Mobile, Cloud and Emerging-Source Forensics
Devices that are not disks
Mobile forensics is shaped by architecture: full-disk encryption, secure enclaves, and screen-lock state. Distinguish Before First Unlock (BFU) from After First Unlock (AFU) - far more data is accessible AFU. Acquisition methods include manual review, logical (backup-based), file-system, physical, and chip-off, each with different completeness and risk. Know where to look: SQLite databases behind messaging, call, and browser apps; location caches; keychain and keystore material; iTunes/Finder and iCloud backups; SIM data; and jailbreak or root artifacts.
Cloud forensics deals with shared responsibility and legal process. Data may reside only with the provider; acquisition typically requires account credentials, a provider export or API, or formal legal process (subpoena, warrant, MLAT, CLOUD Act). Provider-side logs - M365 unified audit, Google Workspace audit, S3 access logs - are often the best evidence of activity. Emerging sources include IoT devices, wearables, vehicles, drones, containers, virtual machines, and cryptocurrency wallets.
Traps
Assuming cloud content is present on the device - often only thumbnails or cached fragments exist locally. Assuming a provider can or will produce a forensic image. Overlooking two-factor authentication barriers, sync overwriting evidence, data residency, and provider-side time zones.
Worked example: a suspect's iCloud photos matter, but the seized phone may hold only low-resolution thumbnails in a cache database. Preserve the account identifier, obtain the full-resolution set through the provider's legal process or account export, and document the chain from account to file.