/labs.

 


   
ReplyQuote
 dega
(@dega)
Reputable Member
Joined: 11 years ago
Posts: 267
Topic starter  

ok many thanks


   
ReplyQuote
(@giuseppem)
Eminent Member
Joined: 9 years ago
Posts: 25
 

In your knowledge, can Cellebrite UFED handle an iPhone in AFU state? Of course, it can perform a "BFU extraction".


   
ReplyQuote
Styers
(@styers)
Eminent Member
Joined: 7 years ago
Posts: 27
 

I advise my Deputies to keep powered on, Place in airplane mode or remove SIM card.

I have a set of lockers outside my office that they can place the device in and run a charger cord through a hole to keep the device charged until they get a search warrant for the device. I also keep a Faraday bag or two handy.


   
ReplyQuote
 dega
(@dega)
Reputable Member
Joined: 11 years ago
Posts: 267
Topic starter  

OK many thanks Styers


   
ReplyQuote
(@trewmte)
Noble Member
Joined: 19 years ago
Posts: 1877
 
Posted by: @styers

I advise my Deputies to keep powered ...... or remove SIM card.

And if the SIM Card requires the battery to be removed to gain access to it, how are you keeping phone powered?


   
ReplyQuote
Share: