Information obtained from the technical analysis of a device may be of little practical value unless the information can be effectively disseminated. The presentation of information is often times as important as the information itself. Findings and opinions need to be presented in clear, concise terms.
The goal of repeatability is to be able to reproduce the same results of measurement carried out under the same conditions of measurement, as when the original steps taken to collect evidence and extract data are repeated.
When a smartphone or other mobile device is seized, or received as evidence, precautionary measures need to be taken to ensure that the integrity of the existing data is not compromised.
Some of the types of data that may be retrieved and examined during a smartphone forensic investigation, even after being deleted, include text messages, call times, dialed and received calls, and call duration.
When an examination is completed, the information is often reported in a form suitable for non-technical individuals. Reports may also include analysis and other metadata documentation.
"Forensic Examination of Digital Evidence: A Guide for Law Enforcement" Published by the US Department of Justice, this guide is intended for use by law enforcement officers and other members of the law enforcement community who are responsible for the examination of digital evidence. It includes guidelines, standards, best practices, and sample reports.
Get the most from smartphones and mobile devices. Mobile forensics tools are able to retrieve the list of installed apps and provide access to application data such as Dropbox, Evernote, Skype, WhatsApp, etc. Other data often extracted include contacts, calls, text messages, photos, and notes.
With more features than ever before, Notes is a common place where users store information.
An iDevice comes bundled with a wealth of apps for all sorts of tasks, including email and web browsing.
The Photos app is a one stop shop for organizing, sharing, and editing multitudes of photos.
Gaining access to an iDevice backup is often times very helpful in uncovering useful data.
Gives a user the instant ability to text in real-time, including the sharing of pictures, files, and more.
Since plists are actually XML files, they can readily be examined once extracted.
Cover 2 Investigations uses tools that can logically acquire Android and iPhone/iPad devices, forensically image Windows and Mac OS X computers, and can analyze data from all four major platforms. Other mobile devices and feature phones may also be supported. Please inquire with the make, model, and operating system of the device.
Digital forensic examiners/investigators must report and present the findings on a very technical discipline in a simplistic manner. A forensic report should simply and succinctly summarize the substantive evidence of the case at hand, so that it is easily understood by the reader. This may be a report being submitted to a supervisor, a client, an attorney, or a court in the matter of a civil or criminal proceeding.