Mobile forensics pr...
 
Notifications
Clear all

Mobile forensics protocol

9 Posts
6 Users
1 Likes
1,775 Views
 dega
(@dega)
Posts: 261
Reputable Member
Topic starter
 

Dear collegue,

I am updating the procedures.

I know that if a smartphone is on to turn it off y removing the battery.

But if it is a phone with no removable battery? Which is the correct procedure?

 
Posted : 21/10/2020 1:10 pm
(@deltron)
Posts: 125
Estimable Member
 

In 2020 with FDE and FBE I would ask why would you want to turn the device off? This is a very old practice that will hurt you on new Android and iPhone device. If you have a iphone in AFU and you turn it off you just lost alot of data you potentialy had.

 
Posted : 21/10/2020 4:39 pm
Styers reacted
 dega
(@dega)
Posts: 261
Reputable Member
Topic starter
 

but what should do LE in a situation of seizure of a Phone?

 
Posted : 21/10/2020 5:21 pm
(@armresl)
Posts: 1011
Noble Member
 
Posted by: @giandega

but what should do LE in a situation of seizure of a Phone?

Airplane mode, then keep it powered up until you find out what specifically you need to do with it.

No shortage of cables or outlets in examiner's offices/labs.

 

 
Posted : 27/10/2020 9:07 pm
 dega
(@dega)
Posts: 261
Reputable Member
Topic starter
 

ok many thanks

 
Posted : 28/10/2020 7:20 am
(@giuseppem)
Posts: 24
Eminent Member
 

In your knowledge, can Cellebrite UFED handle an iPhone in AFU state? Of course, it can perform a "BFU extraction".

 
Posted : 15/11/2020 10:59 am
Styers
(@styers)
Posts: 27
Eminent Member
 

I advise my Deputies to keep powered on, Place in airplane mode or remove SIM card.

I have a set of lockers outside my office that they can place the device in and run a charger cord through a hole to keep the device charged until they get a search warrant for the device. I also keep a Faraday bag or two handy.

 
Posted : 20/11/2020 3:42 pm
 dega
(@dega)
Posts: 261
Reputable Member
Topic starter
 

OK many thanks Styers

 
Posted : 21/11/2020 11:29 am
(@trewmte)
Posts: 1877
Noble Member
 
Posted by: @styers

I advise my Deputies to keep powered ...... or remove SIM card.

And if the SIM Card requires the battery to be removed to gain access to it, how are you keeping phone powered?

 
Posted : 21/11/2020 11:35 am
Share: